Security Versus Usability – User-Friendly Qualified Signatures Based on German ID Cards

Abstract

The new German ID card introduced in 2010 and the electronic residence permit introduced in 2011 are two state-of-the-art ID documents with innovative electronic functions for people living in Germany. Citizens can use both documents for official functions as well as for user identification on the web (also called eID function or online ID function) and for generating qualified electronic signatures (also called eSign function or online signature function).

This article focuses on the experience gained during the introduction of a web application for loading a qualified certificate into German ID cards. Bundesdruckerei has launched the “sign-me” product on the market for this purpose. During a pilot phase from November 2012 to April 2014, citizens were able to load a qualified certificate into their ID cards and use this certificate for a term of one year against a moderate charge. This pilot phase was successfully completed in April 2014, and the “sign-me” application has been in permanent productive use since then.

Besides security issues and the need to comply with legal requirements, the project also focused on aspects of user-friendliness. The aim was to offer existing online-banking users the option to use “sign-me” in a simple manner and largely without the need for prior training.