A-SIT Plus Wallet Demonstrator

Signature Guide

		App Wallet		Remote Wallet
		on same device	on different device
Issue Credentials
» via QR	demo user	-	steps	-
» via Browser	demo user, IDA w/o 2nd Factor, IDA with 2nd Factor	steps	-	(implicitly in presentation)
Present Credentials
» remote	to eIDAS2 RP	steps	steps	steps
» remote	to IDA RP	steps	steps	steps
» proximity		-	steps	-
Sign Documents
» Wallet-Centric	ad-hoc certificate	steps	steps	steps
» Wallet-Centric	pre-loaded certificate	steps	steps	-
» RP-Centric		steps	steps	steps

Wallet-Centric Signature

App Wallet with Ad-Hoc Certificate

Sign with Ad-Hoc Certificate, App Wallet on another device (Cross-Device)

Requirements:
- The Wallet App is installed on the mobile device and provisioned with a PID.
Initialize Signing Process
- Browser on PC:
  - Visit: https://apps.egiz.gv.at/customverifier/# and click “UC5 - Signatures” > “Signature Service”
  - Upload a PDF file
  - Leave settings at: Wallet-centric SCA, EGIZ PoC
  - “Start singing”
  - Scan the QR code with your Wallet app (if the wallet is on another device)
- Wallet App on mobile device:
  - Open the Wallet App
  - In the navbar at the bottom go to “Settings”/”Einstellungen”, then “Sign”/”Signieren”
    - Set QTSP to “apps.egiz.gv.at”
    - Ignore the “Load Certificate” / “Zertifikat laden”
    - If a certificate is available: “Delete Certificate” / “Zertifikat löschen”
    - Click “Sign” / “Signieren”, without previously explicitly loading a certificate
    - A QR Scanner appears: Scan the QR code shown on the webpage
Obtain an ad-hoc certificate by authenticating via Wallet with PID
- Browser on mobile device:
  - The Webpage opens on the mobile browser
  - Click “Open your Wallet on same device”
- Wallet App on mobile device:
  - The Wallet app appears with a Consent screen
  - Share the requested data / Authenticate
Authorize signing via Wallet with PID
- Browser on mobile device:
  - The Webpage opens on the mobile browser
  - Click “Open your Wallet on same device”
- Wallet App on mobile device:
  - The Wallet app appears with a Consent screen
  - Share the requested data / Authenticate
  - (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
Finally: Browser on PC:
- The signed PDF is shown on the initial web page, available for download

Sign with Ad-Hoc Certificate, App Wallet on same device (Same-Device)

Requirements:
- The Wallet App is installed on the mobile device and provisioned with a PID.
- Ensure no certificate is pre-loaded in the wallet
  - “Settings”/”Einstellungen” in Navbar > “Sign”/”Signieren” > “Delete Certificate” / “Zertifikat löschen”
Initialize Signing Process
- Browser on mobile device:
  - Visit: https://apps.egiz.gv.at/customverifier/# and click “UC5 - Signatures” > “Signature Service”
  - Upload a PDF file
  - Leave settings at: Wallet-centric SCA, EGIZ PoC
  - “Start singing”
  - Click the link “Open Wallet on same device”
Obtain an ad-hoc certificate by authenticating via Wallet with PID
- Browser on mobile device:
  - The Webpage opens on the mobile browser
  - Click “Open your Wallet on same device”
- Wallet App on mobile device:
  - The Wallet app appears with a Consent screen
  - Share the requested data / Authenticate
Authorize signing via Wallet with PID
- Browser on mobile device:
  - The Webpage opens on the mobile browser
  - Click “Open your Wallet on same device”
- Wallet App on mobile device:
  - The Wallet app appears with a Consent screen
  - Share the requested data / Authenticate
  - (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
Finally: Browser on mobile device:
- The signed PDF is shown on the initial web page, available for download

