Signature Guide

		App Wallet		Remote Wallet
		on same device	on different device
Issue Credentials
» via QR		-	steps	-
» via Browser		steps	-	(implicitly in presentation)
Present Credentials
» remote	to eIDAS2 RP	steps	steps	steps
	to IDA RP	steps	steps	steps
» proximity		-	steps	-
Sign Documents
» Wallet-Centric	ad-hoc certificate	steps	steps	steps
	pre-loaded certificate	steps	steps	-
» RP-Centric		steps	steps	steps

Wallet-Centric Signature

Sign with App Wallet on another Device (Cross-Device)

Sign with Ad-Hoc Certificate, App Wallet on another device (Cross-Device)

• Requirements:
  • The Wallet App is installed on the mobile device and provisioned with a PID.
• Initialize Signing Process
  • Browser on PC:
    • Visit: https://apps.egiz.gv.at/customverifier/
    • Click “UC5 - Signatures” > “Signature Service”
    • Upload a PDF file
    • Leave settings at: Wallet-centric SCA
    • “Start singing”
    • Scan the QR code with your Wallet app (if the wallet is on another device)
  • Wallet App on mobile device:
    • Open the Wallet App
    • Click “Sign”/”Signieren” in the navbar at the bottom
    • A QR Scanner appears: Scan the QR code shown on the webpage
    • On the Select VDA screen
      • Set QTSP to “apps.egiz.gv.at”
      • Ignore the “Preload Certificate” / “Zertifikat laden”
      • If a certificate is available: “Delete certificate” / “Zertifikat löschen”
      • Click “Continue”
• Obtain an ad-hoc certificate by authenticating via Wallet with PID
  • Browser on mobile device:
    • The Webpage opens on the mobile browser
    • Click “Open your Wallet on same device”
  • Wallet App on mobile device:
    • The Wallet app appears with a consent screen
    • Share the requested data / authenticate
• Authorize signing via Wallet with PID
  • Browser on mobile device:
    • The Webpage opens on the mobile browser
    • Click “Open your Wallet on same device”
  • Wallet App on mobile device:
    • The Wallet app appears with a Consent screen
    • Share the requested data / authenticate
    • (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
• Finally: Browser on PC:
  • The signed PDF is shown on the initial web page, available for download

Sign with Pre-Loaded Certificate, App Wallet on a different device (Cross-Device)

• Requirements:
  • The Wallet App is installed on the mobile device and provisioned with a PID.
  • Certificate is pre-loaded in the wallet: a previous signature has been created (and the certificate is still valid)
• Initialize Signing Process
  • Browser on PC:
    • Visit: https://apps.egiz.gv.at/customverifier/#
    • Click “UC5 - Signatures” > “Signature Service”
    • Upload a PDF file
    • Leave settings at: Wallet-centric SCA
    • “Start singing”
    • Scan the QR code with your Wallet app (if the wallet is on another device)
  • Wallet App on mobile device:
    • Open the Wallet App
    • Click “Sign”/”Signieren” in the navbar at the bottom
    • A QR Scanner appears: Scan the QR code shown on the webpage
    • On the Select VDA screen
      • Set QTSP to “apps.egiz.gv.at”
      • The pre-loaded certificate should be shown
      • Click “Continue”
• Authorize signing via Wallet with PID
  • Browser on mobile device:
    • The Webpage opens on the mobile browser
    • Click “Open your Wallet on same device”
  • Wallet App on mobile device:
    • The Wallet app appears with a Consent screen
    • Share the requested data / Authenticate
    • (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
• Finally: Browser on PC:
  • The signed PDF is shown on the initial web page, available for download

Sign with App Wallet on Same Device

Sign with Ad-Hoc Certificate, App Wallet on same device (Same-Device)

• Requirements:
  • The Wallet App is installed on the mobile device and provisioned with a PID.
• Initialize Signing Process
  • Browser on mobile device:
    • Visit: https://apps.egiz.gv.at/customverifier/#
    • Click “UC5 - Signatures” > “Signature Service”
    • Upload a PDF file
    • Leave settings at: Wallet-centric SCA
    • “Start singing”
    • Click the link “Open Wallet on same device”
  • Wallet App on mobile device:
    • The Wallet app appears
    • On the Select VDA screen
      • Set QTSP to “apps.egiz.gv.at”
      • Ignore the “Preload Certificate” / “Zertifikat laden”
      • If a certificate is available: “Delete certificate” / “Zertifikat löschen”
      • Click “Continue”
• Obtain an ad-hoc certificate by authenticating via Wallet with PID
  • Browser on mobile device:
    • The Webpage opens on the mobile browser
    • Click “Open your Wallet on same device”
  • Wallet App on mobile device:
    • The Wallet app appears with a Consent screen
    • Share the requested data / Authenticate
• Authorize signing via Wallet with PID
  • Browser on mobile device:
    • The Webpage opens on the mobile browser
    • Click “Open your Wallet on same device”
  • Wallet App on mobile device:
    • The Wallet app appears with a Consent screen
    • Share the requested data / Authenticate
    • (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
• Finally: Browser on mobile device:
  • The signed PDF is shown on the initial web page, available for download

Sign with Pre-Loaded Certificate, App Wallet on same device (Same-Device)

