Public Consultation on Electronic identification, authentication and signatures

As always, the last day comes quickly without enough time to prepare a sound document.

But tomorrow is the last day for this consultation and I though that my opinion could help to others.

Public Consultation on Electronic identification, authentication and signatures

1. Respondent information

Are you replying: On behalf of an organisation

Please provide the name of your Organisation EAD Trust, European Agency of Digital Trust

Please provide if applicable, your interest Representative Register ID number

Please indicate which type of stakeholder you are Small or medium-size enterprise

Please provide your Name and Surname Julian Inza

Please provide your email address julian@eadtrust.net

Your country of residence Spain

2. General expectations regarding EU legislation on e-signatures, e-identification and e-authentication

Question 1: Do you / Does your organisation use e-signatures, e-identification and e-authentication? yes

If yes, what are your specific needs? Secure transactions Unambiguous identification of contract partners Integrity of electronic documents Legal effect Legal effect, contract signatures in particular User convenience Others

Please comment why Electronic invoice, electronic documents of all kinds, electronic evidence

If yes, how frequently do you carry out secure transactions? Daily

Question 2: For what online transactions do you consider electronic identification, authentication and signatures useful in coming years? eGovernment services Electronic Public Procurement eCommerce transactions eBusiness transactions Online banking and financial transactions Issuance of authentic electronic documents Secure archiving or storage of authentic electronic documents Others

Please comment why electronic invoices, secure identification in social networks, electronic banking, web services, automated electronic seals,…

Question 3: What socio-economic benefits or drawbacks do you expect from the use of electronic signatures, identification, and authentication in other sectors of activity than yours? A huge improvement in efficience and costs reductions. More security, more convenience, tele-operations of all kinds

Question 4: Would a stronger involvement of financial institutions in the provision of trusted e-signature and e-identification services have an impact on the take-up of e-signature and e-identification in other sectors? yes

If yes, what would be the appropriate incentives? A simpler way to manage revocation information of certificates and to define trusted root certs and chain of trust&nbsp

Question 5: Do you think that there are specific interoperability or security aspects that should be taken into account to foster the use of electronic signatures, identification and authentication through mobile devices (e.g. requirements on the SIM cards, on the handset, on the mobile operator)? yes

If yes, regarding: operational technical

Question 6: For which of the following trust building services and credentials should legal or regulatory measures be considered at EU-level in order to ensure their cross-border use and why? Electronic seals Time stamping Long term archiving Certified delivery of mail Pseudonyms Certified electronic documents in general Others (please list)

Please list Long term accesible digital custody /electronic chartulary /electronic headoffice /secure verification code / certification validation services

3. e-signatures tailored to face the challenges of the digital single market

Question 7: How do you judge the take-up of electronic signatures in Europe? Very high

Please comment why Citizen ID cards are being adopted in advanced countries, which include 2 or more certificates. Virtuous circle fosters the creation of adapted services

Question 8: Which of the following issues have a negative impact on the uptake of e-signature? You may select up to three answers that have according to you the most important impact. Lack of user-friendly signature solutions Others

Please comment why Poor solution for trust discovery of roots CA, bad implementations of OCSP in AIA extension of certificates, insufficient use of timestamping / not enough use of complete (AdES_XL) signatures, legacy management of CRLS to OCSP responses (bound to grace period), excesive use of CRLs for validation

Question 9: Which of the following specific issues have an impact on cross-border interoperability of e-signatures in Europe and should be addressed in a revised legal framework on e-signature (the references point to the articles and annexes of the eSignatures Directive)? Unclear terminology in Directive 1999/93/EC and heterogeneous terminology in national legislations Heterogeneous approach to security requirements (e.g. certification requirements on the signing software in some countries) Insufficient harmonisation of profiles of qualified certificates Other

Please comment why Lack of clear definition of electronic seal for legal persons, lack of clear definition of codes to inform about power of attorney in certificate extensions, unclear effect of qualified certificates without secre signature creation devices, lack of clear definition of automated signature&nbsp

Question 10: Which among the following options could be solutions for signature verification and validation at EU level? Other

Please comment why Common list of OCSP services and timestamping services for all Trusted CAs in Europe. Signature software that creates always AdES-XL signatures including Timestamping and OCSP validation, getting the OCSP address from the AIA field of the certificate. OCSP services with grace period=0, supplied by the CA issuing certificates or a entity in its behalf, forbid the use of CRL for validation purposes. Relying party software that verifies XL signatures, Digital custody for secure storage of signatures,

Question 11: Do you have specific expectations from e-signature standardisation to cover? Mass signature (server signing) Mobile signature creation devices Remote signature Others

Question 12: Do you use «qualified» e-signatures? yes

If yes, how often per month and for which kind and value of transactions? 3/4 per month. Transactions not connected to value. I believe transaction amount limits are relevant only to a few kinds of signatures.

Question 13: What is your view on the need to revise the security provisions of «qualified» e-signatures? The current provisions should stay as they are

Question 14: Would a classification of a range of e-signatures be desirable to match different levels of security? Yes, a classification would be convenient, it should be defined by law and a legal effect should be associated to each or some classes.

