eIDAS: Overview on the implementation and uptake of Trust Services

eIDAS: Overview on the implementation and uptake of Trust Services One year after the switch over DECEMBER 2017

About ENISA

The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop recommendations and provide advice on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

Contact

For contacting the authors please use trust@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

Legal notice

Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent state-of the-art and ENISA may update it periodically.

Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that information contained in this publication might be put to.

Copyright Notice

© European Union Agency for Network and Information Security (ENISA), 2017 Reproduction is authorised provided the source is acknowledged.

ISBN 978-92-9204-247-9 DOI 10.2824/611041

Table of Contents

Executive Summary 5

1. Introduction 7

1.1 Objectives of the report 8

1.2 Methodology 8

1.3 Structure of the report 10

2. Trust Services Uptake one-year after the eIDAS roll-out 11

2.1 TSP Trend towards being Qualified 11

2.2 Market penetration of Qualified and non-Qualified Trust Services 14

2.3 Key factors and barriers influencing development of the Trust Service market 19

2.4 SB and CAB Experience 22

2.5 Business models for Trust Services and involvement of public administration 26

3. TSP market dynamics analysis 29

4. Key Points and Conclusions 32

5. References and bibliography 35

5.1 References 35

5.2 Relevant implementing acts 35

Abbreviations

CA Certification Authority CAB Conformity Assessment Body CAR Conformity Assessment Report CD Commission Decision CEN Centre Européen de Normalisation CID Commission Implementing Decision CIR Commission Implementing Regulation EC European Commission EEA European Economic Area eID electronic Identification EN European Standard ETSI European Telecommunications Standards Institute ETSI TS ETSI Technical Specifications EU European Union GDPR General Data Protection Regulation IAS² IAS² European Commission Study – SMART 2012/0001 (see bibliography) ISO International Organization for Standardization MS Member State OID Object Identifier OJ Official Journal (of the European Union) PKI Public Key Infrastructure QERDS Qualified Electronic Registered Delivery Service QESeal Qualified Electronic Seal QESig Qualified Electronic Signature QTS Qualified Trust Service QTSP Qualified Trust Service Provider QTSP/QTS Qualified Trust Service Provider and the Qualified Trust Service it provides QTST Qualified Time Stamp Token QValQES Qualified Validation service for Qualified Electronic Signatures/Seals SB Supervisory Body Sdi Service digital identifier SME Small and Medium-sized Enterprise TL Trusted List TLSO Trusted List Scheme Operator TS Trust Service TSA Time Stamping Authority TSP Trust Service Provider TSP/TS Trust Service Provider and the Trust Service it provides TSU Time Stamping Unit URI Uniform Resource Identifier QWAC Qualified Website Authentication Certificate

Executive Summary

In the context of the eIDAS Regulation, ENISA conducted a study to present an overview of the implementation and uptake of Trust Services defined in the eIDAS Regulation one year after adoption to the new regime, and analyse the new opportunities and incentives introduced in the European Trust Services market.

One year after the switch over to the eIDAS regulation, the number of the Trust Services has significantly grown and there is a significant trend of TSP (64%) towards the process of being qualified. This goes some way to support the wide recognition of the added value of the qualified status in the Trust Services market. Considering the eIDAS Regulation as a framework, there is a lot of space for individual interpretation but also for development at the level of Member States or even organisations. The survey results indicate, that for more than 90% of the respondents recognize eIDAS as an opportunity to grow their business. At the same time, the methods for provisioning Trust Services needs to be renewed with an innovative approach and “out-of-box” thinking.

Concerning the penetration level of (Qualified)Trust Services in the market, “Classical” Trust Services, related to the issuance of certificates receive a high recognition rate in the market, while the newly defined services by eIDAS, as well as remote qualified trust services for the generation of QESign/QESeal still do not receive widespread recognition. Future plans of (Q)TSP reveal a greater trend towards the provision of qualified trust services in comparison to non-qualified ones.

Moreover, it is recognized that the market is still trying to fully understand the consequences of this regulation. Currently, technical standards (e.g. signature in the cloud) are still under development and for certain services there are only a few providers in specific Member States. In addition, respondents pointed out gaps in the legislation and standardisation, with regards to the electronic delivery, electronic validation, preservation and conformity assessment, as well as Conformity Assessment Body accreditation. This may lead to disharmony of the Trust Services market in the European Union and put in question the “quality level” of Trust Services.

The following conclusions provide further insight concerning the barriers, weaknesses, strengths and drivers for the uptake of (qualified) trust services and derive from the survey as well as the in-depth open questions with selected stakeholders.

A) Barriers and Weaknesses

 Low level of knowledge of what is trust and its importance among the potential users (citizens, enterprises) and lack of understanding of Trust Services.  Current market distortions such as seeming oligopolies in certain market sectors (i.e. browsers market)  Immaturity of the trust services market, not much knowledge about concrete implementation models and integration with current business processes.

 Gaps in Standardization, limitations posed by soft law approaches and technical specifications mainly in regard to new defined services (electronic delivery, electronic validation, preservation), the conformity assessment process and the accreditation of CAB.  National level trust services non-conformant with eIDAS regulation create uncertainty and confusion, hindering the uptake of the Trust Services Market.  Limited number of Applications to support trust services and closed market of web browsers.  Very few providers to offer qualified trust services and high reluctance towards developing new solutions.

B) Strengths of the Trust Services market

 eIDAS brings legal certainty which is a key enabler, since organisations are facilitated to organize and deliver their digital strategies with confidence.  eIDAS is a key to ease the application of sectoral regulations (e.g. PSD2, MIFID2) and to guide towards the compliance with the new GDPR.  It provides a powerful and solid base in developing new solutions and services, being recognised across Europe.  Business requirements of industries with big digital transformation processes, like finance and healthcare, can create market opportunities. A need for certainty, integrity and speed in industries processes can be the driving force for the growth and uptake of Trust Service market.

