HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"L 74/30
EN
Official Journal of the European Union
16.3.2013
DECISIONS
DECISION OF THE EUROPEAN CENTRAL BANK
of 11 January 2013
laying down the framework for a public key infrastructure for the European System of Central
Banks
(ECB/2013/1)
(2013/132/EU)
THE GOVERNING COUNCIL OF THE EUROPEAN CENTRAL BANK,
(4) Few
ESCB
central
banks
have
their
own
public
key
infra
structure and many users from third parties that work
jointly with ESCB central banks do not have easy access
to a certification authority accepted by the ESCB in
Having regard to the Treaty on the Functioning of the European
accordance with its certificate acceptance framework.
Union, and in particular Article 127 thereof,
(5)
There is a need for the Eurosystem to create its own
Having regard to the Statute of the European System of Central
public key infrastructure which can issue all types of
Banks and of the European Central Bank (hereinafter the ‘Statute
electronic certificates such as personal and technical
of the ESCB’), and in particular Article 12.1 in conjunction with
certificates for ESCB and non-ESCB users, and which is
Article 3.1, Article 5, Article 12.3 and Articles 16 to 24 thereof,
flexible enough to adapt to developments in ESCB and
Eurosystem electronic applications, systems, platforms
and services. This public key infrastructure (hereinafter
the ‘ESCB-PKI’) should complement the services
Whereas:
provided by other certification authorities accepted by
the ESCB in accordance with the ESCB certificate
acceptance framework or by certification authorities
(1)
Pursuant to Article 12.1 of the Statute of the ESCB, the
accepted by the ESCB for TARGET2 and TARGET2
Governing Council adopts the guidelines and takes the
Securities for those two applications.
decisions necessary to ensure the performance of the
tasks entrusted to the European System of Central
Banks (ESCB) and to the Eurosystem under the Treaty
(6) On
29
September
2010
the
Governing
Council
decided
and the Statute of the ESCB. This includes the power to
to launch the ESCB-PKI project to build and implement
decide on the organisation of ancillary activities that are
the ESCB-PKI and to provide the resources required for
necessary for the performance of such tasks, such as the
its completion. It decided that the ESCB-PKI will be
issuance and management of electronic certificates for
developed, hosted and operated by the Banco de Espaa.
securing information stored and processed in ESCB and
Eurosystem electronic applications, systems, platforms
and services, and for data communication to and from
them.
(7) The
ESCB-PKI
indirectly
supports
the
performance
of

ESCB and Eurosystem tasks. It is based on three levels
of governance: Level 1 consists of the Governing Council
and the Executive Board, Level 2 of the Eurosystem
(2)
Pursuant to Article 12.3 of the Statute of the ESCB, the
central banks and Level 3 of the providing central bank.
Governing Council also has the power to determine the
internal organisation of the European Central Bank (ECB)
and its decision-making bodies. Accordingly, the
(8) At
Level
1,
the
Governing
Council
is
responsible
for
the
Governing Council has the power to decide that the
direction, management and control of the activities and
ECB will use electronic certificates issued by the Euro
deliverables needed to develop and operate the ESCB-PKI.
system’s own public key infrastructure.
It is also responsible for decision-making in relation to
the ESCB-PKI and decides on the allocation of tasks not
specifically attributed to Levels 2 and 3.
(3)
The number of users accessing a growing number of
constantly evolving ESCB and Eurosystem electronic
applications, systems, platforms and services is
(9) The
Eurosystem
central
banks
are
responsible
for
the
increasing. The Governing Council has identified a need
tasks assigned to Level 2, within the general framework
for advanced information security services, such as strong
defined by the Governing Council. They have
authentication, electronic signatures and encryption,
competences regarding the technical means of imple
through the use of electronic certificates.
menting the ESCB-PKI.