App Wallet with Pre-Loaded Certificate

Pre-Load Certificate, App Wallet on same device

Requirements:
- The Wallet App is installed on the mobile device and provisioned with a PID.
Wallet App on mobile device:
- “Settings”/”Einstellungen” in Navbar > “Sign”/”Signieren” > “Load Certificate” / “Zertifikat laden”
Browser on mobile device:
- The Webpage opens on the mobile browser
- Click “Open your Wallet on same device”
Wallet App on mobile device:
- The Wallet app appears with a Consent screen
- Share the requested data / Authenticate

Sign with Pre-Loaded Certificate, App Wallet on same device (Same-Device)

Requirements:
- The Wallet App is installed on the mobile device and provisioned with a PID.
- Certificate is pre-loaded in the wallet
  - Either a previous signature has been created (and the certificate is still valid)
  - Or see process: “Pre-Load Certificate, Wallet on same device”
Initialize Signing Process
- Browser on mobile device:
  - Visit: https://apps.egiz.gv.at/customverifier/# and click “UC5 - Signatures” > “Signature Service”
  - Upload a PDF file
  - Leave settings at: Wallet-centric SCA, EGIZ PoC
  - “Start singing”
  - Click the link “Open Wallet on same device”
  - (The wallet opens, realizes a certificate is available and redirects again to the browser)
Authorize signing via Wallet with PID
- Browser on mobile device:
  - The Webpage opens on the mobile browser
  - Click “Open your Wallet on same device”
- Wallet App on mobile device:
  - The Wallet app appears with a Consent screen
  - Share the requested data / Authenticate
  - (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
Finally: Browser on mobile device:
- The signed PDF is shown on the initial web page, available for download

Sign with Pre-Loaded Certificate, App Wallet on a different device (Cross-Device)

Requirements:
- The Wallet App is installed on the mobile device and provisioned with a PID.
- Certificate is pre-loaded in the wallet
  - Either a previous signature has been created (and the certificate is still valid)
  - Or see process: “Pre-Load Certificate, Wallet on same device”
Initialize Signing Process
- Browser on PC:
  - Visit: https://apps.egiz.gv.at/customverifier/# and click “UC5 - Signatures” > “Signature Service”
  - Upload a PDF file
  - Leave settings at: Wallet-centric SCA, EGIZ PoC
  - “Start singing”
  - Scan the QR code with your Wallet app (if the wallet is on another device)
- Wallet App on mobile device:
  - Open the Wallet App
  - In the navbar at the bottom go to “Settings”/”Einstellungen”, then “Sign”/”Signieren”
    - Set QTSP to “apps.egiz.gv.at”
    - The pre-loaded certificate should be shown
    - Click “Sign” / “Signieren”
    - A QR Scanner appears: Scan the QR code shown on the webpage
Authorize signing via Wallet with PID
- Browser on mobile device:
  - The Webpage opens on the mobile browser
  - Click “Open your Wallet on same device”
- Wallet App on mobile device:
  - The Wallet app appears with a Consent screen
  - Share the requested data / Authenticate
  - (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
Finally: Browser on PC:
- The signed PDF is shown on the initial web page, available for download

Remote Wallet (with Ad-Hoc Certificate)

Initialize Signing Process
- Browser on device:
  - Visit: https://apps.egiz.gv.at/customverifier/# and click “UC5 - Signatures” > “Signature Service”
  - Upload a PDF file
  - Leave settings at: Wallet-centric SCA, EGIZ PoC
  - “Start singing”
  - Click the link “Open Austrian Remote Wallet”
  - Select “egiz” and Submit
Obtain an ad-hoc certificate by authenticating via Wallet with PID
- Browser on device:
  - The webpage says “Authorize QTSP-service access”
  - Click “Open Austrian Remote Wallet”
- Browser on device :
  - a Consent screen of the remote wallet appears
  - Authenticate with ID Austria credential
Authorize signing via Wallet with PID
- Browser on device:
  - The webpage says “Documents to sign” and “Authorize signing”
  - Click “Open Austrian Remote Wallet”
- Browser on device :
  - a Consent screen of the remote wallet appears
  - Authenticate with ID Austria credential
  - (The Q-TSP signs the PDF with the ad-hoc certificate)
Finally: Browser on device:
- The signed PDF is shown on the initial web page, available for download

RP-Centric Signature

Note: In this use case, certificates cannot be pre-loaded and reused.