C) Key Drivers for Trust Services Uptake

 Usability and integration with business services  Enhance user experience and user-friendly approach  Development of applications, standards to support “new” trust services

1. Introduction

Regulation (EU) No 910/2014 (hereafter the eIDAS Regulation), on electronic identification and trust services for electronic transactions in the internal market, provides a regulatory environment for electronic identification of natural and legal persons and for a set of electronic trust services, namely electronic signatures, seals, time stamps, registered delivery services and certificates for website authentication and it repeals Directive 1999/93/EC . Under the eIDAS Regulation it is possible to use the trust services as well as electronic documents as evidence in legal proceedings in all EU Member States contributing to their crossborder use.

To further enhance in particular the trust of small and medium-sized enterprises (SMEs) and consumers in the internal market and to promote the use of trust services and products, the eIDAS Regulation introduces the notions of qualified trust services and qualified trust service provider. It aims to identify requirements and obligations that ensure a high-level of security for whatever qualified trust service or product is used or provided.

In order to ensure a high-level of security of qualified trust services, the eIDAS Regulation foresees an active supervision scheme of qualified trust service providers (QTSP) and the qualified trust services (QTS) they provide (hereafter referred to as a QTSP/QTS) by the national competent Supervisory Body (SB) that supervises, ex ante and ex post, fulfilment of the QTSP/QTS requirements and obligations. Therefore, when a TSP, without qualified status, intends to start providing qualified trust services, it shall submit to the SB a notification of their intention together with a Conformity Assessment Report (CAR) issued by an “eIDAS” accredited Conformity Assessment Body (CAB). National Accreditation Bodies (NAB) contribute to the quality assurance of the whole process by being responsible to accredit a CAB, who will perform the conformity assessment audits to TSP.

In the context of the eIDAS Regulation, ENISA decided to carry out this study to capture the adoption and implementation of Trust Services in the EU market one year after the roll out of the eIDAS Regulation. The European Commission conducted a study on a market plan to stimulate the take-up of eID and trust services for the Digital Single Market back in July 2016 .

Since 2013 ENISA has contributed to supporting the EC on the implementation of the eIDAS Regulation by providing security recommendations for the correct implementation of trust services, mapping technical and regulatory requirements, promoting the deployment of qualified trust services in Europe , raising awareness for relying parties and end users on securing their electronic transactions by using trust services.

1.1 Objectives of the report

Based on the above description, the goal of this report is to present an overview of the implementation and uptake of Trust Services defined in the eIDAS Regulation one year after the switch over to the new regime, and analyse the new opportunities and incentives introduced in the European Trust Services market.

More specifically, this report aims to:

1. Collect input to identify the current status regarding the adoption and implementation of the (Qualified)Trust Services in the European Trust Services market 2. Identify implementation and operational issues of Qualified Trust Services based on the experience gathered by different types of stakeholders. 3. Analyse the new market opportunities and new incentives offered to the (Q)TSP in order to provide new services. 4. Identify the key factors and barriers that influence the development of the (qualified) trust services and define the main strengths and drivers for their further penetration in the EU Market.

The target audience of the report consists of Trust Service Providers (including individuals, businesses and public administrations), those Member States Supervisory Bodies (SB) designated to carry out supervisory activities under the eIDAS Regulation, Conformity Assessment Bodies (CAB) as well as relying parties (users of Trust Services).

1.2 Methodology

Two main tools were employed in this report to identify the eIDAS market uptake: an online survey and an accompanying set of ‘deep analysis’ questions with some of the respondents who participated in the survey, which served to better understand the current eIDAS market and future directions.

1.2.1 Online Survey

The online survey was carried out through the EU Survey Tool, and was submitted to the EU Trust Service market stakeholders through a multitude of communication channels. The survey was mainly shared through the European Commission distribution channel being the DIGIT-CIRCABC mailing list, the Article 19 ENISA Expert Group mailing list and ENISA contacts through the TSP Forum. The survey took place in May and early June 2017. The respondents’ group included representatives of all types of eIDAS stakeholders:  Trust Service Providers (TSP)  Supervisory Bodies (SB)  Conformity Assessment Bodies (CAB)  Relying parties (Users of the Trust Services)

The survey included 37 mixed questions that were short, closed questions (multiple or single choice) as well as open questions, which were designed to give respondents the possibility to provide further details and clarifications. The core of the survey was based on the experience collected by earlier ENISA documents , e.g. guidelines on security requirements applicable to TSPs, auditing framework for TSPs, initiation/supervision of trust service provision, guidelines for TSPs based on standards. The answers to the survey were analysed using quantitative data analysis techniques – with consideration of the differences among individual respondents.

In total, 85 organisations responded to this online survey. The sample consisted of representatives among stakeholders involved in the eIDAS regulation: Trust Service Providers (44), Conformity Assessment Bodies (7), Supervisory Bodies (10) and relying parties (24). In terms of business sector represented, most of the organisations originated from the private sector. Public administration respondents represent about a quarter of the respondents, while only 9% of organisations are of mixed status/nature, as no further characteristics can reasonably be provided.

B U S I N E S S S E C T O R O F T H E O R G A N I Z AT I O N

9%

Private sector Public administration

26%

Mixed

65%

In terms of geographic spread, respondents to this survey originated from 22 EU Member States. The number of responses received from each country has been largely influenced by the number of Trust Service Providers and the Trust Services available in such country as well as the degree of maturity of online and Trust services overall. Therefore, a higher response rate has been reached in countries with a larger number of TSPs (like Belgium, Germany, Italy, Poland, Spain) available.

The responses to the survey provide for quantitative diversity originating from key stakeholders: TSP, SB and CAB. Responses were collected from a number of participants representing different Member States and groups (in terms of stakeholder type and business sector), and therefore, the conclusions of the survey provide interesting insights, seeking to reflect the situation of the European Trust Service market as a whole. Moreover, it is worth noting that Relying Parties refer mainly to organisations using Trust Services for their

own purposes as well as organisations offering related consulting services, thus excluding natural persons acting as Replying Parties in a PKI or in a set comprising of Trust services.

