Comparative Analysis of User Authentication Technologies for On-Premises Cloud Systems with Key Derivation: Face Biometrics, PIN and Fuzzy Extractors

On-premises cloud platforms cannot rely on external identity providers, and their stored data must be encrypted with user-bound keys, yet most authentication technologies only grant access without producing a cryptographic key. This paper compares six technologies — password, password + TOTP, OAuth 2.0/OIDC, a hardware token (FIDO2), face biometrics alone, and face + PIN with a fuzzy extractor — on six criteria: verifier-theft and phishing resistance, key derivation, offline operation, usability and revocability. An ordinal weighted-sum model, tested for stability over 100,000 random weight vectors, ranks face + PIN and FIDO2 jointly first (probability of rank 1 ≈ 0.50 each). A guessing-work analysis shows that jointly bound face + PIN verifiers yield 31–45 bits against 18–27 bits for separate verifiers, and a closed-form decoding model of the concatenated code agrees with prototype measurements on LFW (FAR 2·10⁻⁶ at FRR 1 %).