Security analysis and performance evaluation of facial biometry-based symmetric key generation for IoT peer-to-peer communication

Secure generation of symmetric cryptographic keys remains a significant challenge for Internet of Things (IoT) environments, where resource-constrained devices require lightweight authentication and encryption mechanisms that do not rely on central key distribution. This paper presents a comprehensive security analysis and performance evaluation of an operational facial-biometry-based key-generation system that establishes symmetric keys directly between two IoT peers using facial-feature coordinates, thereby eliminating the need for any server-side key exchange. This paper evaluates a biometric-based session key agreement protocol that enables two IoT users to compute identical symmetric keys from facial coordinates independently. The system is validated through 2000 experimental trials, comprising 1000 tests on synthetic facial-coordinate pairs and 1000 tests on real facial images, collected to assess key stability, robustness, and usability under diverse conditions. The security evaluation covers three representative attack categories: brute-force attacks against the key space, presentation attacks targeting the biometric acquisition stage, and man-in-the-middle attacks against the peer-to-peer communication channel. The resulting keys achieve high entropy and practical resistance to automated cracking, with estimated attack times that are far beyond the feasible computational limits of current tools. The paper compares the analysed system with state-of-the-art biometric key generation approaches in terms of key size, processing effort on IoT devices, and the security guarantees achieved, highlighting the trade-offs between protection strength and computational cost. The results show that the evaluated solution offers strong security properties while eliminating server dependencies and identifying usability constraints related to liveness detection, capture conditions, and environmental variability. The study provides actionable guidance for IoT security solution designers on balancing security, usability, and implementation complexity in biometric symmetric-key generation systems.