1.2.2 Deep analysis questions

Whereas the survey generated a fair overview of the eIDAS market, it was complemented by four additional in-depth, open questions with selected stakeholders. The survey aimed at seeking to understand the view of market representatives on the uptake of trust services; additionally, it aimed at gaining a deeper insight into possible directions of market development and evolution in the future. A total of 19 responses from 12 Member States have bene submitted and received. Chapter 3 presents the responses collected and highlights the conclusions drawn.

The answers to the open questions have been analysed using qualitative content analysis.

1.3 Structure of the report

Chapter 2 provides in its charts and commentaries a more detailed overview of the trust services uptake status from (Q)TSP, SB, CAB and relying parties, and constitutes the core of this report.

Chapter 3 draws conclusions on the findings and suggests areas for improvements and further steps to be taken, driven by the analysis of open in-depth questions. Similarly, some key drivers for further development have been included.

2. Trust Services Uptake one-year after the eIDAS roll-out

2.1 TSP Trend towards being Qualified

The online survey was carried out in early June 2017, one year after the new rules for trust services under the eIDAS Regulation entered into effect, being 1 July 2016. In June and early July 2017 many (Q)TSP have added their services to the Trust List, as it is described in chapter 3. This is because of the transitional measure laid down in Art.51.3 and Art.51.4 of the eIDAS Regulation, which allowed certification-serviceproviders issuing qualified certificates under Directive 1999/93/EC and considered as qualified on entry into force of the Regulation for trust services, to have an extended period in which to submit a conformity assessment report to the SB up in the period ending on 1 July 2017.

This survey aimed initially to identify (a) whether TSPs recognise the need to provide qualified trust services as defined under the eIDAS regulation and (b) whether they are prepared to undergo the initiation and supervision process (see ENISA reports) as foreseen in eIDAS. A TSP, without qualified status, that intends to start providing qualified trust services should undergo an initiation phase in terms of:

 Preparation: The TSP designs, sets up, implements, tests and deploys in pre-production the QTS it intends to provide, in line with the eIDAS requirements.  Notification: The TSP notifies the SB its intention to become qualified together with the conformity assessment report (CAR) issued by the “eIDAS” accredited CAB.  Initial verification of compliance: The SB verifies whether or not the TSP and the QTS it intends to provide meet the requirements of the eIDAS Regulation in order to be granted a qualified status.  Publication of the qualified status in the national trusted list: Upon notification by the SB that the notifying TSP/TS has been granted a qualified status, the body in charge of the Member State trusted list, updates the list accordingly.

This survey focused on seeking a general approach of the TSP towards compliance with the qualification requirements. The following stages were identified as far as the status of a (Q)TSP is concerned:

 Information gathering  In the initiation phase  Qualified

A large portion of responding TSPs describe their situation as being “in the initiation phase” (64%) while only 4% of the respondents declare that they are still at the stage of “information gathering”. This means that there is a significant tendency (64%) on the part of TSPs to change their status to qualified, which means that the added value of the qualified status is broadly recognised in the TSP market. About 32% of the Trust Service Providers that took part in the survey have been granted qualified status according to the eIDAS security requirements.

T S P S TAT E T O WA R D S B E I N G Q UA L I F I E D

4%

32%

Qualified

In initiation phase

Information gathering

64%

Concerning the TSPs that are currently in the initiation phase, 43% of them are in the preparation phase (for instance, in the phase of developing products, preparing documentation), 43% of them are undergoing the audit process and waiting for the CAR from the corresponding CAB while the remaining 14% are waiting for the SB to verify compliance with the requirements of the eIDAS Regulation. The abovementioned figures are representative of the trend in the period when the survey took place, when many TSPs were still submitting their CAR to the SB, since they were entitled to benefit from the transitional st period ending 1 of July 2017, as defined in Art.51.3 and Art.51.4 of the eIDAS Regulation.

Conclusion 1: There is a significant tendency among TSPs to seek qualified status which verifies the wide recognition of the added value of the qualified status in the Trust Services market.

Most of the survey respondents perceive eIDAS as a business opportunity, which is backed up by their arguments and comments as given below:

 “eIDAS creates a common framework in the European Union and provides new opportunities to expand and offer services across borders”.  “eIDAS provides legal certainty and standardisation that will in turn allow all market players to better prepare their products and lower the risk of being non-compliant”.  “It is expected that the eIDAS will create greater demand for new products and enhance the added value of existing services”.  “eIDAS is also seen as an opportunity for CABs due to new certification areas in Trust Service Providers”.  “The new regulation will become a foundation for digital government and enterprises”.  “eIDAS is also an opportunity mostly corresponding to new services, standardisation and a unified European market”.  “Accreditation as a way of gaining trust from the end users is an additional opportunity”.

 “It creates new market opportunities for eService providers”.

However, when commenting on costs related to become compliant with the eIDAS regulation, TSPs attribute them mainly to the cost for introducing new technologies and necessary changes in organizational processes that are already in place and to the accreditation and audit procedure to be followed. Supervisory Bodies particularly expressed the need for hiring new personnel and for carrying out

specialised trainings in order to prepare new technological challenges.

The survey concludes that the eIDAS regulation is widely recognised as an opportunity for the market. An overwhelming majority (91%) of the TSPs stated that they recognise the eIDAS regulation to some extent as a business opportunity. Just about 50% of the TSPs declare that it is an opportunity for them to grow their business, while 41% recognise it as an opportunity with an additional cost. However, it seems that most of the respondents who chose “both” (business opportunity and additional cost) as an answer, consider the additional cost of eIDAS implementation and/or accreditation as an investment that will result in more business opportunities. The remaining 9% state that the implementation of the regulation will be an additional cost for their organisation.

( Q ) T S P T O WA R D S R E C O G N I T I O N O F E I D A S R E G U L AT I O N

Both

Business Opportunity

Additional Cost

Taking into account the responses from the whole range of stakeholders, the corresponding rates are

comparable, where 92% of the respondents see a business opportunity at least to some extent.

