Hypothesis: Everyone have it's own typing style, just as the hand writing.
So, if the computer can analyze the typing rate it can identify the user properly.
The proposed algorithm is to measure the time intervals between the keystrokes and to collect them (as arithmetic mean) in the matrix of NxN numbers where N is the count of the examined keys. After some time we'll have the average time to press key X after the key Y. IMO, the set of examined keys should include all alphabet keys, regular and capital.
Then we will need some function to compare the result matrix with the stored user sign matrices in order to determine what is the user and with what probability.But here, my mathematics skills are little bit insufficient.

For two factor authentication?

What?

I'm just curious about the purpose. As a second factor for authentication?

Well it depends on the reliability and on the count of keystrokes needed for trustworthy identification. It could be used even as a main identification instead of password, if the above factors are adequate enough.
On the other hand, even if the needed count of keystrokes is big, if someone stole your password he will be identified as an intruder after some time of typing on your computer and the account can be locked.

If I have a sore finger will my typing style change?

When I am positioned differently (on a desk compared to an aeroplane chair) will my typing style change?

If I am upset/happy/sad/angry/pleased will my typing style change?

Well, it is only hypothesis, as I already wrote. IMHO, the emotional factors and the keyboard type, position etc. will not affect the work of the system. At least, the type of the pen and sore fingers will not affect your hand writing style enough to not be identified.
Again, it is only raw idea. I didn't make any experiments, because I simply don't have enough free time.

what about a password, using not only one key at a time, but using any key of the keyboard scancode table as a component of a password element.

a password element is currentlly a char (in the very large majority)
some passwords are path inside a grid (like on smartphones now)
and maybe it would be possible, in PC world, to introduce multikey password.

the password element will then be a combinaison of keys.

of course, it would be harder for user to understand the idea. but if you can enter your password as not only chars, but also time between them, and also simultaneous keys for a certain time, it would be a little fun.

in the case you loose your fingers, and can only type a key at a time, it is a little frustrating, but here, it is more the time to ask an enabled people to type for you the password, and invent a new way to type password, where you are disabled.

i've tested the multikey password, it seems to be cool to enter a password this way, and not so hard to retype the correct sequence, assuming you remember it.

for example:
a key for 1 time, add the b key for 2 more times, then enter the string baba without simultaneous keys, and hit enter+alt+echap+p+q+*, release enter then echap, then p, then q, then hit tree times *.

this kind of password would be hard to crack as the password element will not be a simple byte, but will be a variable size field, that should be fitted in order to pass to the next password element.

There are many types of password systems. All of them have one big disadvantage - you must remember something. This way, someone skilled in "rubber hose cryptanalysis" can break your password protected resources without any problems.
That's why there are different biometric identification technologies - fingerprint detection, face recognition etc. They need some special hardware, or some complex image recognition software (and what if I forget to shave myself).
My idea is similar to biometric identification, but without special hardware and with (maybe) simple software.

how to detect, with 99,9999% accuracy, the typing style?

have you still made some experiments with yourself, to see if it is valuable?

i wonder the coding style would be quite different from a guy to another, but not only, it can be very similar too, and also, a unique guy can have different typing styles, depending on the mood and so more factors, that a machine cannor determine with 100% certainty if the human is the owner or not of the style registered.

the table needed to do this job can be a single 64KB memory segment, where the 128 keys of the keyboard will be used as coordinates in a table, where each element is a set of parameters for the current key pair.
the key before, the key after, used as coordinates, and of course, the content, with our precious datas about how a user will type.

that's a pretty idea, and it needs some experiments first.

i think there will be a tolerence to insert, and the time between keys would not be in milliseconds, but only tenth of a second would be enough, leting a byte hold up to 2.5 seconds between keystrokes, oven, it is concidered as a 2.5 second time. 2.5 second to find a key is very long you know. by recording several samples for each key pair, maybe it would be possible to enhance the accuracy and tolerence to variations.

a first good exercice would be to do a one or two hands typing style.

after, doing a which hand hit witch key., and so on, only the imagination is a limit.




yeah, it's a good idea.

I don't think it possible know who is on the other side just by the way he types. Yes, under normal conditions the typing should have some time pattern.
But when I write, sometimes i have to correct my self, some times I might be tired so I type more slowly. Some time I could be angry on some dude in some forum... so the typing isn't constant.

Same for my password, you could type it with two hands, but when you have a cup of coffee in one hand, you type the pass with the other.

theres to much stuff going on.

if the intruder already know the password, he will just type it few times till he get the timing.

how about an identification method using story based?

so, it is the user who start a story everytime he log in, (system will provide him with a keyword to be added into his story)

eg.
registration, on a sunday morning, (keyword = swimming)

so, user add a pass phrase, i go to swimming pool with jesus

,

so next time, when the user login,

system will present authentication like below.

choose the following which is truth.

1. monday morning to church
2. jesus sunday
3. altavista and the internet
4. go pool with moses

so, the user will choose and then presented with another keyword to add into his story

what you think?

I find this idea good, keep on going !

@edfed: I think it would need a multi-dimensional table, e.g. a fourth- or fifth-order Markov chain. Think about the patterns you always return to when typing - certain words just roll off your fingertips in a particular way, and to learn a pattern based on relative timings between keystrokes would require tracking sequences of at least 4 or 5 keystrokes, maybe more...

For people like me who've learned to type quickly but not 'properly', I think a suitable algorithm could identify me based on my (bad) typing habits. But what about the Mavis Beacon brigade? People who've learned to type properly probably all exhibit similar behaviour - their fingers have all been trained to follow the same patterns of movements.

This idea would fail. What if you are holding a drink and typing with one hand ?

Also, if it had to use intervals one would easily emulate your keystrokes using keybd_event or SendInput.

Just use an eye scanner and fingerprint scanner and you're done.

For the fingerprint thing, there is an episode of mythbusters about it, and how easy they are to cheat.

http://www.bayometric.com/products/USB-Fingerprint-Scanners-LiveScan-Systems.htm

This is not a good argument. You can use keyboard scanners in same way to get the keyword. I like the idea of typing because you can write the password down and nobody suspect it has to be typed in in a special way.

And it's good to prevent computers to be used in a drunken state.
And you don't need complicate hardware. Personally I don't like to watch in a laser scanner. And don't want somebody to cut my fingers for getting the fingerprint.

This has already been done.

http://en.wikipedia.org/wiki/Keystroke_dynamics#Use_as_Biometric_Data

Too bad, they outstrip me again. But I don't know a program that use this method.