ZertES

ZertES is a Swiss Federal law that regulates the conditions under which trust service providers may use certification services with electronic signatures. Additionally, this law provides a framework that outlines the provider’s obligations and rights as they apply to providing their certification services.[1][2]

Description

ZertES was approved into law on December 19, 2003.[3] The law promotes the use of secure services for electronic certification to facilitate the use of qualified electronic signatures. Under this law, the signatures would be equal to a handwritten signature.[4]

Switzerland’s ZertES law possesses a similar tiered structure and standards of legal value as the European Union’s eIDAS Regulation. ZertES provides several assurance levels; qualified electronic signatures is the highest level, equivalent to a handwritten signature. For many official documents, it is required that the electronic signatures used be at this qualified electronic signature level.[1]

Standards

Under ZertES, an electronic signature refers to electronic data that is either attached to or associated to other electronic data, which serves as a means of authentication for that data. Currently, ZertES does not provide specifications on how electronic signatures should be technically implemented. Despite this limitation, the Swiss Federal Council has made international agreements to facilitate the international use of electronic signatures and allow for their legal recognition. Therefore, the Council allows that electronic signatures that have been technically implemented as digital standards in eIDAS be accepted.[5]

The following standards are recognized by the Swiss Federal Council:[1]

Electronic transactions

A Fortgeschrittene Elektronische Signatur, also known as an Advanced Electronic Signature, must meet certain requirements in order to prove its authenticity, including:[1]

  • Establishing a unique link to its signatory
  • The ability to identify its signatory or holder
  • Having been created with software or equipment that remains under the sole control of its signatory
  • The capability of identifying if the data or document to which it is attached to has been altered or tampered with after being signed[1]

ZertES allows for the enhancement of the advanced electronic signature and its legal value by adding on a qualified certificate, which is similar to how eIDAS allows for this instance. The upgraded advanced electronic signature is referred as qualifizierte elektronische Signatur or qualified electronic signature. The signature must be produced by a secure signature creation device and then be attached to the qualified certificate. At the time that the signature is created, the certification must be valid.[1]

ZertES requires that qualified certificates must provide:[2]

  • A serial number that identifies it as a qualified certificate
  • The name of the individual who holds the signature verification
  • Signature verification
  • The name and state of where established in addition to the qualified electronic signature of the issuer of the certificate, referred to as Anbieterin von Zertifizierungsdiensten, in addition to the national or foreign accreditation body that accredited the issuer
  • Time that the certificate will be valid for
  • Proof of recognition for the certificate service provider who provides the certification services
  • Transaction information for which the certificate can be used[2]

Certificate service providers that issue qualified certificates are required to undergo audits performed by a conformity assessment body that has been appointed by the Schweizerische Akkreditierungsstelle.[1]

Under ZertES, the Swiss Federal Council regulates signature generation and issues Signaturprüfschlüssel (Signature Verification Keys) to qualified certificates. The secure signature creative device must verify that the signature key used is:[5]

  • Unique and its secrecy can be reasonably assured
  • Protected from being counterfeited
  • Under the sole control of the signatory

The signature verification process will ensure that:

  • The data used to verify the signature corresponds to the data sent to the verifier
  • The signature is reliably verified and its verification result is displayed correctly
  • If needed, the verifier is able to determine the contents of the signed data
  • It is clearly identified when a pseudonym is used
  • If tampering has occurred, it will be detected
  • The signature owner’s identity is properly displayed[5]

ZertES requires Qualified Trust Service Providers to meet requirements that will ensure the validity of the certificates they issue for electronic signatures. Providers can be naturalized or legal citizens. Under certain circumstances, foreign suppliers may be permitted to provide certification services.[5]

ZertES is similar to eIDAS in assuring the legal bindingness of electronic signatures and a tiered approach to legal value in court with qualified electronic signatures having a higher probative value than Advanced Electronic Signatures. Cross-border communications between Switzerland and the Member state of the European Union occur on a daily basis, as the country is home to many internationally active banks and companies. Therefore, ZertES and eiDAS are comparable in technical design and carry similar legal implications.[1]

gollark: I can't get around that.
gollark: No, it does.
gollark: - PotatOS uses a single global process manager instance for nested potatOS instances. The ID is incremented by 1 each time a new process starts.- But each nested instance runs its own set of processes, because I never made them not do that and because without *some* of them things would break.- PotatOS has a "fast reboot" feature where, if you reboot in the sandbox, instead of *actually* rebooting the computer it just reinitializes the sandbox a bit.- For various reasons (resource exhaustion I think, mostly), if you nest it, stuff crashes a lot. This might end up causing some of the nested instances to reboot.- When they reboot, some of their processes many stay online because I never added sufficient protections against that because it never really came up.- The slowness is because each event goes to about 200 processes which then maybe do things.
gollark: WRONG!
gollark: It doesn't reuse already allocated IDs.

References
  1. Turner, Dawn M. "Understanding ZertES - the Swiss Federal Law on Electronic Signatures". Cryptomathic. Retrieved 12 May 2016.
  2. Der Schweizerische Bundesrat. "Verordnung über Zertifizierungsdienste im Bereich der elektronischen Signatur (Verordnung über die elektronische Signatur, VZertES)". Retrieved 12 May 2016.
  3. Die Bundesversammlung der Schweizerischen Eidgenossenschaft. "Bundesgesetz über Zertifizierungsdienste im Bereich der elektronischen Signatur (Bundesgesetz über die elektronische Signatur, ZertES)". Swiss Confederation. Retrieved 12 May 2016.
  4. Nixon, Paul G.; Koutrakou, Vassiliki N.; Rawal, Rajash (2010). Understanding E-Government in Europe - Issues and Challenges. Routledge. Retrieved 12 May 2016.
  5. The Federal Assembly of the Swiss Confederation. "Federal law on certification services in the area of the electronic signature (Law on the electronic signature, ZertES)". Federal Office of Communications. Retrieved 12 May 2016.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.