Table 1 gives a breakdown of the answers depending on the organisation type. From the overall data analysis, it is concluded that only SBs are somewhat sceptical as to whether the eIDAS regulation is an opportunity. This can be explained by their role in the Trust Services market. CABs are the most enthusiastic category of parties affected by eIDAS; CABs are auditors of QTSPs and they benefit from the new impetus in implementing the provisions of the Regulation.

2.2 Market penetration of Qualified and non-Qualified Trust Services

One of the main goals of the survey has been to capture the penetration and adoption level of the eIDAS trust services one year after entry into force of the eIDAS regulation. The penetration level of the eIDAS Trust Services has been defined from 1 (least used) to 5 (most used). Based on the results shown in Figure 5, it is worth mentioning that the highest penetration level is related to the two typical services being, (Qualified) Electronic Signatures and (Qualified)Time Stamps. The penetration level of the new trust services - defined by the eIDAS Regulation – has been lagging. The highest growth areas are among the newly-introduced services and they are observed for (qualified) electronic seals and (qualified) validation services.

A small portion of the (Q)TSPs contributing to the survey disclosed the number of certificates issued annually in the two-year period leading up to the eIDAS regulation coming into force (01.07.2014 – 30.06.2016), as well as one year after the entry into force (01.07.2016 – 30.06.2017). From that limited sample, it can be inferred that the number of certificates issued has been growing each year and that the current penetration of non-qualified trust services is greater than the penetration of the qualified ones, which actually coincides with the results of Figure 5.

With reference to Relying Parties (users) when it comes to the use of (Qualified)Trust Services, the majority (75%) of them replied that their companies have implemented such services in their operations, while only 25% have not done so yet; even these Relying Parties, however, have future plan to implement them. Public Administration or private sector organisations using Trust Services for their own purposes as well as companies offering related consulting services are mainly among the respondents being already prepared to use Trust Services.

PENETRATION OF TRUST SERVICES AFTER THE EIDAS ROLL OUT 2.2.1 Remote Qualified Trust Services

Another topic addressed in the survey concerns the implementation of any application that make use of remote qualified trust services by relying parties. Trust Services such as cloud-based services for the generation of qualified electronic signature or qualified electronic seal do not require end users to possess a dedicated hardware device for key pair generation and storage (e.g. a smart card). Instead, the signing key can be securely stored in a remote (cloud-based) system of the QTSP and signatures can be created after strong authentication has been used to authenticate the identity of the signatory. The survey focused on finding out the spread and recognition of remote qualified trust services among businesses in Europe. While 54% of respondents declared that they have not implemented such applications, 42% of respondents confirmed that they use applications that leverage on remote qualified trust services (while the remaining 4% were not sure of the existence of such services in their markets). The respondents represented 9 (Luxembourg, Estonia, Spain, Netherlands, Poland, Belgium, Italy, Austria, Finland) out of 22 Member States participating in the survey. One of the main reasons that has been quoted as hindering the implementation of remote signature/seal is that key standards have not yet been published .

2.2.2 Non-regulated (nationally defined) trust services

According to the survey, 28% of the respondents, representing 9 Member States, point out that there are specific types of trust services made available at Member State level, which have not been defined in the eIDAS Regulation (58% of respondents declare that that do not know such services, while the remaining 14% declare that they are not aware of the existence of such services). Such trust services offered in a Member State, are regulated by a Member State and they only have recognition within such Member State but can still act as an obstacle to the uptake of the eIDAS Trust Services.

The respondents provided further clarifications by giving examples of services at national level which are not part of the eIDAS Trust Services:

 “Electronic signature confirmed by “Trusted Profile” (Poland)  “Electronic archiving and digitisation” (Belgium)  “Information/documents long term preservation, LEXNET Platform for exchanging information between the Judicial Bodies and a wide range of legal operators” (Spain)

The survey shows that there are national trust services in some EU MS. Some of them are broadly used at MS level, without however, having any cross border recognition as it is possible to do for trust services under the eIDAS Regulation.

Conclusion 3: Typical Trust Services, related to the issuance of certificates, have deep penetration in the market, while the newly-introduced services by eIDAS, as well as remote qualified trust services for the generation of QESign/QESeal are still not widespread.

2.2.3 Future Directions of Trust Services Provision

The survey seeks to explore future plans of (Q)TSP concerning the provision of Trust Services in the market. Particularly, it addresses a) future plans for the qualified trust services in relation to the non-qualified ones, and b) future plans for the newly introduced trust services in relation to services offered already.

From Figure 6 it is apparent that there is a relative high provision of qualified certificates for electronic signatures (20%) and electronic timestamps (16%). The future plans of (Q)TSP concerning the provision of qualified trust services appear to be of high rate for all qualified Trust Services. Of particular interest are future plans for qualified website authentication certificates (66%), qualified electronic seal (66%), qualified validation service (68%) and qualified electronic registered delivery (52%). Moreover, it is worth noting that qualified electronic registered delivery services and qualified preservation service are not within the scope of direct plans for 45% and 48% of (Q)TSP respectively.

Concerning non-qualified trust services, the current uptake as well as plans of TSP are given in Figure 7. It is apparent that there is high level of penetration for typical services being electronic signatures (45%) and electronic time stamps (32%).

Comparing the two diagrams, it is obvious there is a higher trend (grey part of the chart) towards the provision of qualified trust services in comparison to the non-qualified ones. For example, comparing the provision plans for qualified electronic signature towards non-qualified one, the percentages are 69% towards 39%.

PLANS FOR QTS PROVISION PLANS FOR NON-QUALIFIED TS PROVISION 2.2.4 Website Authentication Certificates

Certificates for website authentication, broadly referred to as SSL/TLS certificates, play a critical role in the security of online transactions and have long been used in website authentication and network traffic encryption services. The number of SSL/TLS certificates has grown sharply in the last few years driven by business needs rather than any regulatory framework, and the market has evolved to be highly concentrated around a small number of players, mostly from outside Europe.

