In this paper, the issue of generating and sharing biometrics based secure cryptographic keys is addressed. In particular, we propose a protocol which integrates multi-biometrics, in which information from multiple biometric sources is combined. This protocol allows generation and sharing of multi-biometrics based crypto-biometric session keys. The protocol achieves mutual authentication between a client and a server without the need of third party certificates. The stored templates are revocable/cancelable and thus protect user privacy. The most distinctive feature of this protocol is that it can integrate multi-biometrics and depending on the required security level, the choice of the biometric modalities to use can be made at runtime