Open the signing request
Someone sends you a PDF to sign, or you create a request yourself on the signing page. Scan the QR code (or open the e-mailed link) with CodeB Wallet.
CodeB Wallet · NFC · eID card
Your national eID card: sign PDFs and sign in
A government-issued eID card holds two keys: one for signatures and one for authentication. CodeB Wallet reads the card over NFC, so you can sign PDFs with it and sign in to websites, with the card’s PIN and the card’s own certificates.
In short: To sign a PDF, scan the signing request with CodeB Wallet, hold the eID card to the phone and enter the PIN; the server finishes a PAdES signature with time stamp and validation data. To sign in, choose the eID card on the sign-in page, scan the QR code, hold the card and enter its PIN. The signature is qualified only when the card’s certificate is a qualified certificate.
PAdES (ETSI EN 319 142) · B-T · B-LT · B-LTA · RFC 3161 time stamps · OCSP / CRL · OpenID Connect · NFC
Closed beta, in testing. Not certified.
In short
- What
- Two uses of a government-issued eID card in CodeB Wallet: signing PDFs with the card’s signing key, and signing in to websites with its authentication key.
- You need
- An Android phone with NFC and CodeB Wallet, the eID card, its card access number (printed on the card) and its PINs.
- PDF signature
- PAdES. The server builds the signature around the card’s signature and adds a time stamp and validation data as far as they can be had (up to B-LTA). The PDF stays on the server.
- Qualified?
- Only when the card’s signing certificate is a qualified certificate. The software adds no qualification of its own.
- Sign-in
- OpenID Connect sign-in with acr
urn:codeb:acr:eidcard. The card certificate must chain to an issuing CA installed on this server and must not be revoked. - Shared at sign-in
- Your given and family name from the card certificate. The national ID number is not passed on to websites; no PIN, no key.
Sign a PDF with your eID card
The card signs, the server builds the PDF signature.
Hold the card to the phone
CodeB Wallet opens the card with its card access number and reads the signing certificate. The server prepares the PDF signature and sends the phone only a 32-byte hash.
Enter the card PIN
The card signs the hash with its signing key inside the chip. The PIN and the key never leave the card.
The server finishes and checks
The server embeds the signature and adds a time stamp, the certificate’s validation data and a document time stamp as far as they can be had (PAdES B-T, B-LT, B-LTA). It checks the signed PDF before the next signer gets their turn.
Sign in to a website with your eID card
One challenge, one signature, signed in.
Choose the eID card on the sign-in page
On the sign-in page of this site (or of a website that signs in through it), choose the eID card. The page shows a QR code; on the phone itself, a button opens the app.
Scan with CodeB Wallet
The app fetches a one-time challenge for exactly this sign-in.
Hold the card and enter its PIN
The card’s authentication key signs the challenge together with the website address, the session and the time, so the signature cannot be used anywhere else.
You are signed in
The server checks the signature, that the card certificate chains to the issuing CA certificates installed on this server and that it is not revoked (OCSP or CRL). The browser continues signed in.
First sign-in
- The first sign-in with a card that is not linked opens a guest account for that card.
- Your given name and family name come from the card certificate.
Link the card to your account
- Sign in to your own account, then open the eID card page with link within 10 minutes and read the card.
- Confirm in the browser that the name shown from the card is yours; from then on the card signs you in to your own account.
- A card belongs to one account only.
Security and privacy
The PDF stays on the server
Only a 32-byte hash travels to the phone and only the card’s signature comes back. The document is never sent to the phone for card signing.
PIN and keys stay on the card
The card signs inside its chip after you enter the PIN. Neither the PIN nor a key ever reaches this site or the app’s storage.
Bound sessions
A card signature session lives 5 minutes and belongs to your account and to the app’s key. A sign-in challenge lives 2 minutes and names the website, the session and the time.
Checked, fail closed
Sign-in checks the chain to the installed issuing CAs and the revocation status; if OCSP and CRL cannot be reached, the sign-in is refused rather than allowed.
Signed result checked
Every signed PDF is validated before the request moves on: one valid signature over exactly the document, no hidden changes.
No tracking
No third-party scripts, no analytics. Only identifiers and outcomes are logged, never document content.
Frequently asked questions
Is a PDF signed with my eID card a qualified electronic signature?
Only if the signing certificate on your card is a qualified certificate (most national eID cards with a signature function have one). The server checks the certificate; for a request that asks for a qualified signature, a card certificate that does not state one is refused. CodeB itself is not a qualified trust service provider and adds no qualification.
Why does the server finish the signature?
An eID card can sign a hash but cannot build a PDF signature. The server prepares the PDF signature, the card signs only its hash, and the server embeds the card’s signature. The PDF stays on the server.
Which PAdES level do I get?
As high as the time-stamp and validation services allow: B-T with a signature time stamp, B-LT with OCSP responses or CRLs, B-LTA with a document time stamp. The result says which level was reached and why a higher one was not.
Which eID cards work?
Government-issued eID cards that CodeB Wallet can read over NFC and whose certificates chain to issuing CA certificates installed on this server; this site is set up for the Maltese eID card. The card certificate must also pass the revocation check (OCSP or CRL).
What does a website learn when I sign in with the card?
Your given name and family name from the card certificate and a pseudonymous account identifier. The national ID number is not put into ID tokens or userinfo, the PIN never leaves the card, and the site claims no level of assurance for this sign-in.
Can I use the eID card instead of a password for my account?
Yes. Link the card to your account once: sign in, open the eID card page with link=1 within 10 minutes, read the card and confirm in the browser that the name from the card is yours. After that the card signs you in to that account.
Can several people sign the same PDF?
Yes. A signing request can invite people by e-mail to sign one after another; each signer can use an eID card, another signature card or the signing service.
Is this certified?
No. The PDF signatures follow PAdES (ETSI EN 319 142) and the sign-in uses OpenID Connect, but the software is not certified.
Related
Sign PDFs with CodeB Wallet →
Signing requests by QR code, several signers, e-mail invitations.
Sign in with the eID card →
The sign-in page with the QR code.
card-prepare / card-finish API →
How the server finishes the PAdES signature, for developers.
eID card sign-in API →
eidcard-start, -challenge, -response and -poll.
eID card signing or sign-in for your service?
Write to us about eID card signatures, sign-in with eID cards and signing requests. Testers for CodeB Wallet are welcome too.