A new era for e-signatures – how eIDAS is shaping the future of high-trust signing

eIDAS has helped herald a new era of e-signing for businesses operating across Europe. E-signatures provide a fast, secure, efficient and cost-effective alternative to paper signing and the eIDAS regulation ensures legal certainty across the EU with its requirements for Basic, Advanced and Qualified e-signatures.

Qualified Electronic Signatures provide the highest level of assurance and non-repudiation. To comply with the eIDAS requirements for Qualified Electronic Signatures an e-signature must:

• Be uniquely linked to the signer
• Be able to identify the signer
• Be created under the signer’s sole control
• Be able to detect any subsequent changes to the data
• Have a digital certificate issued by a trusted, qualified certificate authority
• Use a signing key managed within a trusted Qualified Signature Creation Device (QSCD)

These requirements deliver cross-border recognition and ensure the same legal framework for any documents signed using Qualified Electronic Signatures across the EU. 

Advancements in remote signing

As well as the implementation of eIDAS, e-signatures have been enhanced with the development of remote signing. Until recently many high-security industries used local signing solutions to sign electronic documents.

Local signing requires locally-held hardware such as a smartcard or token and specialized software to validate e-signatures. The major drawback of local signing is that it requires the signer to carry cumbersome hardware with them to sign – this is especially arduous if the signer is on the move and needs to e-sign urgently. 

In contrast, remote signing utilizes connected mobile devices to enable signing authorization from anywhere. Individual signing keys are held in server-based systems or secure cloud services on a Hardware Security Module (HSM).

The Ascertia ADSS SAM Appliance has an embedded HSM, Utimaco’s CryptoServer CP5 HSM, which is Common Criteria (CC) EAL4+ certified according to the eIDAS Protection Profile EN 419 221-5.

eIDAS recognizes remote signing and supports its use for the creation of remote qualified signatures – the highest trust level for signatures in Europe.

In order to be compliant with the eIDAS regulation for Qualified Remote Signatures it is important to be able to provide proof that the signing keys were always under the sole control of the user and they reside within the premises of a Qualified Trust Service Provider (QTSP). Ascertia’s ADSS SAM Appliance is a tamper protected device that authenticates signers and requests formal authorization to use their signing key.

Ascertia is currently undergoing Common Criteria EAL4+ certification for the eIDAS EN 419 241-2 standard to ensure compliance with the eIDAS regulation for creating remote qualified signatures with Level 2 Sole Control.

The below video demonstrates how Ascertia’s ADSS SAM works:

Remote Signing - How it works from Ascertia on Vimeo.