Frequently Asked Questions

A Scheme Operator is an organization accredited by VDSIC to manage and oversee the VDS trust environment within a specific scope. TSO OTENTIK is the first accredited Scheme Operator, responsible for managing trusted service providers, maintaining trust lists, and ensuring compliance with international standards.

TSO OTENTIK operates under the governance of VDSIC (Visible Digital Seal International Council). VDSIC provides the overarching framework and standards, while TSO OTENTIK implements and manages the operational aspects of the trust environment, including provider onboarding, compliance monitoring, and trust list management.

TSO OTENTIK implements comprehensive security measures including cryptographic key management via Hardware Security Modules (HSMs), regular security audits, compliance with ISO 27001, and continuous monitoring of all trust environment components.

TSO OTENTIK maintains and publishes trust lists that contain the certificates of all authorized entities in the ecosystem. These lists are regularly updated to reflect new additions, revocations, and status changes, ensuring that verifiers always have access to current trust information.

TSO OTENTIK complies with ISO 22376 (VDS trust environment), ISO 22385 (VDS technical specification), ISO 27001 (information security management), and ETSI TS 119 612 (trust lists). We also follow the governance requirements set by VDSIC.

Compliance is verified through regular internal audits, third-party assessments, and VDSIC oversight. All service providers in the ecosystem undergo initial and periodic compliance evaluations to ensure adherence to applicable standards and requirements.

A Practice Statement is a public document that describes the operational practices and policies of a Scheme Operator. TSO OTENTIK's Practice Statement details our procedures for managing trust lists, onboarding service providers, handling security incidents, and maintaining compliance.

To become a Scheme Operator, an organization must apply to VDSIC and demonstrate its capability to manage a VDS trust environment. This includes meeting governance, security, operational, and technical requirements as defined by VDSIC's accreditation framework.

A Certificate Authority (CA), also known as a Trust Service Provider (TSP), issues digital certificates to VDS issuers. These certificates are used to create cryptographic signatures on VDS seals, enabling verifiers to confirm the authenticity and identity of the seal issuer.

UsageList validation is a critical process where the CA must technically verify that an Issuer is authorized to use a specific Manifest UUID before issuing a certificate. This ensures that only authorized entities can create seals for specific use cases.

CAs must comply with ETSI standards for trust services, maintain robust key management practices, implement strict identity verification procedures, and participate in the trust list infrastructure maintained by TSO OTENTIK.

CAs must submit an application to TSO OTENTIK, demonstrate compliance with applicable standards (ETSI, ISO), undergo a technical and operational assessment, and sign the appropriate agreements. Once approved, their certificates are added to the trust list.

CAs are responsible for the entire lifecycle of certificates: issuance, renewal, suspension, and revocation. They must maintain accurate records, respond to revocation requests promptly, and ensure that their certificate practices align with TSO OTENTIK's requirements.

After a CA is approved and onboarded, TSO OTENTIK adds their root and intermediate certificates to the published trust lists. These lists are regularly updated and made available to verifiers for seal validation.

A VDS Issuer is an organization authorized to create Visible Digital Seals for specific use cases. Issuers obtain certificates from approved CAs and use them to sign VDS data packages, which are then rendered as 2D barcodes on documents or objects.

An Issuer must be authorized for specific Manifest UUIDs, obtain a certificate from an approved CA, and register with the Scheme Operator. The authorization process ensures that only legitimate entities can create seals for specific document types.

The Issuer contacts an approved CA, provides the necessary identity documentation and proof of authorization for the requested Manifest UUIDs. The CA verifies this information and issues a certificate that the Issuer uses to sign VDS seals.

Issuers are responsible for ensuring the accuracy and completeness of the data included in each VDS seal. They must implement quality control processes and maintain records of all seals issued for audit purposes.

Yes, an Issuer can be authorized for multiple Manifest UUIDs, allowing them to create seals for different use cases. Each authorization is independently verified by the CA.

If an Issuer's certificate is revoked, all new seals created with that certificate will fail verification. Previously issued seals may still be verifiable depending on the revocation policy. The CA and Scheme Operator coordinate to update trust lists accordingly.

