Utilizing Qualified Electronic Signatures

DIW Gateway supports document signing using a Qualified Electronic Signature (QES) through an EUDI Wallet and a Qualified Trust Service Provider (QTSP).

The QES integration uses a Relying Party-centric communication model, in which the signing process is integrated with the business process of the Relying Party.

RP-Centric Communication

In the Relying Party-centric model, the document to be signed originates from the Relying Party’s business process and is provided to DIW Gateway.

The user is authenticated towards the QTSP using their EUDI Wallet. The Wallet Unit presents the required PID using OpenID4VP as part of the QTSP authorization process.

The DIW Gateway communicates with the QTSP using the Cloud Signature Consortium API (CSC API) for the signing operation. After successful authentication and authorization, the DIW Gateway obtains the signing certificates, uploads the calculated document hash, and receives the signature from the QTSP in order to finalize the signed document.

The resulting document is then returned to the integrating system.

Core Scenario Steps

1. The document is presented to the user within the bank’s system.
2. The document is provided to the DIW Gateway via the integration system.
3. The DIW Gateway provides the bank with the data required to start the authentication and authorization process.
4. The user is redirected from the bank to the QTSP.
5. The QTSP initiates an EUDI Wallet interaction to request the necessary PID.
6. The user consents to presenting the PID from the wallet unit.
7. The PID is presented to the QTSP via OpenID4VP.
8. The user is redirected to the DIW Gateway, which will complete the authentication and authorization process.
9. The DIW Gateway obtains the signing certificate, uploads the calculated document hash to the QTSP, and receives the signature.
10. The DIW Gateway finalizes the signed document.
11. The signed document is returned to the integration system and presented to the user.

Responsibilities

The integrating organization manages the business process, provides the document to be signed, and determines when a qualified electronic signature is required.

DIW Gateway provides the technical integration between the Relying Party process, the EUDI Wallet ecosystem, and the QTSP, and finalizes the signed document using the signing result obtained from the QTSP.

The Qualified Trust Service Provider provides the qualified electronic signature service and performs the signing operation.