Evolution in cross-border interoperability of esignatures and eid. Tarvi Martens SK, Estonia

Transcription

1 Evolution in cross-border interoperability of esignatures and eid Tarvi Martens SK, Estonia

2 Let s read the title again! Evolution in cross-border interoperability of esignatures and eid Prerequisites: eid esignature Evolution Cross-border interoperability

3 European eid landscape

4 esignature landscape

5 Summary of current situation eid deployment: Some countries are leading Some countries have odd solutions and/or are stalled Number of countries have plans Number of countries do not even have a plan Deployment: 5-10 years esignature practice: Used mostly in closed systems No common understanding of free-flowing digitally signed file

6 Use of eid & esignature in Estonia ID-card launched 6 years ago Rollout completed, 1M+ cards out Common system for esignatures, widely accepted and deployed for 5+ years All major e-services support ID-card Internet voting deployed... ~ users

7 Cross-border interoperability eid uptake low Even worse with esignatures <1% of transactions cross-border Cross-border interoperability???

8 Manchester declaration By 2010 European citizens and businesses shall be able to benefit from secure means of electronic identification that maximise user convenience while respecting data protection regulations. By 2010 Member States will have agreed a framework for reference to and where appropriate the use of authenticated electronic documents across the EU, as appropriate in terms of necessity and applicable law

9 The road to Nirvana i2010

10 Drivers behind interop Political eprocurement Service Directive Business ebanking etc. General Common understanding of digital signature Standardization in industry (cards, tools etc.)

11 Evolution: yes! Technically repeatedly piloted IDABC Bridge/Gateway v.1. European Bridge-CA (TeleTrust, Germany) Euro-PKI, GUIDE,... openvalidation.org Initatives to be observed today De Norske Veritas e-notary service Spanish egov Validation Gateway eapostille Upcoming IDABC Bridge/Gateway v.2. Upcoming eid Large Scale Project

12 Organizational issues Paper-ID interoperability works! Miracles happen in border points Organizational set-up of Paper-ID interop: ICAO sets standards Continuous information exhange by network of MoIA-s to the borderguards etc. Organizational set-up of eid interop??? Standards are not strict and not imposed Continuous information exhange is missing completely

13 Need for (foreign) eid info Collecting and managing eid/service info is a daily job, not project-based What info is needed? Certificate validity (reference) Certificate semantics Certificate quality (!!!) Hardware token vs. software certificate Quality of service provider & certificate Context of certificate issuance...

14 Handling foreign eid Service Provider What certificate is that? Certificate quality / semantics / validity Identity hub Certification & validation service providers foreign user

15 What document is that? translation and assessment E-notary esignature handling What certificate is that? Certificate quality / semantics / validity Identity hub Digital signing software providers Certification & validation service providers

16 Who will run the Indentity Hub? EC does not have mandate (yet) Single MS cannot afford it (to cover all Europe/World) No actual demand (read: need covered with money) Low volume of international transactions Uptake of national eid-s is still underway We need clear political agreement to create such a service in EU level In future we can envisage situation where every MS runs its own e-borderguard

17 The Other Direction - Harmonization Standardization European Citizen Card (ECC) Common middleware OpenSC Windows Vista plug-and-play for smartcards Various approaches and initiatives to solve differences in middleware layer

18 Legal problems There is no eauthentication Directive National legislations hardly touch the subject SP: Who to sue if I will make wrong assessment on certificate inheritance/validity?

19 Bottom Line We need to create and distribute eid-s first Preferably PKI-based qualified certificates Then teach holders of eid-s to use them Estonian case: penetration usage But interop shall be addressed NOW Withouht vision, political will and hard work there would never been such thing as EU

20 Thank You!