Lockin: uma plataforma de assinaturas eletrônicas simples com identificação reforçada e acumuladores criptográficos RSA

Abstract

The increasing digitalization of legal, administrative, and commercial processes in Brazil has intensified the demand for electronic signature mechanisms that are both accessible and legally robust. In this context, simple electronic signatures stand out due to their ease of use and low cost; however, they lack native mechanisms to ensure the integrity, authenticity, and especially the non-repudiation of signed transactions. This work proposes and implements an enhanced-security model of simple electronic signatures designed to address these limitations without relying on digital certificates issued by the Brazilian Public Key Infrastructure (ICP-Brasil). The proposed solution integrates multi-factor authentication (MFA) to strengthen the digital identification of the signatory, combining facial recognition with liveness detection, delivery of one-time passwords (OTP) via WhatsApp, and the local generation of RSA cryptographic keys of 2048 bits directly in the user’s browser, with the private key kept under the signatory’s exclusive custody in a file encrypted through the PBKDF2 and AES-256-GCM algorithms. These mechanisms enable strong authentication and mitigate the risks of forgery or misuse of credentials. The generated signatures, along with their metadata — signatory identifier, timestamp, and IP address —, are recorded in an RSA-based cryptographic accumulator with a publicly unknown factorization modulus, which eliminates the need for a centralized key generation ceremony. This mathematical structure ensures the auditability and independent verifiability of transactions, allowing the existence and integrity of signatures to be proven outside the platform through a public validation endpoint. The methodology adopted is Design Science Research (DSR), oriented toward the development and evaluation of technological artifacts. The prototype was evaluated through functional tests, security tests and performance analysis, demonstrating technical feasibility and adherence to current Brazilian legislation. The main contribution of this work lies in the design of a simple electronic signature system incorporating advanced security and trust guarantees, accessible to organizations and users in low-cost environments, such as small businesses, digital public services, and individual citizens. The proposed solution is particularly relevant for strengthening trust in digital processes and expanding the adoption of electronic signatures in Brazil.