• Requirements:
  • The Wallet App is installed on the mobile device and provisioned with a PID.
  • Certificate is pre-loaded in the wallet
    • Either a previous signature has been created (and the certificate is still valid)
    • Or see process: “Pre-Load Certificate, Wallet on same device”
• Initialize Signing Process
  • Browser on mobile device:
    • Visit: https://apps.egiz.gv.at/customverifier/#
    • Click “UC5 - Signatures” > “Signature Service”
    • Upload a PDF file
    • Leave settings at: Wallet-centric SCA
    • “Start singing”
    • Click the link “Open Wallet on same device”
  • Wallet App on mobile device:
    • The Wallet app appears
    • On the Select VDA screen
      • Set QTSP to “apps.egiz.gv.at”
      • The pre-loaded certificate should be shown
      • Click “Continue”
• Authorize signing via Wallet with PID
  • Browser on mobile device:
    • The Webpage opens on the mobile browser
    • Click “Open your Wallet on same device”
  • Wallet App on mobile device:
    • The Wallet app appears with a Consent screen
    • Share the requested data / Authenticate
    • (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
• Finally: Browser on mobile device:
  • The signed PDF is shown on the initial web page, available for download

Remote Wallet (with Ad-Hoc Certificate)

• Initialize Signing Process
  • Browser on device:
    • Visit: https://apps.egiz.gv.at/customverifier/#
    • Click “UC5 - Signatures” > “Signature Service”
    • Upload a PDF file
    • Leave settings at: Wallet-centric SCA
    • “Start singing”
    • Click the link “Open Austrian Remote Wallet”
    • Select “egiz” and Submit
• Obtain an ad-hoc certificate by authenticating via Wallet with PID
  • Browser on device:
    • The webpage says “Authorize QTSP-service access”
    • Click “Open Austrian Remote Wallet”
  • Browser on device :
    • a Consent screen of the remote wallet appears
    • Authenticate with ID Austria credential
• Authorize signing via Wallet with PID
  • Browser on device:
    • The webpage says “Documents to sign” and “Authorize signing”
    • Click “Open Austrian Remote Wallet”
  • Browser on device :
    • a Consent screen of the remote wallet appears
    • Authenticate with ID Austria credential
    • (The Q-TSP signs the PDF with the ad-hoc certificate)
• Finally: Browser on device:
  • The signed PDF is shown on the initial web page, available for download

RP-Centric Signature

Note: In this use case, certificates cannot be pre-loaded and reused.

App Wallet

App Wallet on different device (Cross-Device)

• Requirements:
  • The Wallet App is installed on the mobile device and provisioned with a PID.
• Initialize Signing Process
  • Browser on PC:
    • Visit: https://apps.egiz.gv.at/customverifier/#
    • Click “UC5 - Signatures” > “Signature Service”
    • Upload a PDF file
    • Set settings: RP-centric SCA, EGIZ PoC
    • “Start singing”
• Let RP obtain an ad-hoc certificate by authenticating via Wallet with PID
  • (if no certificate has been previously loaded)
  • Browser on PC:
    • The webpage says “Authorize QTSP-service access”
    • and a QR Code is shown
  • Wallet App on mobile device:
    • Click on “Present” / “Vorzeigen” in the bottom navbar
    • Select “Authenticat at relying party” (remote presentation)
    • Scan the QR code
    • The consent screen is shown
    • Share the requested data / Authenticate
• Authorize signing via Wallet with PID
  • Browser on PC:
    • The webpage says “Documents to sign” and “Authorize signing”
    • A QR Code is shown
  • Wallet App on mobile device:
    • Click on “Present” / “Vorzeigen” in the bottom navbar
    • Select “Authenticat at relying party” (remote presentation)
    • Scan the QR code
    • Share the requested data / Authenticate
    • (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
• Finally: Browser on PC:
  • The signed PDF is shown on the initial web page, available for download

App Wallet on same device (Same-Device)

• Requirements:
  • The Wallet App is installed on the mobile device and provisioned with a PID.
• Initialize Signing Process
  • Browser on mobile device:
    • Visit: https://apps.egiz.gv.at/customverifier/#
    • Click “UC5 - Signatures” > “Signature Service”
    • Upload a PDF file
    • Set settings: RP-centric SCA, EGIZ PoC
    • “Start singing”
• Let RP obtain an ad-hoc certificate by authenticating via Wallet with PID
  • (if no certificate has been previously loaded)
  • Browser on mobile device:
    • The webpage says “Authorize QTSP-service access”
    • Click “Open your Wallet on same device”
  • Wallet App on mobile device:
    • The Wallet app appears
    • The consent screen is shown
    • Share the requested data / Authenticate
• Authorize signing via Wallet with PID
  • Browser on mobile device:
    • The webpage says “Documents to sign” and “Authorize signing”
    • Click “Open your Wallet on same device”
  • Wallet App on mobile device:
    • The Wallet app appears
    • The consent screen is shown
    • Share the requested data / Authenticate
    • (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
• Finally: Browser on mobile device:
  • The signed PDF is shown on the web page, available for download

Remote Wallet (with Ad-Hoc Certificate)

• Initialize Signing Process
  • Browser on device:
    • Visit: https://apps.egiz.gv.at/customverifier/#
    • Click “UC5 - Signatures” > “Signature Service”
    • Upload a PDF file
    • Set settings: RP-centric SCA, EGIZ PoC
    • “Start singing”
    • Click the link “Open Austrian Remote Wallet”
    • Select “egiz” and Submit
• Obtain an ad-hoc certificate by authenticating via Wallet with PID
  • Browser on device:
    • The webpage says “Authorize QTSP-service access”
    • Click “Open Austrian Remote Wallet”
  • Browser on device :
    • a Consent screen of the remote wallet appears
    • Authenticate with ID Austria credential
• Authorize signing via Wallet with PID
  • Browser on device:
    • The webpage says “Documents to sign” and “Authorize signing”
    • Click “Open Austrian Remote Wallet”
  • Browser on device :
    • a Consent screen of the remote wallet appears
    • Authenticate with ID Austria credential
    • (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
• Finally: Browser on device:
  • The signed PDF is shown on the initial web page, available for download