  Users' devices, e.g., smartphones or laptops, are typically incapable of
securely storing and processing cryptographic keys. We present Tandem, a novel
set of protocols for securing cryptographic keys with support from a central
server. Tandem uses one-time-use key-share tokens to preserve users' privacy
with respect to a malicious central server. Additionally, Tandem enables users
to block their keys if they lose their device, and it enables the server to
limit how often an adversary can use an unblocked key. We prove Tandem's
security and privacy properties, apply Tandem to attribute-based credentials,
and implement a Tandem proof of concept to show that it causes little overhead.