Based on these features, qualified certificates for website authentication (QWAC) present a particular case among the newly introduced trust services in the eIDAS Regulation, since they will need to enter in an already mature, global and unregulated market. To be successfully introduced it will be necessary to stimulate demand for QWACs by properly communicating to consumers their benefits, while at the same time supporting providers to ensure sufficient supply .

The successful introduction of QWACs needs clear communication of the benefits the hold for stakeholders. According to the survey the majority of relying parties (80%) understand the differences between QWAC and SSL certificates, but the respondents to the survey cannot be classified as “common users”.

Concerning the implementation of QWAC by the QTSPs, 7% of the respondents have already such a service, 27% have not implemented it yet, and 66% have plans to run such a service in the future (see Figure 8). It is really worth noticing the trend towards the uptake of the QWACS .

Q UA L I F I E D W E B S I T E A U T H E N T I C AT I O N U P TA K E

The market impact of introducing QWACs should also be seen through the prism of different sectors of the economy. The biggest potential for utilising QWAC can be seen in Banking services (37%), HealthCare (33%) and e-Government services (31%).

Q WA C I N D I F F E R E N T S E C T O R S 2.3 Key factors and barriers influencing development of the Trust Service market

Respondents provided mixed responses concerning the key factors that will influence further development of the trust services market. The most important factors included “Evolution of Business Models” (20%), “Maturity of e-Government Services” (19%), “Change in mind-set” (19%) and “Public-Private Partnership” (11%). All the above seem to suggest that the main concerns revolve around the market’s ability to adapt to customer needs and its ability to build suitable business models including partnerships between public and private entities.

Most respondents believe that the evolution of business models and change in mind-set, as well as the maturity of the e-government services influence the development of the Trust Service market. Standardisation is considered to be an important factor (13%), while a so called “soft law” approach (for example, guidelines delivered by EU Bodies such as ENISA) is perceived as a less significant factor in an effort to influence the market (Figure 10).

The importance of the legal framework at the national level in the process of development of the eIDAS market is clearly stated. For instance, in one of the respondent’s countries it is permitted to submit a letter to Courts of Justice in electronic form signed with a qualified signature, but there is no formal method to deliver it. There are also examples in which local governments create obstacles against the eIDAS uptake – for instance by declaring some e-government systems as “closed” to avoid coming under the eIDAS framework requirements.

Other reported factors that are likely to influence the development of the Trust Service market include:  “Ease of use, mobility and user experience”  “Accessibility of free/open source libraries and open specifications”  “Use of new technologies like block-chain, video identification, biometrics”  “More detailed definition of closed-system exception defined in the eIDAS regulation”  “Familiarity with and knowledge of the legal and liability aspects, in particular in cross-border use case scenarios”  “Uptake (of the Trust Services) by the private sector”

K E Y FA C T O R S F O R T R U S T S E R V I C E S U P TA K E

Additional analysis of responses shows how respondents from different Member States see further development of trust services. It is worth noting that for Estonia further standardisation is a key factor, while respondents from Italy regard more highly the maturity of e-Government services. In most Member States, evolution of business models has a major impact on the Trust Services market. In each Member State, different aspects play a key role – for example Germany and Estonia deem further standardisation of trust services as the most important factor. The survey shows that trust service markets across the EU vary in maturity and in terms of challenges they face.

Conclusion 5: The evolution of business models and change in the mind-set will have the biggest influence in the development of the trust service market.

What are the key factors that will influence further development of trust services on your market?

The main barrier for further development of trust services market according to the survey concerns limitations in understanding of Trust Services (28%). This results in low demand that has been accounted to 13% of all responses. These factors seem to have a big impact on further development, while they constitute a common problem in all innovative markets and appear whenever new technologies, products or services are introduced. They represent a concern towards new and unknown situations- especially where new services are not clear and cannot be easily explained. This is also backed up by the fact that 16% of the respondents identify users’ familiarity as a barrier.

Around 9% of the responses point to “Other” barriers for the further development of the eIDAS market. The most common one is that “improper” government activities create barriers or distortions in the Trust Service market. Examples include for instance the “lack or low quality of public services”, the “lack of innovation in the public administration” and/or the “use of proprietary or unsecured legacy systems and applications”, as well as unfair competition from public institutions that create ad hoc monopolies of stateowned companies (for instance national postal services) in the Trust Service market. Other commonly mentioned factors are the lack of the secondary legislation for the eIDAS Regulation and the lack of a clear road map for the development of eIDAS and trust services, which keeps on replicating harmonization gaps. Moreover, some Member States also indicate that governments are not supportive of the development of the eIDAS market. Others points are:

 “Reluctance of private sector to implement into services”  “Lack of adoption by key service providers e.g. banks”  “No formal e-delivery standard”  “Lack of blockchain usage vision”

 “Impact of "old" state owned companies and de-facto monopolies (e.g. postal service), lack of innovation and openness in the public administration”  “Lack of awareness of the risks from not being able to prove compliance with industry and regulations”  “Additional expenses for end-users”  “Poor involvement of the national government in developing eServices”  “Lack of centralisation of TSL from each MS”

M A I N B A R R I E R S F O R T H E F U R T H E R D E V E L O P M E N T O F T S

Conclusion 5: Lack of understanding, awareness and low demand are regarded as the main barriers for the development of the Trust Service market.

2.4 SB and CAB Experience 2.4.1 Regulatory and standardisation gaps

As presented in section 2.3, one of the main barriers for the further development of Trust Services market is gaps in standardisation. Concerning Supervisory Bodies and Conformity Assessment bodies, they respectively 80% and 86% confirmed that gaps in standardisation is one of the barriers for the further development of the trust services. It is worth noticing that the role of standards is to support the eIDAS

regulation in Europe and the needs of the international community to provide trust and confidence in electronic transactions.

The open question related to this issue, concerning to specify further standardisation or regulatory gaps during auditing the QTSP, brought deeper insight into this aspect from the CAB and SB perspective. Basically, overall 82% of the respondents from this group confirm such an issue and clearly pointed out that standards and specifications are still missing at the regulatory level.

