ETSI TS 119 432 V1.3.1

(title available in French only)

Official Binding

Reference: ETSI TS 119 432 V1.3.1
Type: ETSI standard
Folder: ETSI standards
Version: V1.3.1
Date: 2026-03
Status: Final
Languages: English
Official source: https://www.etsi.org/deliver/etsi_ts/119400_119499/119432/01.03.01_60/ts_119432v010301p.pdf

Note

ETSI technical specification specifying the protocols and interfaces for creating AdES signatures through a distributed solution, limited to remote server signing (version 1.3.1).

The full text is not reproduced here (copyright): see the official source.

Summary

Purpose

Technical specification ETSI TS 119 432 (version 1.3.1, March 2026) defines protocols and interfaces for creating digital signatures remotely ETSI TS 119 432 V1.3.1, § 1 Scope ETSI TS 119 432 V1.3.1, History. Its scope states:

Official text · ETSI TS 119 432 V1.3.1, § 1 Scope

The present document is limited to remote server signing, i.e. the signing key is held in a remote shared service.

It covers the creation of AdES signatures (advanced electronic signatures in standardised formats) where the process is distributed across several systems or services, and imposes no mandatory technical binding ETSI TS 119 432 V1.3.1, § 1 Scope. Its change history mentions, in February 2026, the definition of signing schemes involving the European Digital Identity Wallet (EUDIW) ETSI TS 119 432 V1.3.1, Annex D (informative): Change history.

Who it applies to

Signature creation applications used by wallet units: they support at least the application programming interface (API) of Annex IV to Implementing Regulation 2024/2979 Art. 12(4), which refers to four parts of this specification Annex IV.
These applications may be provided by wallet providers, trust service providers or wallet-relying parties, and may or may not be integrated into the wallet instance Art. 12(1) Art. 12(3).

Key points

Service decomposition: signature creation application on the signatory’s or relying party’s side, server signing application on the provider’s side, and the device that holds the key ETSI TS 119 432 V1.3.1, § 4 Signature creation process, service decomposition.
Authentication and authorisation: the specification describes several ways of verifying the user’s identity and authorising each signature, including OAuth 2.0 ETSI TS 119 432 V1.3.1, § 5 Authentication and authorization.
Wallet at the heart of signing (clause 6.4.3): the wallet coordinates the creation of the AdES signature, collects consent and the documents or data to be signed, and requests the signature value from the qualified provider’s service; the relying party first registers with a registrar ETSI TS 119 432 V1.3.1, § 6.4.3 EUDIW participating in the signature creation process.
OpenID4VP profile (Annex A): the relying party requests a qualified signature or seal from the wallet with OpenID for Verifiable Presentations; the profile covers only the interface between relying party and wallet, not the one between wallet and provider ETSI TS 119 432 V1.3.1, A.1 Overview.
Request (A.6): the relying party uses OpenID4VP 1.0; the transaction data contain the signature requests, each with the value eu_eidas_qes (or the appropriate variant) and the document or its reference ETSI TS 119 432 V1.3.1, A.6.1 Introduction ETSI TS 119 432 V1.3.1, A.6.4 transaction\_data (the QES transaction).
Response and display (A.7, A.8): the wallet authenticates the user, shows them a consent screen, creates the signature and returns it; when a request contains both the reference (href) and the hash (checksum) of a document, it verifies its integrity and aborts the process in case of mismatch ETSI TS 119 432 V1.3.1, A.7.3 EUDIW processing ETSI TS 119 432 V1.3.1, A.8 Transaction data processing & UX rendering (EUDIW).

What the implementing act applies, and how

Point 3 of Annex IV to Implementing Regulation 2024/2979 designates as the API TS 119 432 version 1.3.1, paragraphs 6.4.3, A.6, A.7 and A.8 Annex IV. This point was replaced by Implementing Regulation 2026/1731 Annex VI.

Applicable clauses: the architecture in which the wallet participates in signature creation (6.4.3) and, in the OpenID4VP profile of Annex A, the construction of the request (A.6), the processing of the response (A.7) and the processing and display of transaction data (A.8) Annex IV.
Clauses not targeted: the rest of Annex A, including the complementary approval flow (A.9) and the security requirements (A.10), Annex B, Annex C and the APIs of clauses 7 and 8 are not part of this reference Annex IV.
Adaptations: none.
Regime: it is an obligation to support, laid down by the article cited above, which targets the signature creation applications used by wallet units Art. 12(4).

Important clauses

ETSI TS 119 432 V1.3.1, § 1 Scope: scope.
ETSI TS 119 432 V1.3.1, § 6.4.3 EUDIW participating in the signature creation process: architecture targeted by Annex IV to Implementing Regulation 2024/2979.
ETSI TS 119 432 V1.3.1, Annex A (normative): OpenID4VP EUDIW-centric signing flow profile: OpenID4VP profile, of which A.6 to A.8 are targeted.
ETSI TS 119 432 V1.3.1, § 7 Remote signatures creation service API: remote signature creation service API (not targeted).

Links

Previous version, also in the corpus: ETSI TS 119 432 V1.2.1 ETSI TS 119 432 V1.2.1.
Providers that manage remote signature devices: ETSI TS 119 431-1 ETSI TS 119 431-1 V1.3.1.
Mandatory signature format of the same annex: PAdES, ETSI EN 319 142-1 Annex IV.
Learning path: step 3, the European wallet.

Consolidation without official value

This summary relies on the consolidated version, published on EUR-Lex, of Implementing Regulation 2024/2979 Implementing Regulation (EU) 2024/2979 — consolidated version of 11/08/2026. It serves as documentation: only the text published in the Official Journal is authentic.

ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI TS 119 432 V1.3.1. Written by Asphalia.