Management of remote signature and seal creation devices

How a QTSP generates, backs up and destroys the private keys behind remote signing and sealing, under eIDAS Annex II and CEN/ETSI standards.

Management of remote signature and seal creation devices is the custodial duty a QTSP carries when the private key behind a signature or seal never leaves its HSM. It covers the security and procedural discipline applied to a qualified signature creation device (QSCD) operated remotely for remote signing and sealing, as opposed to a device the signatory holds personally, such as a smart card.

eIDAS Annex II sets the baseline. Generating or managing signature creation data on behalf of a signatory may only be done by a QTSP, and even then only under conditions that protect the same guarantee a personal device gives automatically: that the data can be used by the legitimate signatory alone. Duplication is allowed, but only for backup, and only if two conditions are met:

  • equal security: every duplicate must be protected to the same level as the original key
  • minimum copies: the number of duplicates may not exceed what continuity of service actually requires

In practice this custodial duty runs through the whole life of the key. A key ceremony or an audited equivalent governs generation inside the certified HSM; a signature activation module (SAM) enforces sole control so that only the authenticated signatory can trigger a use of their own key; logging and monitoring give the provider (and its auditor) evidence that none of this was bypassed; and secure decommissioning destroys the key material once a contract ends or a device is retired, so that no usable copy survives outside the two authorised backups.

Note: duplication for backup can look like a breach of sole control, since two copies of the same key now exist. eIDAS treats this as compatible with sole control precisely because both copies stay under the QTSP's own protection and neither the signatory nor anyone else can access them outside the controlled activation process.

Frequently asked questions
Remote signing Qualified signature creation device (QSCD) Hardware security module (HSM) Sole control Cryptographic key generation Key ceremony Signature activation module (SAM) Qualified trust service provider (QTSP) eIDAS Termination plan Conformity assessment report Wallet secure cryptographic device (WSCD)
Back to glossary