Electronic signature services

Digital signature based on secure signature creation device

Edicom provides a secure device-based signature creation service in the platform with CWA 14169 certification and therefore with total guarantees in the scope of the European Union.

Directive 1999/93/EC of the European Parliament and Council, of 13th of December 1999, sets out a community framework for electronic signature (hereafter, the Directive). In article 3, the Directive states that the conformity of secure signature creation devices will be determined by the organisms designated by the member States, the Commission being responsible for setting out the criteria whereby the member States may establish whether a given organisation is to be designated. On the other hand, it stipulates that the conformity indicated by these organisations must be recognised by all the member States. Likewise, with the aim of harmonising technical requirements, the Directive empowers the Commission to be able to determine, and publish in the Official Journal of the European Communities (DOCE), the reference numbers of the generally acknowledged standards for electronic signature products, indicating that the member States will presume that the electronic signature products that fulfil these norms are in compliance with the requirements stipulated in the Directive for their consideration as secure signature creation devices.

On the other hand, it was necessary that the general requirements defined in the Directive for secure signature creation devices were specified in a standard that would serve as reference to assess the conformity of a specific device and that this norm should be published in the Official Journal of the European Communities (DOCE) by the Commission, as we have seen previously anticipated in the Directive. With this aim, among others, the Commission made a call to the industry and the European standardisation organisations to analyse whether the already existing norms covered the requirements demanded by the Directive.

This analysis identified areas not sufficiently covered and it was therefore deemed necessary to draw up new standards in line with the needs of the Directive. As a result of this analysis, the European Electronic Signature Standardisation Initiative (EESSI) came into being within the framework of the Information and Communication Technologies Standardisation Bureau (ICTSB), dividing the tasks of technical standardisation between two of the officially recognised European standardisation organisations: the European Committee for Standardisation (CEN) and the European Telecommunications Standardisation Institute (ETSI).

The result of these works is a series of technical specifications that includes most of the required areas indicated by the Directive and, among them, CEN Workshop Agreement CWA 14169, concerning secure signature creation devices. This specification, following the Common Criteria model for Information Technology Security Assessment, better known as Common Criteria (CC), takes the shape of a Profile Protection (PP) with an Evaluation Level Guarantee of 4+.

After its acceptance by the electronic signature committee, which according to article 9 of the Directive must attend the Commission and is made up of representatives from the member States and the Commission, a Decision was approved in July 2003 regarding the publication of the reference numbers of the generally recognised norms for electronic signature products, which included CWA 14169 as generally acknowledged technical standard for devices in accordance with the requirements of annex III of the Directive regarding secure signature creation devices