---

EN
16.3.2013 Official
Journal
of
the
European
Union L
74/31
(10) The
ESCB
Information
Technology
Committee
(ITC)
has
certificate or electronic certificate includes a reference to the
a steering role in the development of the ESCB-PKI. It
data carrier devices on which the certificate or electronic
guides, assesses, controls and approves the project
certificate is held;
deliverables against the acceptance criteria in accordance
with the ESCB certificate acceptance framework, the
scope and the schedule approved by the Governing
2. ‘ESCB and Eurosystem electronic applications, systems,
Council.
platforms and services’ means the electronic applications,
systems, platforms and services that the ESCB and/or the
Eurosystem use when carrying out the tasks entrusted to
(11) At
Level
3,
the
Banco
de
Espaa
has
been
appointed
as
them under the Treaty and the Statute of the ESCB;
the providing central bank to carry out the tasks assigned
to it within the general framework defined by the
Governing Council. The providing central bank has put
3. ‘public key infrastructure’ means the set of individuals,
in place the technical infrastructure and secure devices
policies, procedures, and computer systems necessary to
and services required to create and use a public key
provide authentication, encryption, integrity and non-
infrastructure in accordance with: (a) the national law
repudiation services by way of public and private key
transposing Directive 1999/93/EC of the European
cryptography and electronic certificates;
Parliament and of the Council of 13 December 1999
on a Community framework for electronic signatures ( 1 ),
as applicable to it; (b) the national law transposing
4. ‘user’ means either a certificate subscriber or a relying party,
Directive 95/46/EC of the European Parliament and of
or both;
the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data
and on the free movement of such data ( 2 ), as applicable
5. ‘authentication’ means the process of verifying the identity
to it; and (c) Regulation (EC) No 45/2001 of the
of a certificate applicant or certificate subscriber;
European Parliament and of the Council of 18 December
2000 on the protection of individuals with regard to the
processing of personal data by the Community insti
6. ‘ESCB central bank’ means either a Eurosystem central bank
tutions and bodies and on the free movement of such
or a non-euro area NCB;
data ( 3 ).
7. ‘Eurosystem central bank’ means either an NCB of a
(12) Since
electronic
certificates
are
essential
elements
used
in
Member State whose currency is the euro, including the
electronic applications both as an authentication
providing central bank, or the ECB;
mechanism to implement electronic signatures, and for
public key-based encryption, the ESCB-PKI will take into
account existing ESCB and Eurosystem electronic appli
8. ‘providing central bank’ means the NCB appointed by the
cations, systems, platforms and services and current ESCB
Governing Council to develop the ESCB-PKI and to provide
projects in order to ensure that their needs are covered.
ESCB-PKI services on behalf of and for the benefit of the
Eurosystem central banks;
(13) Non-euro
area
national
central
banks
(NCBs)
may
decide
to use the certificates and services provided by the ESCB-
9. ‘non-euro area NCB’ means an NCB of a Member State
PKI,
whose currency is not the euro;
HAS ADOPTED THIS DECISION:
10. ‘ESCB-PKI certification authority’ means the entity, trusted
by users, to issue, manage, revoke and renew certificates on
Article 1
behalf of the ESCB central banks or the Eurosystem central
banks in accordance with the ESCB certificate acceptance
Definitions
framework;
For the purposes of this Decision:
11. ‘ESCB-PKI validation authority’ means the entity, trusted by
1. ‘certificate’ or ‘electronic certificate’ means an electronic file,
users, which provides information on the validity of
issued by a certification authority, which binds a public key
certificates issued by the ESCB-PKI certification authority;
with a certificate subscriber’s identity and is used for all or
some of the following: (a) to verify that a public key
belongs to a certificate subscriber; (b) to authenticate a
12. ‘certificate subscriber’ means either an individual who is the
certificate subscriber; (c) to check a certificate’s subscriber
subject of an electronic certificate and has been issued an
signature; (d) to encrypt a message addressed to a certificate
electronic certificate, or a technical component manager
subscriber; (e) to verify a certificate subscriber’s access rights
who has accepted an electronic certificate issued by the
to ESCB and Eurosystem electronic applications, systems,
ESCB-PKI certification authority for a technical component,
platforms and services. Any reference in this Decision to a
or both;
( 1 ) OJ L 13, 19.1.2000, p. 12.
( 2 ) OJ L 281, 23.11.1995, p. 31.
13. ‘ESCB certificate acceptance framework’ means the criteria
( 3 ) OJ L 8, 12.1.2001, p. 1.
established by the ESCB ITC to identify the certification

