(title available in French only)
Official
Note
ETSI standard setting the policy and security requirements applicable to providers that issue electronic time stamps (version 1.3.1).
The full text is not reproduced here (copyright): see the official source.
Summary
Purpose
European standard ETSI EN 319 421 (version 1.3.1, July 2025) sets the policy and security requirements applicable to trust service providers that issue time-stamps ETSI EN 319 421 V1.3.1, § 1 Scope ETSI EN 319 421 V1.3.1, History. Its scope begins as follows:
The present document specifies policy and security requirements relating to the operation and management practices of TSPs issuing time-stamps.
It does not define the protocols for accessing time-stamping units (TSU): the time-stamping protocol is that of RFC 3161, profiled by ETSI EN 319 422 ETSI EN 319 421 V1.3.1, § 1 Scope ETSI EN 319 422 V1.1.1 RFC 3161.
Who it applies to
- To providers that issue qualified electronic time stamps, through Implementing Regulation 2025/1929 List of reference standards and specifications for qualified time stamp services.
- To providers of qualified electronic archiving services, whose reference standard, CEN/TS 18170 as adapted by Implementing Regulation 2025/2532, cites EN 319 421 version 1.3.1 among its normative references List of reference standards and specifications for qualified electronic archiving services.
- To owners of conformity assessment schemes, through Implementing Regulation 2025/2162 Art. 6(3).
Key points
- Time-stamp policy: the standard defines a policy, BTSP (best practices time-stamp policy), whose identifier the time-stamping authority (TSA) includes in its policy and in its disclosure statement, alongside the other identifiers it uses where applicable ETSI EN 319 421 V1.3.1, § 5.2 Policy name and identification.
- Common base: many clauses make the requirements of ETSI EN 319 401 applicable (risks, practices, personnel, network…) ETSI EN 319 421 V1.3.1, § 6 Policies and practices ETSI EN 319 421 V1.3.1, § 7 TSA management and operation.
- Accurate time: time-stamps follow the profile of EN 319 422; the time is traceable to a UTC(k) laboratory and the TSU clock is synchronized with Coordinated Universal Time with a declared accuracy of one second or better ETSI EN 319 421 V1.3.1, § 7.7.1 Time-stamp issuance ETSI EN 319 421 V1.3.1, § 7.7.2 Clock synchronization with UTC.
- Qualified time-stamps: a TSU that issues time-stamps presented as qualified does not issue non-qualified ones; a TSA that issues both uses separate TSUs ETSI EN 319 421 V1.3.1, § 8.2 TSA issuing non-qualified and qualified electronic time-stamps as per Regulation (EU) No 910/2014.
What the acts apply, and how
- Implementing Regulation 2025/1929 (qualified electronic time stamps): the standard applies in version 1.3.1, together with EN 319 422, subject to adaptations List of reference standards and specifications for qualified time stamp services. They replace normative references (in particular EN 319 401 version 3.1.1 and EN 319 422 version 1.1.1) and rewrite requirements, in particular: for personnel in trusted roles, updates at least every twelve months on threats and security practices; generation and storage of the TSU keys in a device certified under the Common Criteria or EUCC at level EAL 4 or higher, or, until 31 December 2030, under FIPS PUB 140-3 level 3; agreed cryptographic mechanisms published by ENISA, for algorithms and key lengths as for the key expiry date (for the former, the strength of the requirement differs between language versions, see below); quarterly vulnerability scanning and annual penetration testing; termination plan in accordance with the implementing acts provided for by the regulation List of reference standards and specifications for qualified time stamp services Art. 24(5) ETSI EN 319 401 V3.1.1. A recital adds that supervisory bodies should presume compliance with the relevant requirements of the regulation, the provider being able to demonstrate it through other practices laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards the binding of date and time to data and establishing the accuracy of the time sources for the provision of qualified electronic time stamps. Regulation 910/2014, for its part, provides for a presumption with a precise scope:
Compliance with the requirements laid down in paragraph 1 shall be presumed where the binding of date and time to data and the accuracy of the time source comply with the standards, specifications and procedures referred to in paragraph 2.
