PEPPOL Quality Trust Ratings | Ascertia | Blog

PEPPOL is a large-scale European Commission project, working on allowing any company in the EU to be able to communicate electronically with any EU governmental institution for all procurement processes.

PEPPOL process

PEPPOL includes pre-award (e.g. tendering) and post-award (e.g. ordering and invoicing) processes. The results of PEPPOL are very interesting. They go beyond e-procurement and include other e-Gov applications and even non-government sectors. Additionally, it is applicable on a global basis rather than just within the EU.

PEPPOL vision for eSignatures

The eSignature vision of PEPPOL is:

“...to have solutions that make it possible for economic operators in any European country to utilise the eSignatures of their own choice when submitting offers electronically to any European public sector awarding entity.”

Economic operators are seen as product and service suppliers responding to public tenders. PEPPOL’s ultimate interoperability aim for eSignatures can be expressed as:

Need for trusted Validation Authorities (VAs)

To achieve this vision, PEPPOL recognises that there are many challenges for the Relying Party application which needs to process eSignatures.

There are other technical challenges apart from multiple signature and document formats, multiple eID issuers and issues of scaling. The real issue for the Relying Party is the assessment of the risk implied by accepting the signature and eID.


This risk is determined by:

• Signature legal status
• Quality of the eID
• Quality of the cryptography used
• Liability position
• Trustworthiness of the issuing Certificate Authority (CA)
  
  

These are tough questions for a would-be relying party needing to accept eSignatures from any corner of Europe and beyond.

To aid the process, PEPPOL recommends relying parties use Validation Authority (VA) service providers. It takes the technical burden of signature verification away from business applications and the associated risk through use of an agreed liability model.

Such a model already exists in the form of the BBS Global Validation Service, a centralised authority for verifying eSignatures and eIDs across Europe. The following diagram illustrates how BBS offers validation services to relying parties, shielding them from the complexity of PKIs and associated risks:

The BBS Global Verification Service uses Ascertia ADSS Server as the underlying signature and eID verification technology.

Please note: Originally this service was offered by DNV using earlier versions of ADSS Server. 

Signature and eID quality requirements

In an open, non-exclusive, environment, determining which CAs are trustworthy to an appropriate quality level in an automated manner is an essential requirement for Relying Parties.

Therefore, differences in national legislation, as well as different requirements for business applications necessitate development of a framework to enable quality ratings for eSignatures and eIDs.

PEPPOL provides a specification for non-discriminatory rules for acceptance of eIDs to replace present policies for national solutions, which only refer to domestic eID issuers or national accreditation schemes.

Ascertia worked with DNV as part of the Global Verification Service to help establish a signature and eID quality rating scheme back in 2006.

The PEPPOL project took this framework and extended it further, specifically including a parameter for measuring the independent assurance level.

The PEPPOL quality rating framework is based on the following aspects:

• eID quality: Quality must consist of:
  
  
• A certificate quality parameter ranging from zero to six depending on the issuing CA’s CP/CPS. For example, is a qualified certificate policy being used in accordance with ETSI TS 101 456 standard? Is the user’s private key held within a SSCD? Six is the highest level.
  
  
• An independent assurance parameter ranging from zero to seven which defines how the issuing CA is audited and accredited. E.g. is the CA accredited by a public, national or international authority according to applicable law to the CA? Seven is the highest level that can be achieved.

• Hash Algorithm quality:
  
  
  • Ranging from zero to five, depending on how secure the hash algorithm is. Five is the highest level, although most algorithms that are considered secure today are expected to have a rating of two indicating they are good for next 5 to 10 years.
    
    
• Public key quality:
  
  
  • Ranging from zero to five, same as above.