3 ms·

This may be german law specific, the overarching EU Legislation can be found by googlign "qualified electronic signature". In general they require complete, ve

by dtx1 3y ago

This may be german law specific, the overarching EU Legislation can be found by googlign "qualified electronic signature". In general they require complete, verified cryptographic signatures via smartcards or similar but because no one uses it, videoident has become the defacto alternative in germany

V__ 3y ago
That's a misconception. Most contracts or form-free and can be made by handshake if one wants to. There are however some exceptions, which require either physical signatures or the qualified signatures as declared by eIDAS. Those exceptions are some employment contract and most things related to banking. The need for identification over video, etc., has more to do with the know-your-customer laws.
bestham 3y ago
Most physical bearers (smart card or similar) of a Qualified Certificate are issued in person or based on a known identity. Here there is no need for remote identification before the issuance of the certificate. What you are talking about is a “remote signature service”. Such a service will often onboard a user remotely using a physical ID, video and liveliness checks and give them the credentials to produce advanced or qualified electronic signatures with the service in question. These credentials have to meet LoA Substantial or High for a QTSP to be able to issue a QC to a user. Most remote signature services use very short lived certificates (10-15 minutes) that are created for every signature the user produces. (As opposed to the long lived certificates of several years for a physical card). Germany have to follow the eIDAS-regulation as a member state of the EU/EAA. But what level of signature is needed for what transactions is not regulated in the eIDAS.
- dtx1 3y ago
  > But what level of signature is needed for what transactions is not regulated in the eIDAS. Yeah, its the issue that germany decided that only the QES is as legally binding as a physical signature and then they made a whole bunch of contracts, especially work related stuff require physical signatures

by dtx1 3y ago

V__ 3y ago

That's a misconception. Most contracts or form-free and can be made by handshake if one wants to. There are however some exceptions, which require either physical signatures or the qualified signatures as declared by eIDAS. Those exceptions are some employment contract and most things related to banking. The need for identification over video, etc., has more to do with the know-your-customer laws.

bestham 3y ago

Most physical bearers (smart card or similar) of a Qualified Certificate are issued in person or based on a known identity. Here there is no need for remote identification before the issuance of the certificate. What you are talking about is a “remote signature service”. Such a service will often onboard a user remotely using a physical ID, video and liveliness checks and give them the credentials to produce advanced or qualified electronic signatures with the service in question. These credentials have to meet LoA Substantial or High for a QTSP to be able to issue a QC to a user. Most remote signature services use very short lived certificates (10-15 minutes) that are created for every signature the user produces. (As opposed to the long lived certificates of several years for a physical card). Germany have to follow the eIDAS-regulation as a member state of the EU/EAA. But what level of signature is needed for what transactions is not regulated in the eIDAS.

dtx1 3y ago
> But what level of signature is needed for what transactions is not regulated in the eIDAS. Yeah, its the issue that germany decided that only the QES is as legally binding as a physical signature and then they made a whole bunch of contracts, especially work related stuff require physical signatures