scope:

The present document provides policy and security requirements for Trust Service Providers (TSPs) implementing a service component supporting AdES digital signature creation. This component contains a signature creation application and is thus called Signature Creation Application Service Component (SCASC). However, it is more than just the SCA. It contains service elements around which parts of the driving application as defined in ETSI TS 119 102-1 [2] and ETSI TS 119 101 [1] can be implemented. The present document does not give restrictions on whether something is covered within a signature creation application or outside, as long as it is done by the SCASC.

The present document gives no restrictions on the type of TSP implementing such a service component.

The present document aims at supporting the creation of digital signatures in European and other regulatory frameworks.

NOTE 1: Specifically, but not exclusively, the present document is aimed at trust services, supporting the creation of digital signatures in accordance with the requirements of the Regulation (EU) No 910/2014 [i.1] for electronic signatures and electronic seals (both advanced and qualified). Annex B contains specific requirements for SCASC in the context of Regulation (EU) No 910/2014 which aim at providing best practice requirements for the creation of advanced electronic signatures and seals based on X.509 certificates.

NOTE 2: Specifically, but not exclusively, digital signatures in the present document can be used to create electronic signatures, advanced electronic signatures, qualified electronic signatures, electronic seals, advanced electronic seals, and qualified electronic seals as per Regulation (EU) No 910/2014 [i.1].

The present document may be used by competent bodies as the basis for confirming that an organization is trustworthy in creating AdES digital signatures.

NOTE 3: See ETSI EN 319 403 [i.6] for guidance on assessment of TSP processes and services.

The SCASC has connections with external (trust) services that can be contacted for example for provisioning information to be included within the signature. The present document does not put requirements on the trust service policy applied by such external services.

The present document does not specify any protocol used to access the SCASC or how the SCACS can contact an SSASC or an SCDev.

NOTE 4: Protocols to contact a SCASC or a SSASC are defined in ETSI TS 119 432 [i.9].

The present document identifies specific controls needed to address specific risks associated with services providing AdES signature creation.