Providing security to usage of long-term keys in case of semi-trusted secure environment

Abstract

The task of enabling usage of cryptographic software (especially, for working with digital signature) with general-purpose mobile devices (e.g., smartphones with iOS or Android operation systems) is inevitably discussed during all conference discussions dedicated to mass-market cryptography. Users are used to performing their everyday operations with smartphones. Lower level of trust to such devices as environment for cryptographic software must always be kept in mind while developing systems involving them in processes; nevertheless, integrated additional security measures have made possible significant increase of security on such devices and, therefore, certification and usage of cryptographic software for mobile devices. At the same time, the question of providing secure and convenient ways of using long-term keys in hardware tokens with mobile devices still requires further research. In the current paper, we do a review of existing ways of using cryptographic tokens with long-term keys via mobile devices and develop approaches for solving this task in real-world scenarios based on recently developed protocols for password-based authenticated key establishment with proven security.