Wording that differs between language versions. For the TSU key generation algorithm, the signing key length and the signature algorithm, the English version of the annex reads:
The TSU key generation algorithm, the resulting signing key length and signature algorithm used for signing time-stamps and for signing TSU public key certificates respectively shall be compliant with the Agreed Cryptographic Mechanisms
The French version of the same passage uses “il convient” (“it is recommended”) instead List of reference standards and specifications for qualified time stamp services. For the expiration date of the TSU’s private keys, both versions require compliance with the agreed mechanisms (shall, doit) List of reference standards and specifications for qualified time stamp services. The summary does not decide between the two formulations.
- Implementing Regulation 2025/2532 (qualified electronic archiving): the annex makes CEN/TS 18170 applicable subject to adaptations; for its clause 2 (normative references), it lists in particular EN 319 421 version 1.3.1. It adds that the provider, when it uses time stamps, uses a qualified time stamp List of reference standards and specifications for qualified electronic archiving services CEN/TS 18170:2025. A qualified electronic archiving service is presumed to meet the requirements applicable to it where it complies with these standards, specifications and procedures Art. 45j(2).
- Implementing Regulation 2025/2162: Annex II cites EN 319 421, without a version, for the creation of qualified electronic time stamps; conformity assessment schemes state the year and version number of the standards Annex II Art. 6(3).
Cited version
Implementing Regulations 2025/1929 and 2025/2532 name ETSI EN 319 401 in version 3.1.1 List of reference standards and specifications for qualified time stamp services List of reference standards and specifications for qualified electronic archiving services. The most recent version in the corpus is 3.2.1 ETSI EN 319 401 V3.2.1.
Error in the act
In the annex to Implementing Regulation 2025/1929, requirements OVR-7.10-05 and OVR-7.10-06 refer to ETSI EN 319 401 under reference [1], which in EN 319 421 designates Recommendation ITU-R TF.460-6; the annex places EN 319 401 as reference [4]. The English version carries the same numbering List of reference standards and specifications for qualified time stamp services ETSI EN 319 421 V1.3.1, § 2.1 Normative references. Probable reading: reference [4].
Error in the act
In the annex to Implementing Regulation 2025/1929, requirement TIS-7.6.3-02 refers to version CC: 2002 of the Common Criteria, whereas requirement TIS-7.6.2-03, worded in the same way, refers to version CC: 2022; the English version carries the same values List of reference standards and specifications for qualified time stamp services. Probable reading: CC:2022.
Error in the act
In the French version of the annex to Implementing Regulation 2025/2532, EN 319 421 bears the title of a standard applicable to providers issuing certificates; the English version gives its correct title (issuing Time-Stamps) List of reference standards and specifications for qualified electronic archiving services. Probable reading: providers issuing time-stamps.
Important clauses
- ETSI EN 319 421 V1.3.1, § 1 Scope: scope.
- ETSI EN 319 421 V1.3.1, § 7.6 Cryptographic controls: TSU keys.
- ETSI EN 319 421 V1.3.1, § 7.7 Time-stamping: issuance of time-stamps and clock.
- ETSI EN 319 421 V1.3.1, § 8 Additional requirements for qualified electronic time-stamps as per Regulation (EU) No 910/2014: requirements specific to qualified time-stamps.
Links
- Protocol and token profile: ETSI EN 319 422 ETSI EN 319 422 V1.1.1.
- General requirements for providers: ETSI EN 319 401 ETSI EN 319 401 V3.1.1.
- Time-stamping protocol: RFC 3161 RFC 3161.
- Learning path: step 4, trust services.
Consolidation without official value
This summary cites the consolidated version, published on EUR-Lex, of Regulation 910/2014 Regulation (EU) No 910/2014 — consolidated version of 18/10/2024. It serves as documentation: only the text published in the Official Journal is authentic.
ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI EN 319 421 V1.3.1. Written by Asphalia.