Discussion item local signature computation and the use of a third-party

[Ernst Jan van Nigtevecht <EJvN@Sonnenglanz.net>]

Hello,

The use of a third-party to compute the digital signature value may be
hijacked in the channel to the mobile device (or at the third-party).
For instance, if a different digest (and thus document) is used in the
message that is received by the mobile device, the user will sign some
other document, without knowing it. (The risk is of course related to
how the third-party protects the message to the mobile device and how it
deals with the messages of the DSS server.)

The mobile device cannot identify this situation (the challenge code
does not protect the digest...); the hijacker does not change the
challenge code :-)

Because the DSS server must be trusted anyhow (it's the service that
calculates the digest and sends it to the third-party) we could propose
that at least the digest+challengeCode must be signed by the DSS server
and included into the message to the third-party (and mobile device).
The mobile device must be able to verify this, of course (and it should
explicitly trust the certificate of the DSS server). This imposes some
requirements for the mobile device to verify the basic signature.

It is very likely that there are other solutions as well (? mTAN
WS-transaction ?, ...); I've not researched on this topic. Or do you
think we can leave it as it is, for now...

What do you think?

Regards

Ernst Jan