Remote digital signatures: who really controls PIN and OTP
Sharing PINs and OTPs makes it harder to reconstruct who authorised a signature.
In many firms the remote digital signature has replaced the smart card. The qualified certificate and the private key stay in an HSM of the qualified trust service provider, which acts as a qualified signature creation device (QSCD); the holder authorises each operation with the PIN and an OTP code generated by an app or a token, or received by SMS. The model is sound as long as one assumption holds: those two credentials are under the sole control of the holder.
What eIDAS and the CAD say about remote digital signatures
Regulation (EU) 910/2014 (eIDAS), in Article 26, requires an advanced signature to be created using data that the signatory can, with a high level of confidence, use under their sole control. The Digital Administration Code (CAD, Legislative Decree 82/2005) adds two points that weigh on the firm: Article 20(1-ter) presumes that use of the signature device is attributable to the holder, unless proven otherwise; Article 32 requires the holder to safeguard the device and to use it personally.
In other words: if the PIN circulates among the office staff, a signature applied by someone else is in the first instance attributed to the professional, and proving otherwise is difficult precisely because the credentials were shared.
Where it breaks down in practice
- The professional dictates the PIN and OTP to the office staff over the phone to complete a filing that is about to fall due.
- The OTP app is installed on a member of staff’s phone, or the TOTP seed is saved in a shared password manager.
- The PIN stays stored in the browser or in the signing software on a PC used by several people.
- The OTP arrives by SMS on a company SIM that changes hands, which is also exposed to fraudulent SIM swapping.
In all these cases, unauthorised access to that PC or that mailbox, perhaps obtained through session theft on email, becomes the ability to sign documents in the holder’s name.
The minimum rules
OTP generated on the holder’s personal device, with a screen lock and no plain-text backup of the seed. PIN never stored or disclosed. Delegated activities go through tools that leave a trace: the member of staff signs with their own certificate where the rules allow it, or prepares the document and the holder signs. For high volumes there are automated signature arrangements, which must be activated with the provider as an explicit choice and not simulated by sharing credentials.
If the phone is lost or a compromise is suspected, suspension of the certificate should be requested from the provider immediately; the provider can also supply the log of signing operations. In a dispute that log is digital evidence to be acquired methodically, and it can form the basis of a digital forensic expert report.
