Trust services

In the paper world trust comes from notaries, handwritten signatures, stamps and registered letters. Online, that job belongs to trust servicesServices that create trust online: electronic signatures, electronic seals, timestamps, registered delivery, website authentication and the like.: services that show who signed a document, when it existed and whether it changed along the way.

Three levels of signature

eIDAS recognises electronic signatures at three levels. A simple electronic signature can be just the name at the bottom of an email. An advanced signature is a cryptographic signature linked to the signer that reveals any change. A qualified electronic signature, or QESQualified Electronic Signature: a signature based on a qualified certificate and created on a secure signing device; legally equivalent to a handwritten signature., is the highest level and has the legal effect of a handwritten signature. Its key lives in secure hardware that cannot be copied.

Qualified and non-qualified

Not every provider of trust services is "qualified". To earn the title, an organisation passes an independent conformity assessment, comes under the supervision of a national body and is re-assessed regularly. These organisations are called QTSPsQualified Trust Service Provider: a trust service provider that has passed independent assessment and is supervised by a national body.. Evidence from a qualified service carries more legal weight in courts and institutions.

Who is qualified: trusted lists

How does a verifier know that a signature really comes from a qualified provider? Each EU member state publishes its qualified providers in a signed trusted listA signed, versioned list showing which organisations are trusted, together with their keys., in the ETSI TS 119 612 format. The European Commission publishes the list of those national lists, the LOTLList of Trusted Lists: the top-level list that points to every national list with its address and signer.. The diagram above shows the same chain as Tamga uses it: the list of lists, a national list, an institution, a credential.

What eIDAS 2.0 adds

• Qualified attestations. QTSPs can now confirm a person's attribute, such as a profession or a mandate, with a qualified credential called a QEAAQualified Electronic Attestation of Attributes: an attribute attestation issued by a QTSP, with strong legal weight.. The next page compares it with the other kinds.
• Qualified electronic ledgers. A ledger service that legally assures the order and integrity of records. The chapter on shared ledgers explains Tamga's path here.