I'm trying to describe the architecture (or understand existing patterns) for a (trusted/self made) Mobile Application that needs to hold private keys to sign some information presented on the screen (let say it's finally presented as barcode). Let's asume we cannot avoid it and need to store private keys (RSA or ECDSA) securely as possibly.
I haven't found any standards for TEE that or Hardware Security Module that would for sure work on the "normal" Smartphones out there?
- I'm wrong here and Hardware+OS(Android/IOS) support this somehow meanwhile?
I'm aware of White-Box-Cryptography
- But how far can i go with White-Box-Cryptography? How to estimate it cryptoresistance? Any examples of the implementations?
P.S. Additionally the supporting backend can be designed as needed here. So e.g. exchanging of secure information onbehalf of the user (OAuth is used) can be done flexibly if it would improve the security... So let say, i we can exchange Keys in the app monthly or so (more often would be problematic). However getting any information from server is possible, but the solution has to work some offline time too Typical case: NO Internet for 10, 15 Minutes should be supported as far as possible.