Events

eIDAS Trust Services: 6 months on after the switch-over

  • Marina Kirova profile
    Marina Kirova
    29 November 2016 - updated 3 years ago
  • 1 comment
    Total votes: 0
Date & time: 
Monday, 19 December, 2016 - 09:00 to 17:00
Location: 
Charlemagne Building (CHAR) - SICCO MANSHOLT Room
Rue de la Loi 170
1000 Brussels
Belgium

An eIDAS Trust Services Workshop is to be held in Brussels, Belgium, on 19 December 2016, to present the state of play six months after the entry into force of the new rules for trust services under the eIDAS Regulation.

How well have Member States managed to comply with the new rules? Are there obstacles that still need to be overcome? What about trust service providers? Are they on the right path to seize the opportunities brought by the new framework? By providing a platform for sharing experience, best practices, business cases and success stories, the workshop will be an opportunity to take stock of the changes introduced by eIDAS in the EU trust services landscape and to discuss how best to leverage the opportunities offered by the eIDAS Regulation.

More information

Tags: 
trust services

Comments

Log in to post comments
Stephan Engberg's picture
Stephan Engberg,
19/12/2016 12:08

I remain very surprise as to the providers belief that EU is on a good track on "trust" and security. This seems to reflect a commercial and civil servant hope rather than reflecting reality.

In our view:

a) We abuse the term "trust" by switching meaning between the technical use of "verification of fact" to the economic/security "absence of risk" or provable dependability. PKI is ONLY providing the former, but nothing on the later.

b) The industry has a profound misperception that digital identification can ever provide the basis of trust. Identification means creation of destabilizing risk and power which will always decrease trust. The main reason is an absence of serious operational definitions and means for "conditional identification" or "accountability"which is of course a basic part of a signature whereas identification is NOT.

c) We have a deep and serious lack of standards for semantically interoperable resolution with creating a lock-in to oversimplified standards.

d) By far the core element for aligning the requirements is the field where almost no work or solutions seems to be happening on Pseudonymous digital signature (e.g. art 5.2).

We have been focusing exclusively on local or pseudonymous identities and all the elements involved as the only way to reconcile compliance across the complies set of requirements which we by know have all the means to create and roll out. Byt - as of now - we have NOTHING to be compliant against, but have to make our own standards. eId such as PKI has to be strongly delinked as it would invalidate security in transactions. identity beyond that is primitive and surveillance/perimeter-centric instead of dealing with resolving actual security issues such as e.g. authorization.

Regards

Stephan Engberg

Total votes: 1