Download (PDF, 589 KB, Datei ist nicht barrierefrei

InFrAstruCturEs
at the German border for their authenticity and integrity,
the various nations must exchange their root certificates in a
secure manner. this is achieved either via diplomatic pouches
or via the ICAo Public Key Directory (ICAo-PKD).
4.4.2 Country Verifying Certificate Authority (CVCA)
the BsI also operates the Country Verifying Certificate
Authority (CVCA). this authority generates the German root
certificates on a regular basis; the private keys of these certificates
are used to sign the document verifier certificate of
the document verifier instances (DV instances).
the DV instances are responsible for issuing the certificates
authorizing the reading of electronic identity documents,
and also define the individual read rights, i.e. what information
can be read from the identity documents. this authorization
is verified by the rF chip of the electronic identity
document on reading during terminal Authentication.
CVCA Public Key Infrastructure
for citizen applications of the new identity card
CVCA
“ePass”
CVCA
DV(s)
CVCA
“ePass”
“ePass”
“ePass”
CVCA
Inspection
CVCA
“ePass”
“ePass”
authorities
BSI
VfB
CVCA - Country Verifying Certificate Authority
DV - Document Verifier
VfB - Issuing Unit for Terminal certificates
CVCA
CVCA
BerCa(s) “ePass”
“ePass”
CVCA
Service
CVCA
“ePass”
“ePass”
providers
CVCA
“eID”
DV
“eID”
Identity CVCA
CVCA
“ePass” card “ePass”
authority
CVCA
“eSign”
DV
“QES”
Verified CVCA
CVCA
signature “ePass”
“ePass”
terminal
BerCA - Certification Authority for eID service providers
QES - Qualified Electronic Signature
CVCA Public Key Infrastructure
in international context
Country A Country B
InFrAstruCturEs
Authorization certificates are issued solely to control
authorities (e.g. Federal Police) and registry offices (to enable
citizens to check the correctness of data) . these certificates
are also required to read fingerprints.
the diagram “CVCA Public Key Infrastructure for citizen
applications of the new identity card” illustrates the
spectrum of variants of national authorization certificates
for the new identity card. In addition to applications for
sovereign purposes, and for electronic identification, the
CVCA also supports the qualified electronic signature.
the new identity card also requires that authorization
certificates be issued for the control authorities of other
nations that are empowered to access the sovereign functions
of the new identity card. this authorization is issued
separately for each nation.
16 17
Terminal
Terminal
Terminal
CVCA CVCA
DV DV DV DV
Terminal
Terminal
Terminal
Terminal
Terminal
Terminal
Terminal
Terminal
Terminal