Since 2014, when the EIDAS, regulation was approved, we have been calling chip cards, cryptographic tokens, and HSMs (Hardware Security Module) «Qualified Signature Creation Device».
If we go back to Directive 93/1999, the name would be «Secure Signature Creation Device«.
But this is a mistake.
Qualified certificates (like other certificate types) have a field called «Key Usage» and this field indicates whether the certificate will be used for «electronic signature» (ContentCommitment) or for «authentication» (DigitalSignature), e.g. with the client authentication option of the TLS protocol.
Other uses are possible and could even be combined by activating these two, «ContentCommitment» and «DigitalSignature» simultaneously.
From the point of view of the scope of the regulation, neither the Directive 93/1999, nor the Regulation 910/2014, have expressly defined the possibility of authenticating the holder of qualified certificates. But this possibility has always been there. Although only electronic signatures (and, from the EIDAS Regulation onwards, electronic seals) have been considered, certificates that include the «DigitalSignature» bit in the «Key Usage» field are authentication certificates.
This is what was stated in the technical standard ETSI TS 102 280 and is currently stated in the technical standard ETSI EN 319 412-2.
So, if we conclude that certificates can be for authentication, and not just electronic signature, the fact that they reside on the same secure private key protection device for both uses should determine that the device should be referred to as a «Qualified Key Protection Device» and not as a «Qualified Signature Creation Device«.
By the way, I also think that the «Key Usage» bits should have different names. There was already a breakthrough when the name «Non-repudiation» became obsolete in various technical standards and was replaced by «Content Commitment», which actually means «signature» because in the signature the signatory is linked to the signed content. But the old name «Digital Signature» still persists because it technically justifies that in a challenge-response protocol, the response is calculated by performing the cryptographic operation of the digital signature on the challenge. But, in reality, this is an Authentication process and calling it a «Digital Signature» is misleading to experts and laymen alike.
The proper terms are sure «Signature» (instead of «Content Commitment») and «Authentication» (instead of «Digital Signature»), but it may be years before we see these terms in technical standards or legal rules.
Todo es electrónico 