---

L 74/32
EN
Official Journal of the European Union
16.3.2013
authorities, both internal and external to the ESCB, which
3. The
ESCB-PKI
shall
provide
the
following
certification
can be trusted in relation to ESCB and Eurosystem elec
services:
tronic applications, systems, platforms and services;
(a) certificate issuance, renewal and revocation, and confir
14. ‘registration authority’ means an entity, trusted by users,
mation of a certificate’s validity with regard to different
which verifies the identity of a certificate applicant before
certificate types;
the ESCB-PKI certification authority issues a certificate;
(b) issuance of certificates for authentication, electronic
15. ‘relying party’ means an individual or an entity other than a
signature and encryption in relation to ESCB and non-
certificate subscriber which accepts and relies on a
ESCB users, and technical certificates;
certificate;
(c) private key recovery to ensure the recovery of public key-
based encrypted information in the case of certificate loss;
16. ‘audit policy’ means the ESCB audit policy defined by the
Governing Council on 7 October 1998, as published on
the ECB’s website ( 1 );
(d) delivery and management of cryptographic tokens to
certificate subscribers when needed;
17. ‘certificate applicant’ means an individual who requests the
issuance of a certificate for themself or for a technical
(e) provision of information on ESCB-PKI certificate
component;
management procedures, and technical support to ESCB
project managers to help them to integrate ESCB-PKI
certificates into their applications.
18. ‘technical component’ means any software or any hardware
equipment that can be identified by using electronic certifi
Other services may be added in the future as required by ESCB
cates.
and Eurosystem electronic applications, systems, platforms and
services.
Article 2
Scope
Article 4
1. This Decision establishes the framework for the ESCB-PKI.
ESCB-PKI framework
The ESCB-PKI is the Eurosystem’s own public key infrastructure
1. Subject
to
this
Decision,
the
responsibilities
and
functions
developed by the providing central bank on behalf of and for
of the providing central bank and of the other Eurosystem
the benefit of the Eurosystem central banks, which issues,
central banks with regard to ESCB-PKI implementation,
manages, revokes and renews certificates in accordance with
operation and use shall be set out in a Level 2 – Level 3
the ESCB’s certificate acceptance framework.
Agreement and further specified in ESCB-PKI certificate
policies and the ESCB-PKI certification practice statement.
2. As
ESCB-PKI
services
may
affect
relying
parties,
this
Decision also sets out the conditions under which such
2. The Level 2 – Level 3 Agreement, which includes the
parties may rely on ESCB-PKI certificates.
Service Level Agreement, contains the agreement negotiated
between the providing central bank and the Eurosystem
central banks in relation to the responsibilities and functions
Article 3
of the providing central bank and the Eurosystem central banks.
Scope and objectives of the ESCB-PKI
It shall be submitted for endorsement by the Governing Council
and then signed by the providing central bank and the Euro
1. ESCB
and
Eurosystem
electronic
applications,
systems, system central banks.
platforms and services with medium or above medium criti
cality shall only be accessed and used if a user has been auth
3. The
Service
Level
Agreement
is
both
an
agreement
enticated by means of an electronic certificate issued and
defining the level of services to be provided by the providing
managed by a certification authority accepted by the ESCB in
central bank to the Eurosystem, and an agreement defining the
accordance with the ESCB certificate acceptance framework,
level of services to be provided by the Eurosystem to the non-
including by the ESCB-PKI certification authority, or by certifi
euro area NCBs and third parties in relation to the ESCB-PKI.
cation authorities accepted by the ESCB for TARGET2 and
TARGET2 Securities for those two applications.
4. The
ESCB-PKI
certification
practice
statement
is
a
set
of
rules governing the life cycle of electronic certificates, from the
2. The
ESCB-PKI
certification
authority
shall
issue
electronic initial request to the subscription end or revocation, as well as
certificates and provide other electronic certification services for
the relationships between the certificate applicant or subscriber,
certificate subscribers of the ESCB central banks and of third
the ESCB-PKI certification authority and the relying parties. It
parties working with them to enable them to securely access
covers electronic certificates falling under the scope of Directive
and use ESCB and Eurosystem electronic applications, systems,
1999/93/EC, and electronic certificates falling outside its scope.
platforms and services.
It also sets out the roles and responsibilities of all parties and
establishes the procedures concerning issuing and managing
( 1 ) www.ecb.europa.eu
certificates. It is annexed to the Level 2 – Level 3 Agreement.

---

EN
16.3.2013 Official
Journal
of
the
European
Union L
74/33
5. An
ESCB-PKI
certificate
policy
is
a
set
of
rules
which
is
Article 7
applicable to each type of certificate issued. Each set provides
implementation details relating to the ESCB-PKI certification
Relationships between the Eurosystem central banks, third
practice statement for each type of certificate issued. ESCB-PKI
parties and certificate subscribers
certificate policies are annexed to the Level 2 – Level 3
Each Eurosystem central bank shall make arrangements with
Agreement.
regard to third party secure access and use of the ESCB and
Eurosystem electronic applications, systems, platforms and
6. The
ESCB-PKI
certificate
policies
and
the
ESCB-PKI
certifi
services through the use of ESCB-PKI certificates. These
cation practice statement shall be published on the ESCB-PKI
arrangements shall exclusively govern the relationship between
website (
the relevant Eurosystem central bank and the third parties that

