Mobile-Only Solution for Server-Based Qualified Electronic Signatures

Many transactional e-Government services require qualified electronic signatures (QES) for the secure authentication of citizens. Additionally, the offer of electronic services shows a trend towards purely mobile solutions. Existing server signature solutions require the use of two separate devices (PC and mobile device) to provide two separate communication channels for authentication. This requirement causes a usability issue, especially when using mobile-only services on the mobile device. New technologies of modern smartphones such as secure hardware elements and biometric authentication methods can provide secure authentication for a server-based signature solution using only one authentication channel. This paper provides a new server-based signature solution for QES that only requires a single mobile device for authentication against a remote trust service provider. This solution increases the usability of the authentication by only requiring one mobile device and provides the integration of new authentication methods (e.g. fingerprint) used in the authentication procedure. The novel concept is implemented as a productive solution and rolled out on a national level in Austria used for the national electronic identity management (eID).