Illuminating Current Practices in European Remote Signing Solutions

Remote signing solutions enable many degrees of freedom with respect to signature creation applications and signer authentication, especially in comparison with smart card-based solutions. This flexibility, reflecting varying local and sector-specific requirements across Europe, has contributed to a highly heterogeneous ecosystem. In this work, we aim to shed light on current practices of European Trust Service Providers offering remote signing solutions. As a basis for our evaluation, we propose a reusable framework consisting of metrics reflecting functional, security and privacy aspects of the operation of such solutions. We proceed to perform an in-depth, black-box empirical study of eight signing services from six European countries based on this framework. Our observations highlight several trends concerning document confidentiality, signer authentication and defense-in-depth security measures that motivate a review of current requirements and expectations. We further show an inconsistent implementation of optional, ETSI-specified mechanisms.