Electronic Signatures and Trust Infrastructures (ESI); Policy and security requirements for trust service providers; Part 1: TSP services operating a remote QSCD / SCDev

Note

ETSI technical specification, part 1, setting the policy and security requirements for providers operating a remote signature creation device, including a QSCD (version 1.3.1).

Summary

Purpose

Technical specification ETSI TS 119 431-1 (version 1.3.1, December 2024) sets the policy and security requirements for providers that operate, on behalf of a signatory, a remote signature creation device ETSI TS 119 431-1 V1.3.1, § 1 Scope ETSI TS 119 431-1 V1.3.1, History. Its scope begins as follows:

Specific requirements apply where this device is a qualified device (QSCD). The service combines a server signing application and the device; the specification calls it the Server Signing Application Service (SSAS) ETSI TS 119 431-1 V1.3.1, § 1 Scope. It serves as the basis for the conformity assessment of these providers by independent bodies ETSI TS 119 431-1 V1.3.1, § 1 Scope.

Who it applies to

• Qualified trust service providers that manage remote qualified electronic signature or seal creation devices. Regulation 910/2014 reserves this qualified service to a qualified provider that meets certain conditions Art. 29a(1), which apply to seals mutatis mutandis Art. 39a.
• Independent conformity assessment bodies, for which the specification is intended as an assessment basis ETSI TS 119 431-1 V1.3.1, § 1 Scope; the act makes it applicable for the purpose of assessing conformance List of reference standards and specifications for the management of remote qualified electronic signature creation devices and of remote qualified electronic seal creation devices.

Key points

• Common foundation: the requirements incorporate by reference those of ETSI EN 319 401 and of EN 419241-1 (CEN), and the structure follows ETSI EN 319 411-1 ETSI TS 119 431-1 V1.3.1, § 4.1 General policy requirements concepts ETSI TS 119 431-1 V1.3.1, Executive summary.
• Component services: generation of signing keys, binding to the certificate, binding to the electronic identification means or to the identity, signature activation, key deletion and, optionally, provision of electronic identification means ETSI TS 119 431-1 V1.3.1, § 4.4 SSAS component services.
• European EUSPv2 policy: Annex A, which is normative, carries the requirements specific to the qualified provider that manages a remote QSCD, under the policy identifier EUSPv2 ETSI TS 119 431-1 V1.3.1, A.1 SSASP as a Qualified TSP ETSI TS 119 431-1 V1.3.1, A.2 Policy name and identification.
• Device certification: the practice statement refers to the certification of the QSCD, and the provider complies with the requirements of the device’s certification report ETSI TS 119 431-1 V1.3.1, A.3 General requirements.
• Signature activation: the signatory’s key is used in a QSCD; when authentication is directly linked to the identity, the signing session ends no later than 30 minutes after identity verification ETSI TS 119 431-1 V1.3.1, A.5 Signature activation.

What the implementing act applies, and how

Implementing Regulation 2025/1567 designates the reference standards for these qualified services, under the provisions of Regulation 910/2014 on the remote management of devices Art. 1. It applies from 19 August 2027 Art. 2. Its annex delimits the reference:

• Scope: the specification is used to assess conformance with this policy, according to Annex A; the annex to the act does not draw up a list of excluded clauses.
• Regime: the article of Regulation 910/2014 that empowers the Commission contains no sentence establishing a presumption of conformity Art. 29a(2).
• Rewritten requirements: the reference to ETSI EN 319 401 becomes version 3.1.1, and a reference to the agreed cryptographic mechanisms published by ENISA is added; OVR-6.1-04 makes mandatory the international availability of the information, which the specification only recommends ETSI TS 119 431-1 V1.3.1, § 6.1 Publication and repository responsibilities; OVR-A.3-02 makes the practice statement refer to the certification of the device in accordance with Annex II to Regulation 910/2014 List of reference standards and specifications for the management of remote qualified electronic signature creation devices and of remote qualified electronic seal creation devices.
• Added requirements: in clauses 6.4.4, 6.4.9 and 6.5.5, V1.3.1 contains only one requirement numbered -01 ETSI TS 119 431-1 V1.3.1, § 6.4.4 Personnel controls ETSI TS 119 431-1 V1.3.1, § 6.4.9 SSASP service termination ETSI TS 119 431-1 V1.3.1, § 6.5.5 Network security controls. The annex adds requirements there: competence of personnel in trusted roles, who receive updates on new threats and security practices at least every 12 months; a termination plan complying with the acts adopted for the cessation of activity; vulnerability scanning at least once per quarter; firewalls preventing all unnecessary access List of reference standards and specifications for the management of remote qualified electronic signature creation devices and of remote qualified electronic seal creation devices.
• Missing clause: the annex attaches OVR-6.8.5-01 and -02 (cryptographic controls, agreed mechanisms) to a clause 6.8.5 Cryptographic controls List of reference standards and specifications for the management of remote qualified electronic signature creation devices and of remote qualified electronic seal creation devices, which V1.3.1 does not contain: its clause 6.8 stops at point 6.8.4 ETSI TS 119 431-1 V1.3.1, § 6.8 Other provisions.
• Implementing Regulation 2025/2162: its Annex II cites TS 119 431-1, without a version, for both qualified remote management services; conformity assessment schemes include at least these standards, as applicable, with their year and version number Annex II Art. 6(3).

Important clauses

• ETSI TS 119 431-1 V1.3.1, § 1 Scope: scope.
• ETSI TS 119 431-1 V1.3.1, § 6 Trust Service Providers practice: provider practices (keys, activation, controls).
• ETSI TS 119 431-1 V1.3.1, Annex A (normative): Specific requirements related to Regulation (EU) 2024/1183: requirements specific to the qualified provider, targeted by Implementing Regulation 2025/1567.

Links

• General foundation: ETSI EN 319 401 ETSI EN 319 401 V3.1.1.
• Part 2 of the series: ETSI TS 119 431-2 ETSI TS 119 431-2 V1.2.1.
• Remote signing protocols: ETSI TS 119 432 ETSI TS 119 432 V1.3.1.
• CEN standard: EN 419241-1 EN 419241-1:2018 and EN 419241-2:2019.
• Learning path: step 4, trust services.

ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI TS 119 431-1 V1.3.1. Written by Asphalia.