8 Nob 06 / CEN/ISSS ETSI STF 305: Procedures for Handling Advanced Electronic Signatures on Digital Accounting CEN/ISSS Workshop on Electronic Invoices Nick Pope – Thales e-Security STF 305 Team Leader

1 8Nob06 / CEN/ISSS ETSI STF Specialist Task Force - Terms of Reference Propose drafts to ETSI Technical Committee on Electronic Signatures and Infrastructures for: Technical Report on Best Practices for handling electronic signatures and signed data for digital accounting Technical Specification on Policy requirements for trust service providers signing and/or storing data for digital accounting

2 8Nob06 / CEN/ISSS ETSI STF Approach Study into National Practices For Accounting & Digital Accounting UK France Italy Spain Germany Best Practices for Handling signed data for Digital Accounting Policy Requirements for Trusted Service Providers Signing / Storing Data For Digital Accounting

3 8Nob06 / CEN/ISSS ETSI STF Approach Study into National Practices For Accounting & Digital Accounting UK France Italy Spain Germany Best Practices for Handling signed data for Digital Accounting EU e-Invoicing Requirements Policy Requirements for Trusted Service Providers Signing / Storing Data For Digital Accounting Maximum & Minimum Commonly Acceptable

4 8Nob06 / CEN/ISSS ETSI STF Targeting Digital Accounting Through e-Invoicing National accounting practices widely vary Council Directive 2001/115/EC + CWA provide common requirement for signed VAT Invoices Took e-Invoicing requirements as common basis for Digital Accounting

5 8Nob06 / CEN/ISSS ETSI STF Basic Model

6 8Nob06 / CEN/ISSS ETSI STF Trusted Service Provider Model

7 8Nob06 / CEN/ISSS ETSI STF Use Scenarios Main Target: Pan European Trade supported by two external TSPs Other potential National Trade supported by TSP(s) Large Company Internal Service

8 8Nob06 / CEN/ISSS ETSI STF Advantages of applying Best Practice / Policy Targeted Security controls Ensure that documents are kept over necessary period Ensure that singing keys are held &,maintained securely Reduce revocation management Ensure that security of documents is properly maintained Access security Storage security Signature validity

9 8Nob06 / CEN/ISSS ETSI STF Draft Technical Report (TR) Based on ISO/IEC ISO/IEC Information Security Management System Specific Controls & Objectives for: Signature Maintenance of Signature over storage period Storage Reporting to authorities Scanning paper originals + ISO/IEC standard objectives

10 8Nob06 / CEN/ISSS ETSI STF Draft TR - Signature Maximum Identified Practices Advanced Electronic Signature Qualified Certificate Secure Signature Creation Device Registration – ID documents & authorisation Timely revocation Minimum Identified Practices Advanced Electronic Signature CA meets recognised policy requirements Sole control requirement met Nationally “Acceptable” registration Nationally “Acceptable” revocation

11 8Nob06 / CEN/ISSS ETSI STF Draft TR – Signature (continued) Commonly Acceptable Practice for Trusted Service Provider (TSP) offering signing / storage services: Advanced Electronic Signature Qualified CA or CA meets recognised policy requirements SSCD or Sole control requirement met Registration – ID documents & authorisation Timely revocation

12 8Nob06 / CEN/ISSS ETSI STF Draft TR – Signature Maintenance Maximum Identified practices Technical / organisational procedures to assure signature verifiable throughout storage period Minimum identified practices Nationally acceptable practices Commonly Acceptable for TSP Technical / organisational procedures to assure signature verifiable throughout storage period

13 8Nob06 / CEN/ISSS ETSI STF Draft TR – Storage Maximum Identified practices Authorised access via secure channel Authentication, Integrity & optional content commitment (non-repudiation) Assure viewer available through lifetime Held on long term media / copied to assure no loss of data Held in original format – no macros / hidden code Confidentiality of company information by separation Minimum identified practices No remote access required – local access as authorised Authentication & integrity in line with national rules No specific requirement regarding readability Owner liable for any loss of data No special requirement regarding format Confidentiality maintained in storage

14 8Nob06 / CEN/ISSS ETSI STF Draft TR – Storage Commonly Acceptable Practices for TSPs Authorised access via secure channel Authentication, Integrity & optional content commitment (non-repudiation) Assure viewer available through lifetime Held on long term media / copied to assure no loss of data Held in original format – no macros / hidden code Confidentiality by logical or physical separation

15 8Nob06 / CEN/ISSS ETSI STF Draft TR – Reporting Maximum Identified practices Signed & Use secure channels (e.g. SSL) Minimum identified practices Use secure channels Commonly Acceptable for TSP Signed & Use secure channels (e.g. SSL)

16 8Nob06 / CEN/ISSS ETSI STF Draft TR – Scanned Document Maximum Identified practices Assertion (e.g. signature) that true copy Minimum identified practices Assured by good practice Commonly Acceptable for TSP Good practice & assertion where required

17 8Nob06 / CEN/ISSS ETSI STF Draft TR – ISO Objectives & Controls Maximum Identified practices ISO compliance / national rules + Specific controls for trusted personnel & components Minimum identified practices ISO desired Commonly Acceptable for TSP ISO Conformance Recommended / national rules + Specific controls for trusted personnel & components

18 8Nob06 / CEN/ISSS ETSI STF Draft Technical Specification Targeted just at Trust Service Provider (TSP) = Commonly acceptable practices from Technical Report worded in terms of specific requirements (shall) Two levels recognised: Normalised (Advanced Electronic Signature) Extended (Qualified Electronic Signature)

19 8Nob06 / CEN/ISSS ETSI STF Status Drafts out for review and comment by 12-Jan-2007: Final ratification & publication end Q Comments / Questions ?

20 8Nob06 / CEN/ISSS ETSI STF ETSI STF 298 – Advanced Electronic Signature Profiles ETSI Profiles for Advanced Electronic Signatures TS – Profiles of CMS (RFC 3852) Advanced Electronic Signatures based on TS (CAdES) TS – Profiles of XML Advanced Electronic Signatures based onTS (XAdES) Profiles for Government E-Invoicing Baseline for other applications Short term & Long term