The key to secure mobile signature: from password-based protection to two-party signatures

Abstract

Nowadays, the widespread deployment of cryptographic mechanisms is inextricably linked to the use of mobile devices. However, this introduces the problem of their relatively low level of security — both in organizational and technical-engineering aspects. This requires that hardware and software solutions provide protection not only within standard adversary models but also within extended ones, which assume that some of the basic security requirements for safe operation have been violated, resulting in the compromise of the device or the user’s password. This paper presents an analysis of the security of five common classes of solutions for electronic signature operations under several representative extended adversary models. Additionally, the study examines the necessity of establishing trust to an additional party involved in the interaction.