1 ).
use ESCB-PKI certificates. All third parties shall comply with the
ESCB-PKI certificate policies, the ESCB-PKI certification practice
7. Information
concerning
the
ESCB-PKI
certification
auth
statement and the user terms and conditions set out in the
ority, including its identity, and its technical components is
ESCB-PKI certification authority’s application form for its
set out in the Annex to this Decision.
services.
Article 5
Article 8
Responsibilities and roles of the providing central bank
Relationships with relying parties
1. The
providing
central
bank
shall
be
responsible
for
operating and maintaining the ESCB-PKI for the benefit of the
An electronic certificate issued under this Decision may be
Eurosystem central banks, including hosting, operation and
relied upon provided that a relying party:
management carried out in accordance with the Level 2 –
Level 3 Agreement. In particular, it shall deliver certificates
and ESCB-PKI services in accordance with business requirements
(a) verifies the validity, suspension or revocation of the
and technical specifications, such as the ESCB certificate
certificate using current revocation status information;
acceptance framework and the requirements and specifications
set out in the Level 2 – Level 3 Agreement.
(b) takes account of any limitations on use specified in the
certificate; and
2. The
providing
central
bank
shall
put
the
necessary
organi
sational infrastructure in place for creating, issuing and
managing certificates and shall ensure that the infrastructure is
(c) accepts the ESCB-PKI certification practice statement and the
maintained. For that purpose, in consultation with the ITC, the
applicable ESCB-PKI certificate policies.
providing central bank may adopt rules concerning its internal
organisation and administration.
Article 9
3. The
providing
central
bank
shall
act
as
the
ESCB-PKI
Rights to the ESCB-PKI
certification authority and the ESCB-PKI validation authority.
1. The
ESCB-PKI
shall
be
fully
owned
by
the
Eurosystem
central banks.
4. The Level 2 – Level 3 Agreement shall establish the
liability regime applying to the providing central bank.
2. In
view
thereof,
the
providing
central
bank
shall
grant
to
the Eurosystem central banks, to the extent feasible under
Article 6
applicable legislation, all licenses regarding the intellectual
Responsibilities and roles of the Eurosystem central banks
property rights required to enable the Eurosystem central
banks to use the ESCB-PKI and its components and the full
1. Each Eurosystem central bank shall be responsible for
range of ESCB-PKI services and also provide ESCB-PKI services
identifying its certificate subscribers. It shall create the role of
to third parties under the ESCB-PKI certification practice
registration officer to perform this task who shall have the
statement and the ESCB-PKI certificate policies. The providing
authority to register third party users.
central bank shall indemnify the Eurosystem central banks
against any infringement claims raised by third parties in
2. Each
Eurosystem
central
bank
shall
act
as
a
relying
party relation to such intellectual property rights.
in relation to certificates for encryption and electronic signature
issued by the ESCB-PKI for other Eurosystem central banks or
third party users’ certificate subscribers.
3. The
details
regarding
the
Eurosystem
central
banks’
rights
to the ESCB-PKI shall be agreed between Level 2 and Level 3 in
the Level 2 – Level 3 Agreement.
3. Each
Eurosystem
central
bank
using
ESCB-PKI
services
shall act as a registration authority for its certificate applicants
and ensure that its certificate applicants accept and apply the
Article 10
user terms and conditions set out in the ESCB-PKI certification
authority’s application form for its services.
Liability of Eurosystem central banks towards users
1. Unless
they
prove
that
they
have
not
acted
negligently,
the
( 1 ) http://pki.escb.eu
Eurosystem central banks shall be liable in accordance with

---

L 74/34
EN
Official Journal of the European Union
16.3.2013
their functions and responsibilities in the ESCB-PKI for any
Article 12
damage caused to a user who reasonably relies on a qualified
certificate, as defined in Directive 1999/93/EC, as regards:
Data protection
Eurosystem central banks shall comply with the data protection
legislation applicable to their processing of personal data in the
(a) the accuracy at the time of issuance of all the information
performance of their functions related to the ESCB-PKI.
contained in a qualified certificate, and the question of
whether the certificate contains all the details prescribed
Article 13
for a qualified certificate, as defined in Directive
1999/93/EC;
Audit
Audits of the ESCB-PKI shall be performed in accordance with
(b) any assurance that at the time of issuance of a qualified
the principles and arrangements set out in the audit policy.
certificate, the certificate subscriber identified therein held
They shall be without prejudice to the internal controls and
the signature-creation data corresponding to the signature-
audit rules that apply to or are adopted by the Eurosystem
verification data given or identified in the certificate;
central banks.
Article 14
(c) any assurance that the signature-creation device and the
Financial arrangements
signature-verification device function together in a comple
mentary manner, in cases where the ESCB-PKI generates
The Eurosystem central banks shall bear the costs of developing
both;
and operating the ESCB-PKI as further specified in the ESCB-PKI
financial envelope.
(d) any failure to register revocation of a qualified certificate.
Article 15
Role of the Executive Board
2. The
Eurosystem
central
banks
assume
no
commitments,
1. In
accordance
with
Article
17.3
of
Decision
ECB/2004/2
give no guarantees and accept no liability towards users unless
of 19 February 2004 adopting the Rules of Procedure of the
expressly stated in this Decision and in the ESCB-PKI certifi
European Central Bank (
cation practice statement.

