Verification and analysis of solution based on mobile PKI for signing and user identity

As mobile devices become more popular, there is an increasing need for user identification and digital identity verification for online and offline transactions. In certain countries, mobile phones are widely available at affordable prices, offering identity solutions based on either subscriber identity module (SIM) or hardware security module (HSM) that operate on public key infrastructure (PKI). This paper proposes a novel solution for a mobile identity framework based on elliptic curve cryptography (ECC) encompassing user authentication and signature. Our proposed approach is hardware-agnostic and does not rely on a SIM card. Additionally, it is cost-efficient without any third-party dependency. We perform informal security analysis to prove that our framework is secure from various attacks. Furthermore, we conduct formal security evaluations utilising the Scyther Security Protocols Tool and Burrows-Abadi-Needham (BAN) logic. We also evaluate the performance of our system and compare it with other protocols.