1. Choosing the Security Model:
Linking eIDAS Electronic Registered Delivery Services and CEF eDelivery
CEF eDelivery Infrastructure Day, Breakout Session C
Brussels, November 2016
Jörg Apitzsch, Governikus KG, DE

2. (Q)ERDS eIDAS Requirements
REQ1: Integrity
messages should be secured against any illegitimate manipulation during transmission
REQ2: Confidentiality
messages should be encrypted during transmission
REQ3: Sender Identification
should be verified with a high level of confidence
REQ4: Addressee Identification
should be ensured before the delivery of the message
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

3. (Q)ERDS eIDAS Requirements cont.
REQ5: Time-Reference
Time instant of sending/receiving a message should be indicated by a qualified time stamp
REQ6: Proof of Send/Receive
Sender and receiver of the message should be provided with evidence of message sending and receiving
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

4. Trust
Usually is established by means to enable trust in security tokens used to authenticate (seal) messages or parts thereof
Whole message; ensures integrity, too (REQ1)
Statement about sender’s (user of C1) identity (REQ3)
Transport evidences and time instants, e.g. for submission, delivery… (REQ5, REQ6)
Certificates used should conform to relevant ETSI ENs
Different Trust Models have been considered by e-SENS, selection to be done according Application Domain needs
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

5. 4-Corner Trust & Security
Party A
Party B C1
CORNER
End-to-end Security C4
ORIGINAL SENDER
Inner Security
Inner Security
FINAL RECIPIENT
Applications
Layer
SUBMIT
Backend
Backend
DELIVER
1 or several
NOTIFY
NOTIFY
1 or several
AS4
ERDS
ERDS C2 C3
CORNER
Cross-party Security
Messaging and Transport Layer
Connector
Access
Point
SEND
RECEIVE
Access
Point
Connector
ACKNOWLEDGE
Networking Layer: Internet
Options to enable Trust:
(may be combined)
Trusted PKI
Mutual Key Exchange
Service Metadata Publisher
Service Metadata Publisher
Trusted List
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

6. Linking Trust Domains: Direct Brokered Trust
Connector C2 C3
Connector C4
WS-Sec
TD A domestic
means
TLS (?)
TD B domestic
means
AP / SMP
AP / SMP
Trust Domain A
Cross TD
Trust Domain B
AP’s act in TD Broker Role
Connected domestic domains use various established means
C4 <-> C1 Trust just generally given by community agreement / contract
TD A/B rely on their AP (respective it’s connector) brokerage functionality
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

7. Direct Trust – Mutual Key Exchange
Mutual Key Exchange respective domain Trusted Key  Store
May cover all active corners in the network
Widely used simple mechanism of the Direct Trust Model
Advantage: Free choice of PKI for all actors, as far as CAs and issued certificates conformant to ETSI ENs
Piloting Domains: e-Justice and eConfirmation
Disadvantages:
Restricted Scalability
It may not be possible, to actor’s role/service type from his certificate
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

8. Trust Model: Community PKI
Piloting Domain:
eTendering
Hierarchical Community PKI covers AP/SMP (PTN, CEF PKI Service)
CR to OpenPEPPOL to extend scope to C1/C4 for good reasons was not accepted
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

9. Challenge: C1 <-> C4 Authentication
Documents / payload exchanged shall be sealed by the generating & sending service using an advanced digital seal
applied on an ASiC-E Manifest
respective on evidence DeliveryNonDeliveryToRecipient
“Corners” sealing are systems, not “Participants”
Related Business Requirements address authentication
Receiving / consuming party must be able to validate authentication - means to establish trust in the certificate used for sealing
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

10. Trust Brokerage using STS / SAML
Issued SAML Token vouches for C1/C4
Already foreseen by PEPPOL
But never implemented/used
But: SAML according eIDAS eID would be an option for REQ3, Sender Identification
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

11. Trust Federation using Trusted Lists
Established Model for CA Type of Trust Services (at least for issuers of qualified certificates)
eIDAS Recital (46):
“Trusted lists are essential elements in the building of trust among market operators as they indicate the qualified status of the service provider at the time of supervision.”
TL entry depicts (among other details):
../DigitalIdentity: Certificates used (enc, sig/seal)
Essentially is the trust anchor to validate presented certificates
TSPs able to use issuing CA of their choice, nat. regulation may apply
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

