PD CEN/TS 419261:2015 - Security requirements for trustworthy systems managing certificates and time-stamps

PD CEN/TS 419261:2015

Security requirements for trustworthy systems managing certificates and time-stamps

Status : Current   Published : April 2015



1.1 General

This Technical Specification establishes security requirements for TWSs that can be used by a TSP in order to issue QCs and Non-Qualified Certificates (NQCs) as well as electronic time-stamps in accordance with Dir. 1999/93/EC and with [Reg. 910/2014/EU].

Security requirements for the Subject Device Provision Service, which includes SCDev/QSCD provision to subjects, are defined in this TS. However, requirements specific to SCDev/QSCD devices, as used by subjects of the TSP, are outside the scope of this TS. These requirements are defined as Common Criteria [CC] Protection Profiles (PP) in the EN 419211 series.

Recommendations for the cryptographic algorithms to be supported by TWSs are provided in ETSI/TS 119 312.

Although this TS is based on the use of public key cryptography, it does not require or define any particular communication protocol or format for electronic signatures, certificates, certificate revocation lists, certificate status information and time-stamp tokens. It only assumes certain types of information to be present in the certificates in accordance with Annex I of Dir. 1999/93/EC and of [Reg. 910/2014/EU]. Interoperability between TSP systems and subject systems is outside the scope of this document.

The use of TWSs that are already compliant to relevant security requirements of this TS should support TSPs in reducing their burden to establish conformance of their policy to ETSI TS 119 411‑1, 119 411-2, and 119 421 (or equivalent ENs to be subsequently published) and in meeting the Annex I and Annex II requirements of Dir. 1999/93/EC as well as the requirements from Annex I and Article 24.2 (e) of [Reg. 910/2014/EU].

1.2 European Regulation-specific

The main focus of this document is on the requirements in Article 24.2 (e) of [Reg. 910/2014/EU] whilst still facilitating the meeting of requirements in Dir. 1999/93/EC, Annex II (f). In considering [Reg. 910/2014/EU] it is important to take into account the following requirements of particular relevance to TSP trustworthy systems:

  1. Article 24.2 (f) – “use trustworthy systems to store data provided to it, in a verifiable form so that:

    1. they are publicly available for retrieval only where the consent of the person to whom the data relates has been obtained,

    2. only authorised persons can make entries and changes to the stored data,

    3. the data can be checked for authenticity”;

  2. Article 24.2 (g) – “take appropriate measures against forgery and theft of data”;

  3. Article 24.2 (h) – “record and keep accessible for an appropriate period of time, including after the activities of the qualified trust service provider have ceased, all relevant information concerning data issued and received by the qualified trust service provider, in particular, for the purpose of providing evidence in legal proceedings and for the purpose of ensuring continuity of the service. Such recording may be done electronically”;

  4. Article 24.2 (j) – “ensure lawful processing of personal data in accordance with Directive 95/46/EC”;

  5. Article 24.2 (k) – “in case of qualified trust service providers issuing qualified certificates, establish and keep updated a certificate database”;

  6. Article 24.3 – “If a qualified trust service provider issuing qualified certificates decides to revoke a certificate, it shall register such revocation in its certificate database and publish the revocation status of the certificate in a timely manner, and in any event within 24 hours after the receipt of the request. The revocation shall become effective immediately upon its publication”;

  7. Article 24.4 – "With regard to paragraph 3, qualified trust service providers issuing qualified certificates shall provide to any relying party information on the validity or revocation status of qualified certificates issued by them. This information shall be made available at least on a per certificate basis at any time and beyond the validity period of the certificate in an automated manner that is reliable, free of charge and efficient”;

  8. Article 42.1 – “A qualified electronic time stamp shall meet the following requirements:

    1. it binds the date and time to data in such a manner as to reasonably preclude the possibility of the data being changed undetectably;

    2. it is based on an accurate time source linked to Coordinated Universal Time; and

    3. it is signed using an advanced electronic signature or sealed with an advanced electronic seal of the qualified trust service provider, or by some equivalent method”;

  9. Annexes I, III, IV – requirements on data in qualified certificates

Standard NumberPD CEN/TS 419261:2015
TitleSecurity requirements for trustworthy systems managing certificates and time-stamps
Publication Date30 April 2015
Normative References(Required to achieve compliance to this standard)ETSI TS 119 421, ETSI TS 119 411-1, ETSI TS 119 411-2, EN 419211
Informative References(Provided for Information)ISO/IEC 19790, EN 1627, 1999/93/EC, REGULATION (EU) No 910/2014, CCMB-2012-09-003, ETSI EN 319 401, CCMB-2012-09-002, RFC 5280:2008, CWA 14172-3, EN 419221-2, CCMB-2012-09-001, EN 419221-3, RFC 3647:2014, ETSI/TS 119 312, ISO/IEC 9798-1:2010, ISO/IEC 10118-1:2000, ISO 7498-2:1989
DescriptorsService contracts, Application program interface, Identity cards, Personal identification numbers, Security, Signature stamps, Identification methods, Cards
Title in FrenchExigences de sécurité pour systèmes de confiance gérant des certificats et des horodatages
Title in GermanSicherheitsanforderungen für vertrauenswürdige Systeme zur Verwaltung von Zertifikaten für elektronische Signaturen und Zeitstempel
ISBN978 0 580 86425 4
File Size1.985 MB

 Your basket
Your basket is empty

Multi-user access to over 3,500 medical device standards, regulations, expert commentaries and other documents


The faster, easier way to work with standards

Worldwide Standards
We can source any standard from anywhere in the world

Tracked Changes

Understand the changes made to a standard with our new Tracked Changes version