Defining Unified Signature API Library for Mobile Apps to Integrate with Secure Signature Creation Devices (SSCDs)

Secure Signature Creation Devices (SSCDs) are building blocks for performing a legal value digital signature. As the world moves more towards digital transactions, it increases reliance on digital signatures. Interfacing and enabling a SSCD to work with a mobile phone application allows these applications to perform digital signatures of legal value (i.e. Qualified Electronic Signatures - QES, in EU). However, the lack of standardized APIs for interfacing SSCDs with mobile apps poses significant hurdles to widespread adoption. and poses many challenges. This paper introduces a novel approach to address the challenges of integrating Secure Signature Creation Devices (SSCDs) with mobile applications by proposing a solution called MUSAP utilizing Unified Signature API Library. MUSAP enables secure communication between mobile apps and SSCDs, ensuring the protection of private keys and compliance with legal frameworks such as the eIDAS regulation. Implementation details and use cases demonstrate the practical application of MUSAP, showcasing its versatility in supporting both centralized and decentralized identity technologies. The entity issuing identity assertions (certificate or verifiable credential) holds the responsibility for verifying both user's identity, key material and provide a Level of Assurance (LoA) selection mechanism. Key material verification can be achieved by Controlling the key generation process, verifying device trust and relaying key attestations. MUSAP is released as open-source solution at in Github.