1 ), the Governing Council delegates its
normative powers to the Executive Board to take any measures
to implement this Decision that are necessary for the efficiency
Article 11
and security of the ESCB-PKI, and to adopt amendments
relating to the technical aspects of the ESCB-PKI and ESCB-
Participation of non-euro area NCBs in the ESCB-PKI
PKI services provided for in the annexes to the Level 2 – Level 3
Agreement after taking into consideration the advice of the ITC
1. A
non-euro
area
NCB
may
act
as
a
registration
authority and, if applicable, of the Eurosystem IT Steering Committee.
for its internal users as well as for third party users, and may
create the role of a registration officer to perform this task.
2. The Executive Board shall notify the Governing Council of
any measure that it takes pursuant to paragraph 1 without
2. Subject to the approval of the Governing Council, a non-
undue delay and shall abide by any decision adopted by the
euro area NCB may also decide to use ESCB-PKI services under
Governing Council on the matter.
the same conditions as those applying to Eurosystem central
banks. For that purpose, the non-euro area NCB shall submit a
declaration to the Governing Council in which it confirms that
Done at Frankfurt am Main, 11 January 2013.
it will comply with the obligations laid down in this Decision
and in the Level 2 – Level 3 Agreement. A non-euro area NCB
shall not become co-owner of the ESCB-PKI and shall not be
The President of the ECB
obliged to contribute to the ESCB-PKI financial envelope.
Mario DRAGHI
( 1 ) OJ L 80, 18.3.2004, p. 33.

---

EN
16.3.2013 Official
Journal
of
the
European
Union L
74/35
ANNEX
Information concerning the ESCB-PKI certification authority, including its identity, and its technical components
The ESCB-PKI certification authority is identified in its certificate as the issuer and its private key is used to sign
certificates. The ESCB-PKI certification authority is in charge of:
(i) issuing private and public key certificates;
(ii) issuing revocation lists;
(iii) generating key pairs associated with specific certificates, e.g. those that require key recovery;
(iv) maintaining overall responsibility for the ESCB-PKI and ensuring that all the requirements necessary to operate it are
met.
The ESCB-PKI certification authority includes all individuals, policies, procedures and computer systems entrusted with
issuing electronic certificates and assigning them to the certificate subscribers.
The ESCB-PKI certification authority includes two technical components:
— The Root ESCB-PKI certification authority: This certification authority, at the first level, only issues certificates for
itself and its subordinate certification authorities. It is only in operation when carrying out its own narrowly-defined
responsibilities. Its most significant data are:
Distinguished name CN=ESCB-PKI
ROOT
CA,
O=EUROPEAN
SYSTEM
OF
CENTRAL
BANKS,
C=EU
Serial number
596F AC4C 218C 21BC 4E00 6B42 A164 46DD
Distinguished name of issuer CN=ESCB-PKI
ROOT
CA,
O=EUROPEAN
SYSTEM
OF
CENTRAL
BANKS,
C=EU
Validity period
From 21-06-2011 11:58:26 to 21-06-2041 11:58:26
Message digest (SHA-1) CEFE
6C32
E850
994A
09EA
1A77
0C60
3D90
ADC9
9192
— The Online ESCB-PKI certification authority: This certification authority, at the second level, is subordinate to the
Root ESCB-PKI certification authority. It is responsible for issuing ESCB-PKI certificates for users. Its most significant
data are:
Distinguished name CN=ESCB-PKI
ONLINE
CA,
O=EUROPEAN
SYSTEM
OF
CENTRAL
BANKS,
C=EU
Serial number
2C13 E18F FDB5 91CE 4E29 550B B5A3 F59C
Distinguished name of issuer CN=ESCB-PKI
ROOT
CA,
O=EUROPEAN
SYSTEM
OF
CENTRAL
BANKS,
C=EU
Validity period
From 22-07-2011 12:46:35 to 22-07-2026 12:46:35
Message digest (SHA-1)
D316 026C D2CF 1A8C 4AA3 8C29 EE3D 591E 4286 AD08

---

Document Outline

• �

---