App Wallet

App Wallet on different device (Cross-Device)

Requirements:
- The Wallet App is installed on the mobile device and provisioned with a PID.
Initialize Signing Process
- Browser on PC:
  - Visit: https://apps.egiz.gv.at/customverifier/# and click “UC5 - Signatures” > “Signature Service”
  - Upload a PDF file
  - Set settings: RP-centric SCA, EGIZ PoC
  - “Start singing”
Let RP obtain an ad-hoc certificate by authenticating via Wallet with PID
- (if no certificate has been previously loaded)
- Browser on PC:
  - The webpage says “Authorize QTSP-service access”
  - and a QR Code is shown
- Wallet App on mobile device:
  - In Navbar “Daten vorzeigen” / “Present data” > scan the QR code
  - The consent screen is shown
  - Share the requested data / Authenticate
Authorize signing via Wallet with PID
- Browser on PC:
  - The webpage says “Documents to sign” and “Authorize signing”
  - A QR Code is shown
- Wallet App on mobile device:
  - In Navbar “Daten vorzeigen” / “Present data” > scan the QR code
  - The consent screen is shown
  - Share the requested data / Authenticate
  - (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
Finally: Browser on PC:
- The signed PDF is shown on the initial web page, available for download

App Wallet on same device (Same-Device)

Requirements:
- The Wallet App is installed on the mobile device and provisioned with a PID.
Initialize Signing Process
- Browser on mobile device:
  - Visit: https://apps.egiz.gv.at/customverifier/# and click “UC5 - Signatures” > “Signature Service”
  - Upload a PDF file
  - Set settings: RP-centric SCA, EGIZ PoC
  - “Start singing”
Let RP obtain an ad-hoc certificate by authenticating via Wallet with PID
- (if no certificate has been previously loaded)
- Browser on mobile device:
  - The webpage says “Authorize QTSP-service access”
  - Click “Open your Wallet on same device”
- Wallet App on mobile device:
  - The Wallet app appears
  - The consent screen is shown
  - Share the requested data / Authenticate
Authorize signing via Wallet with PID
- Browser on mobile device:
  - The webpage says “Documents to sign” and “Authorize signing”
  - Click “Open your Wallet on same device”
- Wallet App on mobile device:
  - The Wallet app appears
  - The consent screen is shown
  - Share the requested data / Authenticate
  - (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
Finally: Browser on mobile device:
- The signed PDF is shown on the web page, available for download

Remote Wallet (with Ad-Hoc Certificate)

Initialize Signing Process
- Browser on device:
  - Visit: https://apps.egiz.gv.at/customverifier/# and click “UC5 - Signatures” > “Signature Service”
  - Upload a PDF file
  - Set settings: RP-centric SCA, EGIZ PoC
  - “Start singing”
  - Click the link “Open Austrian Remote Wallet”
  - Select “egiz” and Submit
Obtain an ad-hoc certificate by authenticating via Wallet with PID
- Browser on device:
  - The webpage says “Authorize QTSP-service access”
  - Click “Open Austrian Remote Wallet”
- Browser on device :
  - a Consent screen of the remote wallet appears
  - Authenticate with ID Austria credential
Authorize signing via Wallet with PID
- Browser on device:
  - The webpage says “Documents to sign” and “Authorize signing”
  - Click “Open Austrian Remote Wallet”
- Browser on device :
  - a Consent screen of the remote wallet appears
  - Authenticate with ID Austria credential
  - (The Q-TSP signs the PDF with the ad-hoc generated or preloaded certificate)
Finally: Browser on device:
- The signed PDF is shown on the initial web page, available for download