Secure Generation of Digital Signature on Compromised Computer

Although digital signatures are the basic elements of security-sensitive systems, the host computers that generate them are usually connected to the Internet and are constantly at risk of intrusion. The worst possible situation is when an intruder generates a user's legitimate signature against the user's intension. Therefore, unintended digital signatures must never be generated, even when the host computers have been compromised. In this paper, two conditions, i.e., secure confirmation of the target data and secure activation of the signature process, are presented for ensuring this type of security. The paper describes a new signature system that meets these conditions by using virtual machines, a tamper-resistant module, and a cryptographic protocol. The proposed system is as secure as the underlying virtual machine monitor.