QSCD (Qualified Signature Creation Device)
Definition
Frequently asked questions
What is the purpose of a qualified signature creation device?
To protect the signatory''s private key, which is the most sensitive element of a signature. The device ensures that this key cannot be copied or deduced, that it remains under the exclusive control of its holder, and that the signature produced is protected against forgery. These requirements are set out in Annex II of the eIDAS regulation.
In what forms does a QSCD exist?
Historically, it was a smart card or cryptographic USB key handed to the signer. Today, the most common form is the remote device: the key is kept in a hardware security module operated by a qualified provider, and the signer activates it remotely after authenticating themselves.
How does a device obtain this status?
It must be evaluated by a body designated by a Member State, according to recognized security standards, generally Common Criteria. Once certified, it is notified to the European Commission, which publishes the list of recognized devices. Hardware or software that does not appear on it cannot be used to create a qualified signature.
Is remote signature as safe as a smart card?
The eIDAS regulation expressly permits it, provided that the qualified provider managing the device applies procedures ensuring that the signer retains exclusive control of their key. In practice, each signature requires strong authentication. The signer no longer has hardware to keep or renew, which eliminates the risk of loss.
Associated guides
Related terms
Ready to put these concepts into practice?
Certyneo allows you to create eIDAS-compliant signature envelopes in a few clicks, without installation.