Secure signature creation device

A secure signature creation device (SSCD) is a specific type of computer hardware or software that is used in creating an electronic signature. To be put into service as a secure signature creation device, the device must meet the rigorous requirements laid out under Annex II of Regulation (EU) No 910/2014 (eIDAS), where it is referred to as a qualified (electronic) signature creation device (QSCD). Using secure signature creation devices helps in facilitating online business processes that save time and money with transactions made within the public and private sectors.^{[1][2] [3]}

Description

The minimum requirements that must be met to elevate an electronic signature creation device to the level of a secure signature creation device are provided in Annex II of eIDAS. Through appropriate procedural and technical means, the device must reasonably assure the confidentiality of the data used to create an electronic signature. It further must ensure that the data used to create an electronic signature is unique and only used once. Lastly it shall only allow a qualified trust service provider or certificate authority to create or manage a signatory’s electronic signature data.^[2]

To ensure security, signature creation data used by the SSCD to create an electronic signature must provide reasonable protection through current technology to prevent forgery or duplication of the signature. The creation data must remain under the sole control of its signatory to prevent unauthorized use. The SSCD itself is prohibited from altering the signature’s accompanying data.^[1]

When a trust service provider or certificate authority places an SSCD into service, they must securely prepare the device according to Annex II of eIDAS in fully compliance to the following three conditions:^[4][1]

1. While in use or in storage, the SSCD must remain secure.
2. Further, a reactivation and deactivation of the SSCD must occur under secure conditions.
3. Any user activation data, include PIN codes be delivered separately from the SSCD after being prepared securely.

International security assurance requirements for SSCDs

The secure signature creation device must also meet the international standard for computer security certification, referred to as the Common Criteria for Information Technology Security Evaluation (ISO/IEC 15408).^[5] This standard gives computer system users the ability to specify security requirements via Protection Profiles (PPs) for security functional requirements (SFRs) and security assurance requirements (SARs).^[1][3] The trust service provider or certificate authority is the required to implement the specified requirements and attest to their product’s security attributes. A third-party testing laboratory then evaluates the device to ensure that the level of security is as claimed by the provider.^[6]

Central authentication service

When a secure signature creation device is used as part of a central authentication service (CAS), it may act as a CAS server in multi-tier authentication scenarios. The CAS software protocol allows users to be authenticated when signing into a web application.

The common scheme for a CAS protocol includes the client’s web browser, an application requesting authentication and the CAS server. When authentication is needed, the application will send a request to the CAS server. The server will then compare the user’s credentials against its database. If the information matches, the CAS will respond that the user has been authenticated.^[1][3]

Legal implications regarding secure signature creation devices

eIDAS has provided a tiered approach to determining the legal implications of electronic signatures. A signature that has been created with a secure signature creation device is considered to have the strongest probative value. A document or message that has been signed with such a device is non-reputable, meaning the signatory cannot deny they are responsible for the creation of the signature.^[2]

Regulation (EU) No 910/2014 (eIDAS) evolved from Directive 1999/93/EC, the Electronic Signatures Directive. The intent of the directive was to make EU Member States responsible for creating legislation that would allow for the creation of the European Union’s electronic signing system. The eIDAS Regulation required all Member States to follow its specifications for electronic signatures by its effective date of 1 July 2016.^[7][8]

References

1. Turner, Dawn M. "What is a secure signature creation device". Cryptomathic. Retrieved 18 November 2016.
2. Turner, Dawn. "Understanding eIDAS". Cryptomathic. Retrieved 12 April 2016.
3. "Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC". EUR-Lex. The European Parliament and the Council of the European Union. Retrieved 18 March 2016.
4. "Electronic Signatures and Infrastructures: Policy requirements for certification authorities issuing qualified certificates" (PDF). European Telecommunications Standards Institute. Retrieved 18 November 2016.
5. "ISO/IEC 15408-1:2009 Information technology -- Security techniques -- Evaluation criteria for IT security -- Part 1: Introduction and general model". International Organization for Standardization (ISO). Retrieved 18 November 2016.
6. Turner, Dawn M. "Trust service providers according to eIDAS". Cryptomathic. Retrieved 18 November 2016.
7. Turner, Dawn M. "eIDAS from Directive to Regulation - Legal Aspects". Cryptomathic. Retrieved 18 March 2016.
8. "Regulations, Directives and other acts". Europa.eu. The European Union. Archived from the original on 12 December 2013. Retrieved 18 March 2016.

External links

• www.iso.org/iso 22715:2006
• www.eur-lex.europe.eu/eIDAS