12. Trusted List in e-SENS
TSL specification itself not only addresses qTSP/qTS according eIDAS
Domains may set up and maintain own TL
Actually used or in set up by Domains eHealth, eTendering and Business Lifecycle
Domain TLs since years in use by e.g. European Banking Sector, German eHealth “gematik”
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

13. Special Case: Interconnecting existing ERDS by CEF eDelivery
Application Domain:
General purpose ERDS established in piloting countries are used for cross-border processes and procedures of Business Lifecycle use cases
Pilot developed in view of Art. 44 of eIDAS
Main key is enabling for legal value (solutions aim to qualify as Q(ualified)ERDS)
Recital (22): In order to contribute to their general cross-border use, it should be possible to use trust services as evidence in legal proceedings in all Member States.
Participating Countries: FR, DE, AT, GR, SI
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

14. Project funded under CEF Telecom Call 2015-1
Take-up:
Connecting Europe Facility
NOBLE (NO Barriers in edeLivEry)
Project funded under CEF Telecom Call
10 beneficiaries from DE, FR, GR, SI
Timespan October 2016 – September 2017
Productive setup of 7 APs and SMPs
thereof 6 APs to interconnect ERDS of above countries
initial usage for data exchange in Business Lifecycle procedures, but not bound to these use cases
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

15. WP5.4 eDelivery landscape – on it‘s way to NOBLE
(initially already was connected to WP5.4 PoC AP AP AP AP AP
Lettre recommandée
en ligne
Slovenska Centralna rešitev za e-Vročanje
National solutions per ERDS Realm use adapters to connect to APs
19/11/2016
CEF eDelivery and ERDS, Trust Establishment 15

16. ERDS in 4-Corner Model Not covered by CEF yet Domestic means Domestic
ORIGINAL SENDER
Ultimate Recipient C1
CORNER
End-to-end Trust/Security C4
Trust Domein A,
Inner Security
Inner Security
Trust Domain B,
uses
uses
Now: C1,C2,C3,C4 (q)ERDS in
Trust List
Domestic ERDS Messaging/ Transport Layer
SUBMIT
ERDS Realm
MS A
ERDS Realm MS B
DELIVER
1 or several
NOTIFY
NOTIFY
1 or several
Domestic
means
Domestic
means C2 C3
CORNER
Cross-AP Trust/Security
AS4
CEF eDelivery Messaging
and Transport Layer
Adapter/ Connector
Access
Point
SEND
RECEIVE
Access
Point
Adapter/ Connector
ACKNOWLEDGE
Networking Layer: Internet
E.g. given by
Community PKI
like PTN
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

17. eIDAS on TS, (q)ERDS
Art gives a general definition of scope and duties
Art defines the requirements for qualified ERDS
Important: If “data being transferred between two or more qualified trust service providers” applies for all TS involved – means QERDS and APs in the 4-Corner Model
Trust Service Provider for QERDS and APs may be separate entities
If all seen as QERDS type of TS, requirements must be fulfilled by each TS involved, at least fulfilment must be ensured over the whole 4-Corner delivery chain in a trustworthy manner
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

18. TL Governance and Operational Setup
Actually set up as (single instance) Domain TL
Migration of TL set up for ERDS used in Business Lifecyle to official MS TLs expected
Governance defined by EC / national law on QTS
Possible Options for Domain TLs:
Bilateral contracts between Member States or service providers
Network of service providers: Governance defined by service providers in cooperation with national supervisory bodies
ETSI ESI is working standards for trust service status lists providers, including policy & security requirements
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

19. Open points tbd
Authors questions: Should we include some of the issues of the “AT-CZ-DE-FR-IT non-paper on electronic registered delivery services (ERDS)” in the presentation? Alignment still needed with CEF eDelivery BB Security Controls and Recommendations
19/11/2016
CEF eDelivery and ERDS, Trust Establishment

20. Thank you for your attention!
Jörg Apitzsch,
19/11/2016
CEF eDelivery and ERDS, Trust Establishment