Report

Teaser, summary, work performed and final results

Periodic Reporting for period 1 - FutureTrust (Future Trust Services for Trustworthy Global Transactions)

Teaser

\"What is the problem/issue being addressed?The FutureTrust project aims at providing reliable and secure implementations of software components that are essential to the success of the “Regulation (EU) No. 910/2014”, which is commonly known as the “eIDAS-Regulation”...

Summary

\"What is the problem/issue being addressed?

The FutureTrust project aims at providing reliable and secure implementations of software components that are essential to the success of the “Regulation (EU) No. 910/2014”, which is commonly known as the “eIDAS-Regulation” (https://eid.as/) in the public sector as well as in private organizations across Europe and beyond:

• Global Trust Service Status List (gTSL). The trust anchor for eIDAS-based trust services is an electronically signed XML document containing the trusted certificates used by the eIDAS services. The gTSL service will provide support for the automatic and accountable updates of this list, and for the inclusion of trust anchors from organizations outside the EU which aim to comply with eIDAS.
• Comprehensive Validation Service (ValS). Due to the large variety of electronic signature formats and security token standards, the secure validation of a large number of these formats/standards is a non-trivial task. The ValS will implement validation routines for advanced electronic signature standards like XAdES, CAdES, PAdES and ASiC, plus a selection of well supported industry standard tokens (e.g., SAML, OpenID Connect). ValS is implemented as a RESTful web application, and returns an XML-based validation report according to the OASIS Digital Signature Verification report standard.
• Scalable Preservation Service (PresS). Due to the constant progress in cryptanalysis, electronic signatures issued today may become invalid in the near future. To avoid a situation where the legal status of a document or signature may become unclear, the eIDAS-Regulation requires to implement appropriate preservation measures, as outlined in ETSI SR 019 510. The FutureTrust project maintains a close relationship with the corresponding preservation-specific working group within ETSI ESI such that the PresS is aligned as closely as possible with the forthcoming preservation-related standards and may possibly serve as Open Source reference implementation of the forthcoming European Norm.
• Remote Signing and Sealing Service (SigS). Due to technical challenges related to the user-friendly integration of smart card-based signature creation devices on a variety of different devices (e.g., PC, Laptop, Smartphone, Smart Watch) with different operating system (e.g., MAC OS, Android, Linux, Windows 8 and 10, iOS, …), there has been a trend towards remote signing systems, where the private signature key is hosted in a central server and only activated on behalf of the user. This trend has been acknowledged by the eIDAS-Regulation in recital (51) and Annex II Nr. 3 (https://www.eid.as/home/#annex2 ) for example and hence, eIDAS provides the opportunity to delegate the signing process to a secure server implementation. The SigS developed in FutureTrust will be an instantiation of such a server implementation, which aims at supporting a large variety of different signature formats (XAdES, CAdES, PAdES and ASiC). After successful authentication of a client device, SigS will generate a signature on the provided document using the private key associated with the client, and the requested signature algorithm.
• Identity Management Services (IdMS). Since secure authentication is a major issue for the SigS and other business processes, the FutureTrust IdMS will offer the possibility for clients to authenticate against the IdMS using a variety of different means, and will issue an identity token out of a small list of interoperable standards.

The validity and usefulness of these services will be verified in a series of demonstrators in the public sector both in European (Portugal, Austria, Germany, Serbia) and non-European (Georgia) countries.

Why is it important for society?

Digital services are becoming more and more important in the everyday life of European and non-European citizens. Big Internet companies like Amazon, Google, Facebook and Twitter already dominate private use cases\"

Work performed

WP1 Administration
All administrative tasks have been completed on time.

WP2 Foundations
Deliverable D2.1 gives an overview of standards relevant to FutureTrust and analyzes standardization gaps. D2.2 provides an overview of the three most important delegated authentication standards: SAML, OpenID, and OpenID Connect. D2.7 derives a list of trustworthiness requirements based on the current state of the art in relation to EU privacy and data protection law and eIDAS.

WP3 Design
The basis for a successful implementation of software is a detailed specification of its functionalities. This task has been completed in time, with deliverables D3.1 to D3.6 detailing the requirements of the different services (gTSL, ValS, PresS, SigS, IdMS), and the requirements for the demonstrators in D3.7.

WP4 Implementation
The methodology to implement the services and the demonstrators has been described in D4.1, using state-of-the art software development techniques.

WP5 Pilot
This work package will become active once the software implementations are available. All partners from this WP contributed to WP3.

WP6 Dissemination, Exploitation, Technology Transfer
We presented FutureTrust at scientific conferences and workshops, invited associate members, and established an external advisory board.

Final results

Progress beyond the state-of-the-art is achieved by providing specifications and implementations for services which do not exist up to now.

The project achieved more than claimed in the Grant Agreement by including SAML and OpenID Connect in D3.3, and by publishing novel research results for example. Another point, where FutureTrust already went beyond the results promised in the Grant Agreement is the recently provided “eIDAS-Map” (https://www.eid.as/tsp-map), which playfully allows to explore the emerging “eIDAS-Ecosystem” (https://blog.skidentity.de/en/eidas-ecosystem/).

The socio-economic impact and the wider societal implications of the project so far are limited due to the lack of demonstrators. This will increase significantly in year 3, and after the finalization of the project. It is expected that FutureTrust will help to significantly speed up the digitalization of the European society.

Website & more info

More info: http://www.futuretrust.eu.