H AV E YO U N O T I C E D R E G U L ATO R Y O R S TA N D A R D I Z AT I O N G A P S D U R I N G A U D I T I N G ?

 CABs Approach CABs point out the lack of standards for eIDAS services as well as their different understanding on standards. More specifically, they mention standards missing in the areas of qualified electronic delivery, qualified validation, qualified preservation, and alternative identification methods (e.g. through video means). The legal uncertainty concerning eIDAS-compliant cryptographic algorithms has also been mentioned.

 SBs Approach At the same time, respondents representing Supervisory Bodies (SBs) complain about the lack of standardization for the Conformity Assessment process. They strongly express the view that the differences in CAB accreditation schemes in the Member States and the absence of a standardised Conformity Assessment Report constitute a challenge. For instance, audit reports from one Member State contain around 100 pages, while from another the number of pages can reach up to 500. This means CABs have different interpretations of the actual scope of audits and/or the content of the audit report. As a result, this situation may lead to a non-harmonised Trust Service market and questions regarding “quality” of Trust Services in the European Union may raise. Therefore, in the opinion of the respondents from SBs, it is imperative to draw definitions for:  Accreditation procedure for the Conformity Assessment Bodies  Auditing rules and scope (“what to audit against”) taking into account: eIDAS provisions, implementing acts, standards and specifications  Conformity Assessment Report Content  Implementing acts and clear definitions of trust services, i.e. ERDS, preservation and validation

 Technical standards describing the certification scheme of the different trust services

2.4.2 Problems encountered during an eIDAS audit

The survey has indicated that 70% of CAB and SB have encountered problems while performing eIDAS audits to QTSP. It is worth mentioning that the time that the survey was carried out, it was the period st before the deadline of 1 July when certification-service-providers issuing qualified certificates under the Directive 1999/93/EC had to submit a conformity assessment report to the SB. This means that many audits were still ongoing and that SBs had been adapting to the audit process.

The most commonly quoted auditing problems to both CABs and SBs were related to different interpretations of eIDAS requirements and/or definitions of trust services in the Member States and the lack of harmonization by implementation. Furthermore, the problem of linking ETSI EN 319 xxx standard series to eIDAS Regulation clauses and the number of reports to provide, meaning both EN 319 and eIDAS report, was raised.

D O YO U E N C O U N T E R P R O B L E M S W H E N P E R F O R M I N G A N E I D A S A U D I T ?

 SB Approach A number of respondents indicate that TSP are quite supportive and no problems were encountered when performing audits. However, SBs raise the need to have the full version of the Conformity Assessment Report, whereby all detected vulnerabilities be analysed, along with audit findings to be presented in a meeting between the CAB, the QTSP and the SB.

SBs mainly report the problem of TSP preparation for the audits, and specifically: problems in having access to systems, lack of supporting documents/ policies / procedures related to audits, divergence in interpretations of the Regulation related to remote signing services and video identification.

Moreover, difficulties in getting insights in case of the activities of a TSP are spread out among many subcontractors. SB also mention that the requirements in the eIDAS Regulation are quite general so that it is possible to interpret them differently, which triggers differences in opinion among CAB, SB and TSP.  CAB Approach The respondents originating from CABs point out the limited audit support documents and the differences in interpretation of eIDAS requirements by the stakeholders (CAB, TSP and SB), particularly by SB. Besides the standardisation issue (as described in 2.4.1), they express the opinion that many of their problems are

laid down at supervision level, being the result of insufficient preparation of the SB, lack of experience and expertise of SB personnel and lack or delay in publishing national documents supporting the auditing process. Moreover, the limited experience of the NAB and the absence of national experts/auditors have been raised. The management of non-conformities identified during the audit relates to the absence of shared / common rules concerning the management of non-conformities after the audits as well as the requirements that should apply to the conformity of non-qualified TSP. It was also mentioned that in general audits on qualified certificate issuance, did not raise any issues, since QTSP are well prepared thanks to their experience with proving conformance with the requirements of Directive 1999/93/EC. However, some TSPs present an insufficient level of preparation for the eIDAS audits, but this is not the general case. Other ancillary issues include assessing video identification methods (article 24.1(d)) and the lack of regulation on eIDAS-compliant cryptographic algorithms as mentioned above. Moreover, SB and CAB, based on their auditing experience, commented also on the difficulty level of auditing the trust services. The results show that Electronic Registered Delivery and Remote Electronic Signatures/Seal are the most challenging Trust Services to audit, pointed out respectively by 24% and 23% of the respondents.

Conclusion 6: A guidance on conformity assessment report content, audit process and post-audit activities is needed to assure the same “quality” implementation level of Trust services and avoid interpretations among the involved stakeholders (SB, CAB and TSP).

W H I C H T R U S T S E R V I C E I S T H E M O S T D I F F I C U LT T O A U D I T ? 2.5 Business models for Trust Services and involvement of public administration

A broad understanding of the whole Trust Service market can indicate three general business models: Centralised (closed – leading role of the public sector), Federal (open – leading role of the commercial sector) and Mixed (both public and commercial sector) (Figure 16). According to the respondents (in this case TSP, CAB and SB) the leading model for trust services provision in their countries is the mixed one, where both public and commercial organisations provide services on the market. This answer is given by 69% of the responses, representing 17 countries. A purely centralised or federal model is present in very few countries.

Among respondents who have indicated the “Mixed” model, most of them agree that this is the right choice, as it ensures higher adoption and brings an opportunity to maximise the strongest qualities of both parties: public entities can build a big customer base, while private entities can be more innovative and provide services that the public sector wouldn’t be interested in.

Arguments for shifting towards a “Federal” model is that it would be more dynamic, innovative and competitive (respondents point out the issue with free provision of public Trust Services). Moreover, it is supported that this model is optimal as it is open, innovative and provides the best services for end-users. However, 4 out of 9 respondents believe that their market should move towards a mixed model which can guarantee a stronger market providing more possibilities, can be more flexible and can provide the best services in both commercial and public sectors.

