The use of qualified electronic signatures remotely has become a practical solution for persons who need to sign electronically from multiple devices. Such a solution may use a Remote QSCD – a qualified electronic signature creation device managed remotely by a qualified trust service provider.

Regulation (EU) 2024/1183 (the act updating the European framework for digital identity) amends Regulation (EU) No 910/2014 (the eIDAS Regulation). Known in practice as eIDAS 2.0, the new framework places greater importance on remote signing services, the control exercised by the signatory and the technical requirements applicable to providers.

What Is a Remote QSCD

A QSCD is a signature creation device that meets the requirements laid down in Annex II to the eIDAS framework. In the case of a Remote QSCD, the device is managed remotely by a qualified trust service provider. As a rule, it is not physically in the signatory’s possession, and the signatory uses it through an application or an online interface.

A Cloud Certificate Does Not Mean That the Private Key Is Freely Accessible

In everyday language, people refer to a “digital certificate in the cloud”. From a technical perspective, the certificate is the electronic document that links the signatory’s identity to the public key. The element that must be specially protected is the private key, which is used to create the signature.

In a Remote QSCD architecture, the private key is generated and stored in a secure environment, generally in an HSM, that is, a Hardware Security Module. The key is not downloaded to the user’s phone or computer. However, an HSM is only a technical component. The existence of an HSM does not automatically turn a solution into a QSCD or a certificate into a qualified certificate.

What Does Sole Control Mean

Sole control means that the signatory retains control over the use of the signature creation data. This sole control does not necessarily require physical possession of the private key or direct access to the HSM.

In a remote service, sole control must be ensured through procedures and mechanisms that prevent the key from being used to create a signature without the signatory’s authorization. Depending on the service architecture, strong authentication, confirmation of the operation, linking the authorization to the document or data to be signed, and protection of the signature activation data may be relevant.

Sole control does not mean that the provider no longer has any technical role. The provider may administer the infrastructure, operate the HSM and provide the signing service. What must be excluded is the possibility for the provider or another person to independently create signatures using the signatory’s key, outside the authorized procedure.

What eIDAS 2.0 Changes for Remote Signing

A Clearer Framework for Remote QSCDs

The eIDAS Regulation already contained requirements for qualified signature creation devices and allowed, in practice, the provision of remote signing services. eIDAS 2.0 nevertheless clarifies the framework applicable to qualified remote electronic signature creation devices and the responsibility of the provider managing them.

In essence, a Remote QSCD must maintain the level of protection of a QSCD, even if the device is administered in an environment controlled by the provider. Both the security of the device and the processes through which the signatory activates and authorizes their signature are relevant.

What eIDAS 2.0 Does Not Change

eIDAS 2.0 does not automatically turn every cloud signing solution into a qualified solution. For a signature to be qualified, several elements must be assessed cumulatively:

  • the signatory’s identity must be verified in accordance with the applicable requirements;
  • the certificate must be a qualified certificate for electronic signatures;
  • the signature creation data must be protected in a QSCD, including in a qualified electronic signature creation device managed remotely (Remote QSCD);
  • the signature must be created through a compliant service and procedure;
  • the provider and the qualified service must have the appropriate status in the relevant trust list.

Accordingly, the mere storage of the key in an HSM, the use of a password or the existence of a mobile application is not, considered separately, sufficient to demonstrate the qualified nature of the signature.

How a Remote QSCD Service Works

The specific process depends on the solution provided and the provider’s policy, but a typical architecture involves the following stages:

  1. the provider verifies the user’s identity and, where applicable, issues or makes available the qualified certificate;
  2. the signature creation data are generated and protected in the service’s secure environment;
  3. the certificate and private key are associated with the signatory’s profile, without the private key being transferred to their device;
  4. the user initiates the signing process and authenticates through the mechanism provided by the service;
  5. the service verifies the authorization and sends the operation to the protected cryptographic environment;
  6. the signature is created, and the signed document is returned to the user or to the application that requested the operation.

In a compliant solution, the authorization mechanism must provide, in accordance with the applicable requirements, guarantees that the operation approved by the signatory corresponds to the document or set of documents for which they expressed their intention to sign. The details may vary depending on the type of service, the security assessment and the applicable requirements.

The Role of ETSI Standards

The Regulation establishes legal and security requirements at European level, while technical standards explain how those requirements can be implemented and assessed. In the field of remote signing, ETSI standards contribute to the harmonization of services and to the creation of verifiable criteria for providers and conformity assessment bodies.

Relevant Standards for Remote Signing Services

  • ETSI TS 119 431-1 establishes general policy and security requirements for providers of remote electronic signature and/or seal creation services;
  • ETSI TS 119 431-2 addresses the requirements applicable to the signature activation mechanism, known as the Signature Activation Module;
  • ETSI TS 119 432 addresses protocols for the remote creation of electronic signatures;
  • the standards in the EN 419 241 series additionally provide requirements for trust systems supporting server-based signing and for the protection of the QSCD used in this context.

These standards address aspects such as key lifecycle management, the separation of responsibilities, signatory authentication, signature activation, communications protection, logging and the resilience of the infrastructure against unauthorized use.

What Level of Trust Do the Standards Provide

ETSI standards do not, in themselves, constitute a legal certification that every service referring to them is qualified. The level of trust results from the combination of the requirements of the eIDAS Regulation, conformity assessment, the provider’s audit, the certification of relevant components and the maintenance of the service under qualified status.

When certain standards are recognized through the relevant acts of the European Union, compliance with them may support a presumption of conformity with the requirements they cover. This presumption does not eliminate the need to assess the service as a whole and does not automatically extend to components or functionalities that are not included within the scope of the standard.

From the user’s perspective, standards provide an important level of trust because they transform general concepts such as sole control, key protection and signature activation into technical requirements that can be verified. However, compliance must be assessed for the specific service, not merely for the HSM product or the application used.

What Should Be Checked Before Using a Qualified Cloud Certificate

Before contracting a Remote QSCD service, the user should verify at least the following aspects:

  • whether the provider is a qualified trust service provider;
  • whether the specific remote signing service has qualified status, and not merely the provider in general;
  • whether the certificate issued is a qualified certificate for electronic signatures;
  • how sole control is achieved and which mechanism activates the signature;
  • whether measures exist to link the authorization to the signed document or data;
  • which standards and conformity assessments cover the service actually used;
  • how certificate revocation, service suspension, account recovery and security incidents are managed.

The distinction between a qualified electronic signature and a qualified electronic seal is also important. A Remote QSCD intended for signing by a natural person must not be confused with the infrastructure used for the seals of a legal entity, as the requirements and responsibilities may differ.

Conclusion

A Remote QSCD enables the use of a qualified electronic signature without the user having to physically carry a token or keep the private key on their own device. However, the security of the solution depends on the system as a whole: the generation and storage of the key in protected infrastructure, the activation mechanism, the sole control exercised by the signatory, the provider’s qualified status and the conformity assessment.

eIDAS 2.0 does not eliminate these conditions, but makes them more visible and creates a clearer framework for remote signing services. ETSI standards provide important technical and operational benchmarks, but qualified status must be verified for the specific service and the provider supplying it. Consequently, the fact that a certificate is presented as being “in the cloud” or that a key is stored in an HSM is not, on its own, sufficient to demonstrate the existence of a qualified electronic signature.

Manciu & Associates
Att. Manciu Cătălin Adrian
← Interest on financed credit costs