How is biometric data used to generate encryption keys? I understand that biometric data such as fingerprints and face patterns are matched for recognition with a certain degree of tolerance to account for differences given by empiric factors (positioning, aging, dirt, different measurement tool, etc.).

Given that's the case, how are biometric characteristics used to generate encryption keys to encrypt and decrypt data?

I.e. If you encrypt data using a particular reading of a biometric characteristic, wouldn't the small differences in future readings prevent you from successfully decrypting the data?
We do not know how to extract a cryptographically secure key $K\in\{0,1\}^k$ for traditional symmetric encryption from biometric data $b$ such as fingerprints, by way of a function $F(b)\mapsto K$. As noted in the question, problem is that when the biometric data is re-acquired, the naturally occurring $b'$ will be slightly different from $b$ and we'll have $F(b)\ne F(b')$ unacceptably often, for about uniform $K$ of cryptographic interest (e.g. $k\ge80$ bits). That's including if how $F$ operates (e.g. minutiae extraction) is carefully tailored to the characteristics of the biometric data [#].

Allowing $F(b')$ used for decryption to generate several guesses of $K$ (with the right one sorted out thanks to authenticated encryption) does not seem enough to get a workable system.

What does work is extracting a secure sketch as $S(b)\mapsto s$ so that


for naturally occurring variations $b'$ of $b$, with high likelihood, the same key $K\in\{0,1\}^k$ can be extracted from $(b,s)$ and $(b',s)$ (and some public nonce $n$ if we want multiple $K$), using a function $F(b,s)$ or $F(b,s,n)$
$s$ can be published without compromising the confidentiality of $K$ or/and $b$; including if $s'=S(b')$ gets published for several naturally occurring variations $b'$ of $b$.


A search for articles on secure sketch returns a lot of bibliography.

However the interest of biometric data as encryption key is dubious: biometric data, in particular fingerprint, is hard to keep secret, which is the primary attribute desired for an encryption key. Using fingerprints as a means of identification makes much more sense.



[#] Note: all claims to the contrary that I met fall into at least one of these pitfalls:


the error rate is unacceptable, like for >5% of a population, an attempt to obtain the same $K$ a day after fails, even will allowance of two retries;
some ancillary data (similar to $s$ above) is required along $K$ or stored in the scanning device (thus in the later case the number of users is limited, replacement of a failed single scanning device cause disruption, and multiple scanning devices must communicate in order to produce the same $K$);
$K$ has very low entropy (say &lt;40 bits), making it vulnerable to better-than-brute-force key search, and even conceivable that two users accidentally end up with the same $K$ if nothing but their biometrics is an input;
some part of the method must remain secret, and is how the previous issue is masked.