Electronic Signatures and Trust Infrastructures (ESI); Policy and Security requirements for Providers of Electronic Attestation of Attributes Services

Note

ETSI technical specification setting the policy and security requirements applicable to providers of electronic attestation of attributes services (version 1.1.1).

Summary

Purpose

Technical specification ETSI TS 119 471 (version 1.1.1, May 2025) sets the policy and security requirements for providers that issue or validate electronic attestations of attributes (EAA) ETSI TS 119 471 V1.1.1, § 1 Scope ETSI TS 119 471 V1.1.1, History. An EAA is an electronic attestation that confirms attributes of a natural or legal person, or of an object ETSI TS 119 471 V1.1.1, Introduction. Its scope begins as follows:

It covers in particular the issuance of attestations and their validation by the provider ETSI TS 119 471 V1.1.1, § 1 Scope.

Who it applies to

Implementing Regulation 2025/1569 targets two categories of providers, which comply with the standards of its Annex I Art. 3(1):

• providers of qualified electronic attestations of attributes (QEAA);
• providers of electronic attestations of attributes issued by or on behalf of a public sector body responsible for an authentic source (PuB-EAA).

Key points

• Role of the provider: it vouches for the accuracy and validity of the attributes, and is responsible for their truthfulness and currency ETSI TS 119 471 V1.1.1, § 4.1 Overview.
• Issuance to a wallet: before issuing an attestation to a European wallet (EUDIW), the provider verifies the PID received, authenticates itself to the wallet instance and verifies that it is neither revoked nor suspended ETSI TS 119 471 V1.1.1, § 4.2.2.3 EUDIW specific; Annex I to Implementing Regulation 2025/1569 rewrites this last requirement without suspension Annex I.
• Revocation: the provider revokes an attestation upon an authorised and validated request within 24 hours, and in the cases listed (error, fraud, incident…) ETSI TS 119 471 V1.1.1, § 4.2.5.1 General.
• Signing keys: when the provider generates the signing keys of the attestations, it does so in a secure cryptographic device, evaluated or certified under the schemes cited ETSI TS 119 471 V1.1.1, § 7.5.3 EAAS key protection and cryptographic module engineering controls.
• Management and operation: clause 7 covers organisation, personnel, access, cryptography, security, incidents, continuity and cessation of activity ETSI TS 119 471 V1.1.1, § 7 EAASP management and operation.

What the implementing act applies, and how

Annex I to Implementing Regulation 2025/1569 provides that TS 119 471 version 1.1.1 applies subject to adaptations Annex I. Implementing Regulation 2026/1735 replaced this annex Art. 1(4).

• Clauses not applicable: clause 4.2.2.2 (verification of attributes against authentic sources) and clause 4.3.2 (wallet-specific validation) Annex I.
• References: ETSI EN 319 401 version 3.2.1, the agreed cryptographic mechanisms published by ENISA, FIPS 140-3, the EUCC scheme and ISO/IEC 15408:2022 Annex I.
• Rewritten or added requirements: authentication to the wallet with a valid access certificate; description of the revocation mechanism in the practice statement; notification to the supervisory body at least one month before any change and three months before a planned cessation; cryptographic techniques compliant with the agreed mechanisms; termination plan compliant with the acts adopted for the cessation of activity Annex I.
• Signing device: the device used to sign or seal the attestations is a qualified signature or seal creation device; the other signatures or seals of the service are created in a system certified under the Common Criteria (CC 3.1 until 31-08-2027, or CC:2022, or ISO/IEC 15408, level EAL 4 or higher), under the EUCC at level EAL 4 or higher, or under FIPS 140-2 level 3 (existing systems, until 31-08-2027) or FIPS 140-3 level 3 (until 31-12-2030) Annex I.
• Emptied requirements: several requirements of clauses 7.5.2 and 7.5.5 are replaced by the word void in the annex Annex I.

Regime, depending on the provider:

• For PuB-EAA, Regulation 910/2014 provides for a presumption, with a precise scope:

• For QEAA, the article that empowers the Commission contains no presumption sentence Art. 45d(5). The same article provides for an evaluation carried out in accordance with these standards:

For both categories, Implementing Regulation 2026/1735 is based on these two articles, among others amending Implementing Regulation (EU) 2025/1569 as regards applicable standards and specifications.

• Implementing Regulation 2025/2162: its Annex II cites TS 119 471, without a version, for the issuance of qualified electronic attestations of attributes; conformity assessment schemes include at least these standards, as applicable, with their year and version number Annex II Art. 6(3).

Important clauses

• ETSI TS 119 471 V1.1.1, § 1 Scope: scope.
• ETSI TS 119 471 V1.1.1, § 4.2 EAA Issuance services: issuance, use, renewal and revocation.
• ETSI TS 119 471 V1.1.1, § 4.2.2.2 Verification of attributes against authentic sources: verification against authentic sources (not applicable under Annex I to Implementing Regulation 2025/1569).
• ETSI TS 119 471 V1.1.1, § 7.5 Cryptographic controls: cryptographic controls, largely adapted.

Links

• General foundation: ETSI EN 319 401 ETSI EN 319 401 V3.2.1.
• Verification of attributes against authentic sources: ETSI TS 119 478 ETSI TS 119 478 V1.1.1, targeted by Annex IV to the same Regulation Annex IV.
• Format of attestations: ETSI TS 119 472-1 ETSI TS 119 472-1 V1.2.1, through Annex II to Implementing Regulation 2024/2979 Annex II.
• Learning path: step 7, the attestation issuer.

ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI TS 119 471 V1.1.1. Written by Asphalia.