Digital signature and security with efsta

The digital signature within the framework of the Austrian Cash Register Security Ordinance (RKSV) is a central element for ensuring the tamper-proof nature of cash registers. It serves to record and document every transaction in a cash register in a way that prevents forgery.

It is an electronic signature based on cryptographic methods. It ensures that the contents of a document, such as a receipt or transaction, are unchanged and authentic. Under the RKSV, each cash register transaction is provided with a unique digital signature that cannot be subsequently altered.

The process of digital signing in an Austrian POS system works as follows:

• POS transaction: As soon as a business transaction (e.g. a sale) is completed via the POS system, the cash register creates a transaction data structure. This contains all the relevant information of the transaction, such as the amount, the time and a consecutive transaction number.
• Creation of the signature value: Before the transaction data is stored in the POS system, a signature value is formed. For this purpose, a hash value (a kind of cryptographic checksum) is calculated over the data of the transaction. This hash value represents a unique representation of the transaction.
• Signing with a private key: The hash value of the transaction is signed with a private key. This private key belongs to a certificate that is uniquely assigned to the cash register and was issued by an accredited certification authority. The digital signature is generated by encrypting the hash value with the private key.
• Verifiability with public key: The signed transaction data is stored together with the digital signature. During a later audit, the validity of the digital signature can be verified with the corresponding public key (which is contained in the certificate). This ensures that the data has not been changed since it was signed.

Chaining of receipts

Each receipt contains a signature that is linked to the previous transaction. This creates a chain (chain of signatures) that makes manipulations immediately recognisable. If a transaction were to be changed subsequently, this chain would be broken, which would make the manipulation visible.

The digital signatures are based on certificates issued by a nationally recognised certification authority. Each company must apply for such a certificate for its cash registers. These certificates:

• Identify the company and the associated cash register.
• Include the public key that can be used to verify the signatures.
• Must be renewed regularly in accordance with legal requirements.