The present invention relates to a computer-implemented method for signing a message by a user device of a public key infrastructure (PKI) system. The present invention further relates to a corresponding attestation server and a corresponding computer program product.
The de-facto technique for authenticating messages are digital signatures. Digital signatures allow the holder of a private key to generate a signature which can be verified using the corresponding public key. Such digital signatures are based on the property that no one except the holder of the private key can generate signatures that are valid under the public key. Digital signatures may be used e.g. during TLS client authentication and server authentication, for signing contracts and for e-mails.
To verify that a given public key belongs to a given entity, public key certificates may be used. Such certificates effectively bind a public key to a given entity. A certificate may be generated by a trusted authority of a PKI-system. The trusted authority, which is often denoted as certificate authority, issues a signature on the public key of the respective entity and on additional attributes corresponding to this entity, e.g., the name, the address and/or its affiliation. This signature, together with the information to verify it, then acts as the certificate.
In order for the digital certificate system to be secure, the private key of the signer must be kept secret. If the private key gets compromised, e.g., if a computer has been infected by malware, or a smart phone is lost, the certificate on the corresponding public key has to be revoked. This means that the certificate issued beforehand is not valid anymore and a verifier will reject a signature signed under the corresponding public key. The revocation may be done by informing the issuer of the certificate (certificate authority) and requesting a revocation of the certificate. The certificate authority may publish certificate revocation lists.
To verify a signature, a verifier must determine the validity of both the certificate and the signature itself. Hence usually a public key certificate is sent along with the corresponding digital signature. The verifier may determine whether a certificate is still valid by asking the certificate authority whether the certificate has been revoked and/or by checking revocation lists that have been published by the certificate authority. The validity of the certificate should be verified at each verification of the given signature.
Accordingly, there is a need for alternative methods for verifying signatures in a PKI-system.