Creation of a cryptographically secure electronic identity

Mobile device, the mobile device comprising a processor and a memory, the memory storing an ID application program for providing an electronic identity, wherein the processor is configured to execute a method for creating a cryptographically secured electronic identity of a user on a mobile device,

• wherein the ID application program comprises a control component for controlling the creation of the electronic identity, the ID application program further comprising a provisioning component for executing provisioning of the ID application program in the course of creating the cryptographically secured electronic identity,
• wherein the mobile device further comprises a security element, wherein the mobile device further comprises a communication interface for communicating via a network with a personalization server,
• wherein provisioning the ID application program comprises:
• in response to a security inspection request from the provisioning component, performing a remote security inspection of the security infrastructure of the mobile device using the control component by a personalization server over a network,
• receiving a result of the remote security inspection of the personalization server, which the control component forwards to the provisioning component,
• in response to a positive result of the remote security inspection, sending a key generation request from the provisioning component to the control component, which the control component forwards to the security element,
• in response to the key generation request, generating by the security element a first asymmetric key pair associated with the ID application program and a second asymmetric key pair associated with the ID application program, the first asymmetric key pair comprising a first private cryptographic key and a first public cryptographic key wherein the second asymmetric key pair comprises a second private cryptographic key and a second public cryptographic key, wherein the security element sends the first and second public cryptographic keys to the control component, which forwards the two public cryptographic keys to the provisioning component,
• upon receipt of the two public cryptographic keys, generating a certificate request by the provisioning component for generating a certificate of the ID application program comprising the first public cryptographic key, wherein the certificate request comprises the first public cryptographic key,
• sending the certificate request by the provisioning component over the network to the personalization server, the certificate request comprising the first public cryptographic key, wherein the provisioning component sends the second public cryptographic key to the personalization server in addition to the certificate request,
• in response to the certificate request, receiving the certificate generated by the personalization server with the first public cryptographic key and a root certificate of a root instance of a PKI by the personalization component,
• storing the certificate of the ID application program and the root certificate on the mobile device.