A VDS Verifier (also called a Relying Party) is any entity that validates VDS seals. Verifiers use the trust lists and certificates published by TSO OTENTIK to confirm the authenticity, integrity, and legitimacy of a VDS seal.

The verifier scans the 2D barcode, decodes the data package, checks the cryptographic signature against the issuer's certificate, validates the certificate against the trust list, and confirms that the Manifest UUID is authorized. If all checks pass, the seal is verified.

Trust lists are published by TSO OTENTIK and can be downloaded for local caching. Verifiers should regularly update their cached copies to ensure they have the latest information about authorized CAs and issuers.

Yes, VDS can be verified offline using locally cached trust lists and certificates. The verifier only needs to have previously downloaded the relevant trust information. This makes VDS ideal for environments with limited or no internet connectivity.

When verification fails, the verifier should check the specific error (expired certificate, revoked certificate, tampered data, unknown issuer). Depending on the context, they may reject the document, request a new copy, or contact the issuer for clarification.

A successful verification confirms three things: the data has not been tampered with (integrity), the issuer's identity is confirmed (authenticity), and the issuer is authorized for this type of seal (legitimacy). Verifiers should evaluate all three aspects when making decisions.

Verifiers should be prepared to read multiple barcode formats including DataMatrix, QR Code, and Aztec Code. The specific format used depends on the Manifest definition for each use case.

A VDS Solution Provider is a company that develops and sells software or hardware solutions for the VDS ecosystem. This includes tools for seal generation, verification, trust list management, and certificate handling.

Solution Providers can support multiple roles: CA/TSP operations (certificate management), Issuer operations (seal generation), Verifier operations (seal validation), and Scheme Operator operations (trust list management).

Solutions must comply with ISO 22376, ISO 22385, ETSI TS 119 612 (for trust lists), and X.509 (for certificates). Additionally, solutions should follow the Manifest specifications defined for each use case.

Solution Providers can apply to be listed in our provider directory by demonstrating that their solutions meet TSO OTENTIK's technical requirements. This involves a technical assessment and compliance review.

VDS implementations typically use ECDSA or RSA for digital signatures, with specific key lengths as defined in the relevant standards. The exact requirements depend on the Manifest specification and security level required.

Yes, solutions can be designed to work with multiple Scheme Operators. The key requirement is that they correctly handle trust list management and certificate validation for each operator's ecosystem.

TSO OTENTIK provides interoperability testing facilities and can certify that solutions meet the required standards. Contact us for information about testing schedules and certification processes.

Solutions should implement automated trust list downloading and caching mechanisms. They should check for updates at regular intervals and handle both incremental and full trust list updates efficiently.

Start by contacting us through our website or email. We will guide you through the appropriate onboarding process based on your role (CA, Issuer, Verifier, or Solution Provider) and provide the necessary documentation and technical specifications.

A Manifest UUID is a unique identifier for a specific VDS use case definition. Manifests define the data structure, encoding rules, and validation requirements for a particular type of seal. Contact TSO OTENTIK to request or register a new Manifest UUID.

TSO OTENTIK facilitates coordination between solution providers and other ecosystem participants. We maintain technical documentation, host interoperability events, and provide communication channels for technical discussions.

We offer several partnership levels: technology partner (solution integration), service partner (implementation and support), and strategic partner (joint market development). Each level has specific requirements and benefits.

TSO OTENTIK provides comprehensive technical documentation including API specifications, trust list formats, Manifest templates, and integration guides. Access to detailed documentation is provided during the onboarding process.

The onboarding timeline varies by role and complexity. Typical timelines range from 2-4 weeks for verifiers to 2-3 months for CAs. We work with each organization to ensure a smooth and efficient process.

Yes, TSO OTENTIK provides a sandbox environment for testing and development. This allows organizations to test their integrations in a controlled environment before moving to production.

TSO OTENTIK provides technical support throughout the integration process, including documentation, email support, and scheduled consultation calls. We also offer training sessions for teams new to the VDS ecosystem.