Qualified signature creation device (QSCD)
A QSCD (qualified electronic signature creation device) is certified hardware, such as an HSM, that creates a qualified signature or seal under EU eIDAS.
A QSCD - the qualified (electronic) signature creation device defined in eIDAS article 3(23) - is the certified, tamper-resistant hardware that holds the signature creation data (the private key) and creates a qualified signature or seal under the EU eIDAS regulation. Article 3(22) actually defines the underlying signature creation device more broadly, as configured software or hardware; in practice, certified QSCDs are built as dedicated hardware. A QSCD is one of the two things that make a signature qualified: Article 3(12) defines a qualified electronic signature as an advanced electronic signature created with a QSCD and based on a qualified certificate. An advanced electronic signature needs neither. eIDAS Annex II sets its requirements: key confidentiality, protection against forgery and use by others, reliable key generation, and - the legal basis for remote signing - that key generation and management on the signatory's behalf may only be carried out by a QTSP. Certification is typically done against Common Criteria protection profiles; the predecessor device under the earlier eSignatures Directive was called an SSCD (secure signature creation device). The seal equivalent - a QSealCD, or qualified electronic seal creation device - follows the same Annex II requirements to produce qualified electronic seals.
A QSCD can be a smartcard or USB token, or - the dominant model today - a remote QSCD: a certified HSM operated by a QTSP for remote signing. eIDAS 2.0 (Regulation (EU) 2024/1183) added Article 29a, a qualified trust service for the management of remote QSCDs, formalising this remote-signing model in its own right. In the EUDI Wallet context the same role is played by the WSCA/WSCD (wallet secure cryptographic application/device). A wallet can produce qualified signatures either because its own WSCD itself holds QSCD certification, or - more commonly - by relying on a remote QSCD that a QTSP manages on the signatory's behalf, in which case the local WSCD need not be QSCD-certified.