![](bg8.png)
In this work, we reduce cryptographic service
providers to three different types namely software,
hardware, and remote providers. Our case study
showed that current applications cannot assume to use
one specific provider even on the same device class.
Furthermore, we found that the characteristics of an
application can change considerable by changing the
provider type. Not knowing which provider is going
to be used can therefore compromise security of an
application. And finally, our security analysis showed
that no single provider can excel in every use case.
Based on these findings we create a list of features
that we believe would answer the challenges given:
• an application has to use the cryptographic service
provider which is most suitable for a task at hand,
• modern multi-device users need to access their
cryptographic keys wherever and whenever in
need,
• the user deserves to decide which cryptographic
service provider she wants to use, and
• it is crucial for applied cryptography to be easy to
use for users and developers.
These features are not yet available in applied cryp-
tography and we believe that providing these features
will get personal data security up to speed again.
REFERENCES
Backes, M., Bugiel, S., Derr, E., Gerling, S., and Hammer,
C. (2016). R-droid: Leveraging android app analysis
with static slice optimization. In Proceedings of the
11th ACM on Asia Conference on Computer and Com-
munications Security, ASIA CCS ’16, pages 129–140,
New York, NY, USA. ACM.
Baumgärtner, L., Graubner, P., Schmidt, N., and Freisleben,
B. (2015). Andro lyze: A distributed framework for
efficient android app analysis. In 2015 IEEE Interna-
tional Conference on Mobile Services, pages 73–80.
Chang, V., Kuo, Y.-H., and Ramachandran, M. (2016).
Cloud computing adoption framework: A security
framework for business clouds. Future Generation
Computer Systems, 57:24 – 41.
Chang, V. and Ramachandran, M. (2016). Towards achiev-
ing data security with the cloud computing adoption
framework. IEEE Transactions on Services Comput-
ing, 9(1):138–151.
Egele, M., Brumley, D., Fratantonio, Y., and Kruegel, C.
(2013). An empirical study of cryptographic misuse in
android applications. In Proceedings of the 2013 ACM
SIGSAC Conference on Computer & Communi-
cations Security, CCS ’13, pages 73–84, New York,
NY, USA. ACM.
Fernandes, D. A. B., Soares, L. F. B., Gomes, J. V., Freire,
M. M., and Inácio, P. R. M. (2014). Security issues in
cloud environments: a survey. International Journal
of Information Security, 13(2):113–170.
Gutmann, P. and Grigg, I. (2005). Security usability. IEEE
Security & Privacy, 3:56–58.
Halpin, H. (2014a). The W3C Web Cryptography API:
Design and Issues. In Proceedings of the 5th Inter-
national Workshop on Web APIs and RESTful design
(WS-REST), Seoul, Korea.
Halpin, H. (2014b). The W3C Web Cryptography API: Mo-
tivation and Overview. In Proceedings of the Compan-
ion Publication of the 23rd International Conference
on World Wide Web Companion, WWW Companion
’14, pages 959–964. W3C.
Kimak, S., Ellman, J., and Laing, C. (2012). An inves-
tigation into possible attacks on HTML5 indexedDB
and their prevention. In The 13th Annual PostGradu-
ate Symposium on The Convergence of Telecommuni-
cations, Networking and Broadcasting (PGNet 2012),
Liverpool, UK. Liverpool John Moores University.
Kimak, S., Ellman, J., and Laing, C. (2014). Some Potential
Issues with the Security of HTML5 IndexedDB. IET
Conference Proceedings, pages 2.2.2–2.2.2(1).
Lazar, D., Chen, H., Wang, X., and Zeldovich, N. (2014).
Why does cryptographic software fail?: A case study
and open problems. In Proceedings of 5th Asia-
Pacific Workshop on Systems, APSys ’14, pages 7:1–
7:7, New York, NY, USA. ACM.
Mohamed, I. and Patel, D. (2015). Android vs ios secu-
rity: A comparative study. In 2015 12th International
Conference on Information Technology - New Gener-
ations, pages 725–730.
National Institute of Standards and Technology (2001).
FIPS140-2: Security Requirements for Cryptographic
Modules.
Reimair, F. (2011). Trusted virtual security module.
Reimair, F. (2014). Cloud-based signature solutions: A sur-
vey. Technical report, Secure Information Technology
Center - Austria.
Reimair, F., Teufl, P., and Zefferer, T. (2016). CrySIL:
Bringing Crypto to the Modern User. In Web Informa-
tion Systems and Technologies, volume 246 of Lecture
Notes in Business Information Processing. Springer.
Reiter, A. and Zefferer, T. (2015). Power: A cloud-based
mobile augmentation approach for web- and cross-
platform applications. In Cloud Networking.
Ren, K., Wang, C., and Wang, Q. (2012). Security chal-
lenges for the public cloud. IEEE Internet Computing,
16(1):69–73.
Santos, N., Raj, H., Saroiu, S., and Wolman, A. (2014).
Using arm trustzone to build a trusted language run-
time for mobile applications. In Proceedings of the
19th International Conference on Architectural Sup-
port for Programming Languages and Operating Sys-
tems, pages 67–80, New York, NY, USA. ACM.
Sleevi, R. and Watson, M. (2014). W3C Candidate Recom-
mendation: Web Cryptography API.
Varadharajan, V. and Tupakula, U. (2014). Security as a ser-
vice model for cloud environment. IEEE Transactions
on Network and Service Management, 11(1):60–75.
SECRYPT 2017 - 14th International Conference on Security and Cryptography
374