QSCD (Qualified Signature Creation Device)
Definition
A hardware or remote HSM-based device that stores the signer's private key such that it cannot be extracted, ensuring sole control under eIDAS Article 26(c). USB hardware tokens and remote HSMs operated by Trust Service Providers are common implementations.
- Governing framework
- eIDAS Regulation, Article 29 and Annex II
- Function
- Stores signer's private key, non-extractable
- Common implementations
- USB hardware tokens, remote HSMs
- Legal role
- Prerequisite for a Qualified Electronic Signature
Common questions
Why does a QSCD's non-extractability requirement matter for evidentiary weight?+
Since the private key can never leave the device, a signature produced by it provides strong assurance that only the legitimate signer could have created it, which is what allows a Qualified Electronic Signature built on a QSCD to carry legal equivalence to a handwritten signature.
Does a remote HSM-based QSCD provide the same assurance as a physical USB token?+
Yes, provided the Trust Service Provider operating the remote HSM meets the sole-control requirements under eIDAS, typically through strong signer authentication before each signing operation, even though the private key resides in a cloud-hosted rather than locally-held device.
Related terms
- Aadhaar E-Sign
- India's authentication-linked electronic signature service in which the user's Aadhaar biometric or OTP authentication triggers the generation of a short-validity signing certificate...
- ESIGN Act (Electronic Signatures in Global and National Commerce Act)
- US federal legislation (2000) providing that no electronic signature may be denied legal effect solely because it is in electronic form. Technology-neutral:...
- EU Trusted List (EUTL)
- The authoritative list maintained by the European Commission listing all Trust Service Providers per EU member state that are supervised to issue...
- Long-Term Validation (LTV)
- A PDF signature profile (PAdES-LTV, ETSI EN 319 102-1) in which the OCSP responses, CRL data, and TSA certificate chain information are...
- OCSP (Online Certificate Status Protocol)
- A real-time certificate revocation protocol in which the verifier queries the CA's OCSP responder with the certificate's serial number and receives a...
- Public Key Infrastructure (PKI)
- The system of hardware, software, policies, and standards that manage digital certificates and public-key encryption. Provides the trust architecture underpinning all cryptographic...
- Qualified Electronic Signature (QES)
- The highest tier of electronic signature under EU eIDAS Regulation 910/2014. Created by a Qualified Signature Creation Device (QSCD), backed by a...
- TSA Timestamp (Timestamp Authority)
- A cryptographically protected record of the time at which a signature was created, issued by a Timestamp Authority (TSA) whose own certificate...
- X.509 Certificate
- A digitally signed data structure that binds a public key to a named identity (subject) and is issued by a Certificate Authority....