Please comment and explain for which usage a classification would be desirable. legal person seal, automated signature, powers of attorney with use limits, SSL certificate with legal effects, sinonimous certificates and their effects, qualified certificates without SSCD. person associated to a company or government body acting in assigned role but not needing a representation letter or power

Question 15: Should «electronic consent» be recognised formally by future European legislation? yes

If yes, should legislation (where necessary supported by operational and technical standards) define specific requirements on: Others

Please explain why It is already recognized in standards and is named «content commitment». When a certificate has that bit activated, should verify a proof of consent, including a turing test demonstrating the user has read the message and asking clearly for consent. This kind of use should generate evidences for all involved parties and, where possible, an accesible digital custody (chartulary+electronic headoffice+secure verification code) receipt for them)

Question 16: Should «electronic consent» be considered as equivalent to electronic signatures? yes

Question 17: Are there specific aspects that should be taken into account to address electronic archiving? yes

If yes, please specify the legal provisions which are needed in your opinion to address electronic archiving needs? All electronic documents (signed or not) with legal effect, should be available under security considerations applied to archive (WORM), through a URL of trusted sites (electronc headoffice), with the help of a secure verification code. With additional measures for preserving privacy in specific cases, or to allow to be accessible to third parties for proof or evidential reasons. Paper documents or receipts withs URL and SVC, that can be verified against the electronis versions are considered trustworthy equivalent to authentic documents

4. Principles to guide e-identification and e-authentication in europe

Question 18: Do you see a need for additional legal or regulatory measures on electronic identification at EU-level? yes

If yes, in your opinion, what are the general principles that should underlie the legal provisions on the mutual recognition and acceptance of e-identification at EU-level? Others

Please comment compatibility&nbsp

Question 19: What effects for the digital single market do you expect from legal provisions on an EU-wide mutual recognition and acceptance of eID issued in the Member States? Legal certainty Reduction of administrative burden Other

Please comment why Simplicity for citizen to exercise their rights in all countries, Convenience for citizens, efficience for government bodies and enterprises

Question 20: How could users provided with electronic identification and authentication means benefit from their mutual recognition and acceptance across Europe and in which sectors? Increase of user convenience Simplification of access to online services Reduction of numerous UID/passwords Reduced exposure to ID theft Others

Please comment why Use in day by day in non online services, to dematerialice paper

Question 21: What are the specific aspects that should be taken into account to achieve cross-sector interoperability of electronic identities? Others

Please comment why Common list of trusted CAs and their roots, Common profiles, common OIDs definitions, Correct codification of OCSP servers in AIA fields

Question 22: Please indicate experiences and lessons learned in the private sector that could be transferred to the public sector. Please make everything EASY for the final user. And define a consistent user experience for all ID cards. Users then can detect if someone try to cheat them (identifying unusual use patterns)

5. Legislative measures for the challenges ahead

Question 23: What European Union legislative measures on e-signatures, e-authentication of natural and legal person claims as well as e-identification would be appropriate in your opinion to best meet the challenges of the digital single market? Other

Please comment why Reglament better than Directive. Clear rules. Clear language, Legal framework ligned with standards (standards are now better than law, but can not be used in the best way because law does not cover some technical uses)

6. Research and Innovation

Question 24: On what issues should EU R&D and standardisation focus to have all the necessary technology to improve eID management? Nothing. A lot of money has been spent in past years without real improvement. We have standards. We should use them and in some cases improve them, with normal budget.

Question 25: On which technologies should Research & Development focus to improve the usability of e-signatures and electronic identification for end users and to facilitate the deployment for service providers? Timestamping services, OCSP services, custodian services, registered notice services, mobile service, intelligent NFC services, interoperability services

Question 26: What technologies could contribute to overcoming the lack of trust in electronic identification, authentication and signatures in the European Single Market (ex. addressing the so-called «what you see is what you sign» issue)? TSL, XAdES-XL, PAdES-LTV, writen signature digitalization with security measures binding the signature to the document in a way equivalent to «advance signature» with use of trusted third parties

7. Others

Question 27: Europe is fully part of the global economy. However, the forthcoming legal framework cannot cover non EU countries. Are there nevertheless international issues that should be taken into account? The development of the legal framework must take into account existing standards or be compatible with future global standards. For instance RFC 3739

Question 28: Would you wish to share some best practices examples outside Europe? Maybe connection of strong authentication with ID cards to federated identity systems (such as SAML) or simple authentication systems such as Open-ID can facilitate the use of Strong identity in social networks

Question 29: Are there any other issues which you think should be addressed by policy makers? Yes. The use of ID systems and electronic signatures should be a strategic movement covering all kind of documents and sectors. In the past different lobbies or groups of interest have tried to convince EU policy makers to take out electronic signatures from electronic invoices to cite just one area. Electronic signatures should be used consistently in all areas or, at the end, exceptions will be greater that the rule and electronic signature can become useles or even worst, dangerous.

Meta Informations

Creation date 15-04-2011

Last update date

User name null

Case Number 089674306510210511

Invitation Ref.

Status N

Language en