Digital signature and security with efsta

The digital signature as part of the Cash Register Security Ordinance (RKSV) in Austria is a key element in ensuring that cash registers are tamper-proof. It is used to record and document every transaction in a cash register in a tamper-proof manner.

It is an electronic signature based on cryptographic procedures. It ensures that the contents of a document such as a receipt or a transaction are unchanged and authentic. As part of the RKSV, each cash register transaction is provided with a unique digital signature that cannot be subsequently changed.

The process of digital signing in an Austrian POS system works as follows:

Cash register transaction: As soon as a business transaction (e.g. a sale) is completed via the cash register, the cash register creates a transaction data structure. This contains all relevant information about the transaction, such as the amount, the time and a consecutive transaction number.
Creation of the signature value: Before the transaction data is saved in the cash register, a signature value is created. For this purpose, a hash value (a type of cryptographic checksum) is calculated over the transaction data. This hash value is a unique representation of the transaction.
Signing with a private key: The hash value of the transaction is signed with a private key. This private key belongs to a certificate that is uniquely assigned to the cash register and has been issued by a recognized certification authority. The digital signature is generated by encrypting the hash value with the private key.
Verifiability with public key: The signed transaction data is stored together with the digital signature. During a subsequent check, the validity of the digital signature can be verified using the associated public key (which is included in the certificate). This ensures that the data has not been changed since it was signed.

Every cash register must have a signature creation unit (SEE) that handles the digital signing process. This unit works either as a:

Hardware component

z. e.g. in the form of a signature module in the cash register or as a smartcard

Cloud-based solution

the one that offers signature services over the Internet

Software-based solutions

The signature creation device ensures that every transaction is signed securely and forgery-proof.

Linking the documents

Each receipt contains a signature that is linked to the previous transaction. This creates a concatenation (chain of signatures) that makes manipulations immediately recognizable. If a transaction were subsequently changed, this chain would be interrupted, making the manipulation visible.

The digital signatures are based on certificates issued by a state-recognized certification authority. Every company must apply for such a certificate for its cash registers. These certificates:

Identify the company and the associated cash register.
Contain the public key with which the signatures can be verified.
Must be renewed regularly in accordance with legal requirements.