A Trust Service Provider (TSP) is an entity that provides any number of trust services involved with the creation, validation and preservation of e-signatures, e-seals or digital certificates.
Security is of utmost importance to ensure the integrity of certificates provided in order to create electronic signatures. As many TSPs store signing keys and digital certificates, these must be stored securely in order to ensure the integrity of the certificates, e-signatures and e-seals issued by the TSP.
TSPs must operate to a set of standards to ensure the security and validity of the certificates and authentication services they offer. The EU's eIDAS regulation has helped standardise the requirements for TSPs and provide organisations with a list of European Commission approved companies that they can trust.
Under the EU eIDAS regulation the definition of a trust service is:
An electronic service normally provided for remuneration which consists of:
TSPs provide a combination of the above services – some only issue digital certificates, others provide electronic signature services as well. What is important is that all TSPs adhere to the strict requirements that ensure the validity and security of the certificates, keys and signatures they provide.
A list of EU Trusted Providers can be viewed on the European Commission’s website.
A Qualified Trust Service Provider (QTSP) must comply with additional measures under the eIDAS regulation to provide qualified certificates, qualified electronic signatures, qualified electronic seals or qualified electronic signature creation devices.
In order to be listed and recognised as a QTSP, organisations must undergo an independent assessment and regular audits to ensure that they continue to adhere to the requirements set out by eIDAS.
The additional requirements are to ensure that the integrity of the data held by QTSPs for the creation of digital certificates and signing keys is secure and protected to ensure validity.
Once an organisation has submitted the required information and QTSP status is awarded, the organisation can be listed as a QTSP on the European Council’s list of trusted providers.
According to the eIDAS regulation, a Qualified Electronic Signature (QES) must adhere to the same definition as an Advanced Electronic Signature (AES), but also:
Qualified Trust Service Providers are able to provide QES and are regarded as the highest level of trust.
Ascertia’s ADSS SAM Appliance is Common Criteria EAL4+ certified against the eIDAS ETSI EN 419 241 standard and the EN 419 241-2 Protection Profile with Level 2 Sole Control and is recognised as a QSCD and QSealCD.
Many TSPs and QTSPs use Ascertia’s high-trust solutions to deliver their services. Contact us to discuss your requirements and how we can help.