The respondents from countries with a “Centralised” Trust Service model are in the minority, accounting for only 13% of the respondents. The main arguments for keeping such a model are that the public sector can guarantee strong control over security and that in small countries such a model is more cost-effective.

W H AT I S T H E B U S I N E S S M O D E L U S E D F O R T R U S T S E R V I C E S I N YO U R C O U N T R Y ?

One third of the respondents (38%) originating from 12 out of 22 countries, confirm that in their countries there is a partnership between private and public sectors regarding Trust Services. Although Trust Services may appear to have a direct effect only on the public sector, there is a real business potential in the private sector too. Incorporation of Private-Public Partnership would benefit both the business and customers. Such partnership would result in better efficiency and cost optimisation and can lead to innovation growth. The customers would benefit from better and broader access to services, provided by both public and private sectors, better user experience and perhaps even more flexible pricing schemes.

I S T H E R E A P P P I N YO U R C O U N T R Y ? 2.5.1 Involvement of public administration

In the opinion of more than half of the respondents (55%), public administration should pursue a mixed approach of building own solutions and implementing commercial solutions. Purchase of 3rd party solutions only comes as the second most popular response to the question constituting 34% of the responses.

 Build own solution Only 11% of respondents point out that public administration should build its own solutions which results from the need for independence from any third-parties and from avoiding vendor locking, in particular if this kind of services is perceived as a "critical infrastructure". Deeper analysis of the answers shows that most of the respondents (67%) who recommend that public administration should build its own Trust Services are from the private sector. Even more interesting is the fact that most of the respondents from the public administration sector recommend a combination of solutions (59%) or buying 3rd party ones (36%).

However, it is highlighted that the public administration shall be fully responsible for the operation of its publicly available services. In case of immaturity of the TS market and lack of commercial solutions, public administration can build its own solutions to boost adoption of eIDAS Trust Services. This is in principle in line with the conclusion drawn in chapter 2.3 that the involvement of public administration is needed.

 Buying third party solutions The rationale in favour of buying third party solutions is mainly related to the cost-effectiveness issue. Commercial, of-the-shelf solutions, are considered as being more cost-effective than custom ones developed by public administration. Moreover, considering the size of public administration in the proportion to the cost and complexity of creating a whole new mechanism it does not seem to be applicable.

 Combine the above solutions In reference to the mixed approach, the justification is that the existing commercial solutions shall be used whenever possible in case of "standard use” whereas for some specific needs (e.g. due to national security related aspects) administration may build its own solutions. In a long term the option “Build own solution” may result in legacy solutions and lack of improvements, while combination of the solutions will help towards interoperability of public and private services, depending though on each country status (e.g. existing infrastructure, staff).

P U B L I C A D M I N I S T R AT I O N R O L E

Concluding, the decision concerning the “best approach” to take should be based on the analysis of cost, timing, nature of the needed service and the user's perspective, defining "what would be the best way to serve citizens". A mixed approach is considered by many respondents as the only one offering "the best possible price and performance ratio", as it enables the use of the "most effective and economic solutions". Conclusion 7: A combination of public and private solutions is considered as the best way to implement trust services and therefore there should be always space for synergy between the two sectors. The respondents were also asked about the potential of building a central Trust Services gateway (in accordance with the idea described in recital 7 of the eIDAS Regulation) providing a single user interface to different Trust Services, especially for electronic signatures. 43% of the respondents identified that there is a market need for such an idea. Almost 32% of all respondents said they did not know if there was such demand on the market, which points out the uncertainty of an under development market (Figure 19).

I S T H E R E A M A R K E T D E M A N D F O R B U I L D I N G A C E N T R A L T R U S T S E R V I C E S G AT E WAY ?

3. TSP market dynamics analysis

In addition to the survey, information about the eIDAS implementation is gained by analysing the TSL list changes over time . There have been many changes to TSL since the switch over to the eIDAS Regulation (01.06.2016). More than half (54%) are stable services, which have not been changed, 19% are new services and 27% are services stopped after eIDAS roll-out. These results were inferred in July 2017 and do st not include changes before July 1 2016.

T R U S T S E R V I C E S A F T E R T H E S W I T C H O V E R T O E I D A S

Service continuation

New services

Service stopped after 19% eIDAS

Figure 21 shows the change over time of the total active qualified trust services offered, as well as the monthly number of granted and withdrawn qualified trust services for one year after the switch over to eIDAS. Significant growth in the number of qualified trust services added can be highlighted in June 2017. This is due to the transitional measure laid down in Art.51.3 and Art.51.4 of the eIDAS Regulation, which provided to CSP issuing qualified certificates under the Directive 1999/93/EC an extended period to submit st a conformity assessment report up to 1 July 2017.

The majority of Trust Services is related to the “typical CA services”, meaning the issuance of (Qualified) Electronic Certificates. Services supporting electronic Time Stamp are widely provided. New services defined in Article 3 of eIDAS Regulation (Preservation, Registered Delivery, Validation) are lagging significantly (Figure 22).

Conclusion 9: The number of Qualified Trust Services has grown after the switch over to eIDAS regulation. However, introduction of services newly introduced by the eIDAS Regulation (QWAC, QeSeal, Preservation, QERD, QVal) is significantly lagging.

Q UA L I F I E D T R U S T S E R V I C E S S I N C E E I D A S A P P L I C AT I O N T R U S T S E R V I C E S S TAT U S

Most qualified trust services issuing Qualified Certificates issue them for Electronic Signature (78%). In July 2017, there were 150 CAs issuing qualified certificates for electronic signatures, 21 issuing qualified certificates for electronic seals and 6 issuing qualified certificates for website authentication. The growth of electronic seals and website authentication services is not considered very high and most of the new granted services received their status in June and July 2017.

The current state of Qualified Trust Services issuing qualified certificates shows that 78% of the market share is qualified certificates for electronic signatures, and only 11% is for electronic seals, and 3% for website authentication.

