3

I have some basic questions regarding eIDAS and 'Advanced Electronic Signatures'. Say, if I create a product under my company Acme Inc that offers a simple electronic signature where I sign every completed document digitally with a digital certificate that attests to the identity of Acme Inc (while providing an additional certificate of completion where I attest to the identity of the signers).

Provided, my product can:

  1. Uniquely generate signing links to the signatory with unique references to them in the database (be it guest or registered signers),
  2. And if the link can be accessed for signing by the signatory by authenticating themselves (e.g: one-time 2FA code to their mobile, confirming their email, etc), and my product can uniquely identify them in our database along with their first name, last name, email, and the mode of identity verification in an authentic certificate of completion.
  3. And if and only if the signatory could have had access to the signing URL and the 2FA code, which is under their sole control.
  4. And finally, my product can digitally sign the completed document (with the certificate for Acme Inc) in a way that any subsequent change in the data is detectable.

Questions:

  1. Would the electronic signature in the above case be considered as an Advanced Electronic Signature?
  2. What sort of identity verification method is a) bare minimum and b) more than enough for AES?
  3. Should I necessarily be generating individual digital certificates for all signers to be eIDAS-compliant AES? Or is a digital certificate for my company (Acmne inc) with an audit certificate of completion good enough?

I've perused the eIDAS document but I am not able to find the answers. Could someone help me?

7
  • And you saw this? ec.europa.eu/digital-building-blocks/wikis/display/ESIGKB/… "As part of the eIDAS Regulation, these certificates can be purchased from specific providers, named Trust Service Providers (TSP)." ? According to that, unless you are a TSP, then you aren't providing Advanced Signatures. And then, given that, you would need to look up with the authentication requirements are of a TSP.
    – schroeder
    Oct 13, 2023 at 20:53
  • And looking that up, I quickly get to etsi.org/deliver/etsi_en/319400_319499/31941102/02.01.01_60/… Section 6.2
    – schroeder
    Oct 13, 2023 at 20:59
  • @schroeder From your first link: "providers of non-qualified certificates for electronic signatures could be but are not mandatorily listed in these Trusted Lists." -- The general requirement is a high level of trust that only the apparent signer has access to the private key; where "high level of trust" is open to interpretation. That level of trust may already be satisfied if the certificate is issued by the internal CA of company ACME to a person named Bambi Bundle with email address [email protected] -- even if that CA might be under control of ACME's evil sysadmin Oct 14, 2023 at 18:07
  • Regarding your question 3, I'd say that if you sign all documents with the same certtifcate, then the signing certificate is under the sole access of ACME Inc, not of the intended signres, hence the aes is at most by ACME Inc. Your audit certificate would then also only be a statement signed by ACME inc.,That being said, an answer in particular to your question 2 might rather be found on law.SE, Oct 14, 2023 at 19:49
  • 1
    Thanks @HagenvonEitzen and schroeder. I tried law.stackexchange. But they keep downvoting the question without any comments on what is missing or how to improve the question. Oct 16, 2023 at 6:48

0

You must log in to answer this question.