eID Client

PersoApp provides a proprietary eID client and an Open Source Software Library for using, integrating and further developing the electronic identification function of the new German national ID card. The foundation of the Open Source Software Library is the proprietary eID client of AGETO Service GmbH. This client is a secure and reliable application and is already in practical use. In the case of PersoApp, the eID client serves as a demonstrator to show the mode of operation of eID client software for the electronic identification function. The Open Source Community can use it together with the PersoApp test and demo service for demo and test purposes. This test and demo service is available within the current reference publickey infrastructure for the electronic identification function. Both the proprietary eID client and the Open Source Software Library will be available as a Java 1.6 implementation.

Features

The Open Source Software Library and the proprietary eID client offer the following basic features:

  • New German national ID card online authentication for the owner with regard to a service provider, e.g. online shop, via an Internet connection
  • Presenting a service provider’s authorization certificate to an owner of a new German national ID card
  • Data reading and transmitting (including personal data stored on the new German national ID card) according to the specification of a service provider’s corresponding authorization certificate

General Security Requirements

The security requirements for an eID client and the Open Source Software Library of PersoApp refer to the technical guidelines (TR) of the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik – BSI):

  • BSI-TR-03112: eCard API Framework
  • BSI-TR-03127: Architecture electronic Identity Card and electronic Resident Permit (informative translation)
  • BSI-TR-03128: EAC-PKI for the electronic Identity Card
  • BSI-TR-03130: eID-Server

The PersoApp guidelines support compliance of an eID client with these technical guidelines. They refer to the establishment and development of security architecture and the secure integration of Open Source Software Components into an (existing) IT system.

Licenses

Modules of the PersoApp Open Source Software Library are available under GNU Lesser General Public License (LGPL) v3. PersoApp documentation is available according to Creative Commons Attribution-ShareAlike 3.0 Unported.

Quality Assurance

The realization of functional and non-functional requirements for the Open Source Software Library and their integration in eID clients and applications is supported by the following three measures:

  • Definition and classification of quality criteria
  • Development of indirect and direct measurement indicators for a quantitative software quality assessment
  • Specification of processes and methods for assessing enforcement of quality criteria

TU Darmstadt/CASED regularly conducts polls within the Community and associated partners to identify requirements regarding software functionality, usability, and security of the new German national ID card’s electronic identification function. Security engineering methods and mechanisms support the enforcement of these requirements. Fraunhofer SIT offers guidelines for establishing and documenting a security architecture and the secure integration of Open Source Software Library into (existing) IT systems. For instance, regular code reviews should support the code quality. A peer review supports quality assurance of design/architecture. The PersoApp consortium provides a BSI TR compliant demo and test service free of charge to the PersoApp Community for the complete project duration. This enables the Community to test their own software during their development phases. Documentation is understood as an important part of the Open Source Software Library and its integration. Documentation development is linked to software development by organizational and technical means. In order to ensure documentation completeness and actuality, involved Community members will be immediately informed about changes in software by an automatic ticketing system.

Releases

Five major releases with updates of the Open Source Software Library are planned over the duration of this project. After the consortium has published the basic release, the Community can submit patches and feature requests. The consortium strives for a six-month interval between releases. This period is divided into two parts: a five-moth period for submitting patches and feature requests; a one-month period for testing. A feature freeze marks the start of a testing period. From this time on new features will not be taken into consideration for the next major release. Every six months a new major release will be available, which will have undergone a full review. This regularity of releases and their reviews support compliance with the general security requirements for the PersoApp Open Source Software Library of the new German national ID card’s electronic identification function.