150 150

148 148

144 146 146 143

20 21

13 14

8 8 9 10

4 4 6 6

2 2 2 2

Q UA L I F I E D C A S E R V I C E S BY T Y P E O F C E R T I F I C AT E

8%

For eSignatures

11%

For WebSiteAuthentication

3%

For eSeals Other

78%

4. Key Points and Conclusions

One year after the eIDAS Regulation entered into effect, the number of the available Trust Services has increased considerably and a significant trend of Trust Service Providers (TSPs) (64%) towards acquiring the qualified status is noted. This increase, confirms the wide recognition and the added value of the qualified status in the Trust Services market.

Considering the eIDAS Regulation as a framework, there is a lot of space left for individual interpretation but also for development at the level of Member States and even organisations. The survey results indicate, that for more than 90% of the respondents eIDAS is an opportunity to grow their business. At the same time, the way of provisioning Trust Services needs to be changed and it needs an innovative approach going forward.

It is well known that for TSPs the eIDAS implementation requires an additional cost for undergoing an audit but after that the potential of using cross border services is likely to increase. The most important and difficult challenge is to find out how to implement such services into existing processes to optimize costs while pursuing new business opportunities. The eIDAS Regulation can be used as a foundation for digital transformation of organisations. It can provide new eServices allowing for the creation of new business models, products and services whilst also driving operating costs lower.

Concerning the penetration level of (Qualified)Trust Services in the market, typical Trust Services, related to the issuance of certificates receive a high recognition rate in the market, while the newly introduced services by eIDAS, as well as remote qualified trust services for the generation of QESign/QESeal are still not widespread. However, the future plans of (Q)TSP reveal the higher trend towards the provision of qualified trust services in comparison to the non-qualified ones.

It can also be concluded from the survey results that appropriate understanding, involvement and active participation of the national administration and organizations in the creation of the eIDAS ecosystem in each MS is extremely important. Governments can play a leading role in the dissemination of eIDAS and create a “starting point” for further adoption and mass use of Trust Services developing new e- Government services. There is huge potential to increase customer usage of trust services by projecting user-friendly applications that support Trust Services.

Moreover, the market recognizes that it is still trying to fully understand the consequences of this regulation. Currently, technical standards (i.e. signature in the cloud) are still under development and for certain services there are few providers in specific Member States. In addition, respondents pointed out gaps in the legislation and standardisation, in regard to the electronic delivery, electronic validation, preservation and conformity assessment, as well as the CABs accreditation process. This may lead to a non-harmonised Trust Service market in the European Union and may place in question the “quality level” of Trust Services.

The following conclusions provide further insight concerning the barriers, weaknesses, strengths and drivers for the uptake of (qualified) trust services and derive from the survey as well as the in-depth open questions with selected stakeholders.

A) Barriers and Weaknesses

 Low level of knowledge of what is trust and its importance among the potential users (citizens, enterprises) and lack of understanding of Trust Services.  Current market distortions such as seeming oligopolies in certain market sectors (i.e. browsers market)  Immaturity of the trust services market, not much knowledge about concrete implementation models and integration with current business processes.  Gaps in Standardization, limitations posed by soft law approaches and technical specifications mainly in regard to new defined services (electronic delivery, electronic validation, preservation), the conformity assessment process and the accreditation of CAB.  National level trust services non-conformant with eIDAS regulation create uncertainty and confusion, hindering the uptake of the Trust Services Market.  Limited number of Applications to support trust services and closed market of web browsers.  Very few providers to offer qualified trust services and high reluctance towards developing new solutions.

B) Strengths of the Trust Services market

 eIDAS brings legal certainty which is a key enabler, since organisations are facilitated to organize and deliver their digital strategies with confidence.  eIDAS is a key to ease the application of sectoral regulations (e.g. PSD2, MIFID2) and to guide towards the compliance with the new GDPR.  It provides a powerful and solid base in developing new solutions and services, being recognised across Europe.  Business requirements of industries with big digital transformation processes, like finance and healthcare, can create market opportunities. A need for certainty, integrity and speed in industries processes can be the driving force for the growth and uptake of Trust Service market.

C) Key Drivers for Trust Services Uptake

 Usability and integration with business services o Promote the benefits and added value the Trust Services can bring in the daily life of the people and provide stronger integration of trust services into business processes. o Integration of qualified certificates for website authentication with browser distributions o Involve all related parties, not only legislators, but also third parties like browsers and developers. o Stronger integration of electronic signatures, seals and timestamps with standard software. o Increase the level of the interconnection between countries and the use of Trust Services by developing new, easy to use e-Government services.  Enhance user experience and user-friendly approach o Deployment of trust services needs to become more streamlined. Interoperability, security and usability are probably the most important elements that will inspire confidence for stakeholders. o Training and awareness about the capability of Trusted Services at every level of the market, including decision makers in business and governments, SMEs and mass market. o Reach all the target customers by making user-friendly applications based on Trust Services market. o Remote identification for certificate issuance is a challenge that should have similar approaches in all countries.

 Development of applications, standards to support “new” trust services o Growth of the number of e-services available both in the commercial and public sectors that integrate Trusted Services in order to impulse for the development of low-digitalised areas of economy and administration. o Implement and “test in practice” new tools based on eIDAS trust services like eSeals. o Development of new standards for Internet browsers and electronic signature “in the cloud”. o The topics of collateral technologies such as biometric advanced electronic signatures, identity of objects for IoT solutions and block-chain-based self-sovereign eID systems can have a great impact on the growth of the Trust Services market. o The growing market of e-invoicing and the implementation of PSD2 could leverage the e-Seals market. o A strong need for the preservation of electronic documents in long-term and digital preservation systems compliant with the OAIS framework.

5. References and bibliography

5.1 References 5.2 Relevant implementing acts

ENISA

European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

Athens Office

1 Vasilisshs Sofias Marousi 151 24, Athens, Greece

TP-07-17-169-EN-N

PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-247-9 DOI: 10.2824/611041 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu