2013/132/EU: Decision of the European Central Bank of 11 January 2013 laying down the framework for a public key infrastructure for the European System of Central Banks (ECB/2013/1)

Article 1

Definitions

For the purposes of this Decision:

• 1. ‘certificate’ or ‘electronic certificate’ means an electronic file, issued by a certification authority, which binds a public key with a certificate subscriber’s identity and is used for all or some of the following: (a) to verify that a public key belongs to a certificate subscriber; (b) to authenticate a certificate subscriber; (c) to check a certificate’s subscriber signature; (d) to encrypt a message addressed to a certificate subscriber; (e) to verify a certificate subscriber’s access rights to ESCB and Eurosystem electronic applications, systems, platforms and services. Any reference in this Decision to a certificate or electronic certificate includes a reference to the data carrier devices on which the certificate or electronic certificate is held;

• 1. ‘ESCB and Eurosystem electronic applications, systems, platforms and services’ means the electronic applications, systems, platforms and services that the ESCB and/or the Eurosystem use when carrying out the tasks entrusted to them under the Treaty and the Statute of the ESCB;

• 1. ‘public key infrastructure’ means the set of individuals, policies, procedures, and computer systems necessary to provide authentication, encryption, integrity and non-repudiation services by way of public and private key cryptography and electronic certificates;

• 1. ‘user’ means either a certificate subscriber or a relying party, or both;

• 1. ‘authentication’ means the process of verifying the identity of a certificate applicant or certificate subscriber;

• 1. ‘ESCB central bank’ means either a Eurosystem central bank or a non-euro area NCB;

• 1. ‘Eurosystem central bank’ means either an NCB of a Member State whose currency is the euro, including the providing central bank, or the ECB;

• 1. ‘providing central bank’ means the NCB appointed by the Governing Council to develop the ESCB-PKI and to provide ESCB-PKI services on behalf of and for the benefit of the Eurosystem central banks;

• 1. ‘non-euro area NCB’ means an NCB of a Member State whose currency is not the euro;

• 1. ‘ESCB-PKI certification authority’ means the entity, trusted by users, to issue, manage, revoke and renew ESCB-PKI certificates in accordance with the ESCB/SSM certificate acceptance framework;

• 1. ‘ESCB-PKI validation authority’ means the entity, trusted by users, which provides information on the validity of certificates issued by the ESCB-PKI certification authority;

• 1. ‘certificate subscriber’ means either an individual who is the subject of an electronic certificate and has been issued an electronic certificate, or a technical component manager who has accepted an electronic certificate issued by the ESCB-PKI certification authority for a technical component, or both;

• 1. ‘ESCB certificate acceptance framework’ means the criteria established by the ESCB ITC to identify the certification authorities, both internal and external to the ESCB, which can be trusted in relation to ESCB and Eurosystem electronic applications, systems, platforms and services;

• 1. ‘registration authority’ means an entity, trusted by users, which verifies the identity of a certificate applicant before the ESCB-PKI certification authority issues a certificate;

• 1. ‘relying party’ means an individual or an entity other than a certificate subscriber which accepts and relies on a certificate;

• 1. ‘audit policy’ means the ESCB audit policy defined by the Governing Council on 7 October 1998, as published on the ECB’s website ([^E0001]);

• 1. ‘certificate applicant’ means an individual who requests the issuance of a certificate for themself or for a technical component;

• 1. ‘technical component’ means any software or any hardware equipment that can be identified by using electronic certificates;

• 1. ‘competent authority’ means either a national competent authority or the ECB;

• 1. ‘national competent authority’ (NCA) means a national competent authority as defined in point (2) of Article 2 of Council Regulation (EU) No 1024/2013 ([^E0002]) and, for the purposes of this Decision, also includes, in respect of the supervisory tasks assigned to them, national central banks that have been assigned certain supervisory tasks under national law and are not designated as NCAs;

• 1. ‘cooperating authority’ means a public authority, other than a central bank within the ESCB or a competent authority, with which the ESCB or the Single Supervisory Mechanism (SSM) cooperates in carrying out the tasks of the ESCB or of the ECB under Regulation (EU) No 1024/2013;

• 1. ‘participating competent authority’ means a competent authority that uses the ESCB services for the purpose of cooperating with the ESCB and with other competent authorities, in order to carry out its tasks within the Single Supervisory Mechanism (SSM), established pursuant to Regulation (EU) No 1024/2013.

Article 2

Scope

Article 3

Scope and objectives of the ESCB-PKI

• (a) certificate issuance, renewal and revocation, and confirmation of a certificate’s validity with regard to different certificate types;

• (b) issuance of certificates for authentication, electronic signature and encryption in relation to ESCB and non-ESCB users, and technical certificates;

• (c) private key recovery to ensure the recovery of public key-based encrypted information in the case of certificate loss;

• (d) delivery and management of cryptographic tokens to certificate subscribers when needed;

• (e) provision of information on ESCB-PKI certificate management procedures, and technical support to ESCB project managers to help them to integrate ESCB-PKI certificates into their applications.

Other services may be added in the future as required by ESCB and Eurosystem electronic applications, systems, platforms and services.

Article 4

ESCB-PKI framework

Article 5

Responsibilities and roles of the providing central bank

Article 6

Responsibilities and roles of the Eurosystem central banks

Article 7

Relationships between the Eurosystem central banks, third parties and certificate subscribers

Each Eurosystem central bank shall make arrangements with regard to third party secure access and use of the ESCB and Eurosystem electronic applications, systems, platforms and services through the use of ESCB-PKI certificates. These arrangements shall exclusively govern the relationship between the relevant Eurosystem central bank and the third parties that use ESCB-PKI certificates. All third parties shall comply with the ESCB-PKI certificate policies, the ESCB-PKI certification practice statement and the user terms and conditions set out in the ESCB-PKI certification authority’s application form for its services.

Article 8

Relationships with relying parties

An electronic certificate issued under this Decision may be relied upon provided that a relying party:

• (a) verifies the validity, suspension or revocation of the certificate using current revocation status information;

• (b) takes account of any limitations on use specified in the certificate; and

• (c) accepts the ESCB-PKI certification practice statement and the applicable ESCB-PKI certificate policies.

Article 9

Rights to the ESCB-PKI

Article 9a

Use of the ESCB-PKI services by cooperating authorities

Article 10

Liability of Eurosystem central banks towards users

• (a) the accuracy at the time of issuance of all the information contained in a qualified certificate, and the question of whether the certificate contains all the details prescribed for a qualified certificate as defined in Directive 1999/93/EC and Regulation (EU) No 910/2014;

• (b) any assurance that at the time of issuance of a qualified certificate, the certificate subscriber identified therein held the signature-creation data corresponding to the signature-verification data given or identified in the certificate;

• (c) any assurance that the signature-creation device and the signature-verification device function together in a complementary manner, in cases where the ESCB-PKI generates both;

• (d) any failure to register revocation of a qualified certificate.

Article 11

Participation of non-euro area NCBs in the ESCB-PKI

Article 12

Data protection

Eurosystem central banks shall comply with the data protection legislation applicable to their processing of personal data in the performance of their functions related to the ESCB-PKI.

Article 13

Audit

Audits of the ESCB-PKI shall be performed in accordance with the principles and arrangements set out in the audit policy. They shall be without prejudice to the internal controls and audit rules that apply to or are adopted by the Eurosystem central banks.

Article 14

Financial arrangements

Participating central banks and participating competent authorities shall bear the costs of developing and operating the ESCB-PKI services according to a defined reimbursement framework, which is based on a cost allocation key, as further specified in the ESCB-PKI financial envelopes following the applicable reimbursement rules. Cooperating authorities shall contribute to the costs in accordance with a specific reimbursement framework.

Article 15

Role of the Executive Board

ANNEX

Information concerning the ESCB-PKI certification authority, including its identity, and its technical components

The ESCB-PKI certification authority is identified in its certificate as the issuer and its private key is used to sign certificates. The ESCB-PKI certification authority is in charge of:

• (i) issuing private and public key certificates;

• (ii) issuing revocation lists;

• (iii) generating key pairs associated with specific certificates, e.g. those that require key recovery;

• (iv) maintaining overall responsibility for the ESCB-PKI and ensuring that all the requirements necessary to operate it are met.

The ESCB-PKI certification authority includes all individuals, policies, procedures and computer systems entrusted with issuing electronic certificates and assigning them to the certificate subscribers.

The ESCB-PKI certification authority includes three technical components:

• 1. The Root ESCB-PKI certification authority: This certification authority, at the first level, only issues certificates for itself and its subordinate certification authorities. It is only in operation when carrying out its own narrowly-defined responsibilities. Its most significant data are:

• 1. The Online ESCB-PKI certification authority: This certification authority, at the second level, is subordinate to the Root ESCB-PKI certification authority. It is responsible for issuing ESCB-PKI certificates for users. It expires on 22 July 2026. Its most significant data are:

• 1. The Online ESCB-PKI certification authority V1.2: This certification authority, at the second level, is subordinate to the Root ESCB-PKI certification authority. It is responsible for issuing ESCB-PKI certificates for users. After 22 July 2026 it is the sole online ESCB-PKI certification authority, until its expiry. Its most significant data are:

[^E0002]: Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63).

[^E0003]: Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (OJ L 257, 28.8.2014, p. 73).

[^E0005]: OJ L 80, 18.3.2004, p. 33.