QSCD | Giesecke+Devrient Mobile Security GmbH | STARCOS 3.6 QES C1

Certificate SRC.00025.TE.06.2016 Certificate SRC.00025.TE.06.2016 // Addendum 1 Attestation SRC.00025.TE.06.2016 Attestation SRC.00025.TE.06.2016 // Addendum 1

Type of Certification	QSCD \| Certification of Qualified Signature and Seal Creation Devices
SRC Certificate Registration Number	SRC.00025.TE.06.2016
Valid from	June 8, 2016
Valid until	December 31, 2022
Certificate Holder	Giesecke+Devrient Mobile Security GmbH
Certified Product	STARCOS 3.6 QES C1
Testing Method	In accordance with the requirements of the SigG and SigV, the attestation was issued based on a Common Criteria evaluation according to the Protection Profiles “Protection profiles for secure signature creation device, Part 2: Device with key generation” and “Protection profiles for secure signature creation device, Part 4: Extension for device with key generation and trusted communication with certificate generation application”. The evaluation was carried out with evaluation assurance level EAL 4+ and against a high attack potential (augmentation AVA_VAN.5).
The audit includes	the Common Criteria evaluation of the product “STARCOS 3.6 QES C1” according to the following Protection Profiles with evaluation assurance level EAL 4+ (EAL 4 with augmentation AVA_VAN.5): “Protection profiles for secure signature creation device, Part 2: Device with key generation” “Protection profiles for secure signature creation device, Part 4: Extension for device with key generation and trusted communication with certificate generation application” the attestation of the product according to §§ 15 para. 7 sentence 1, 17 para. 1 Signature Act (SigG) as well as §§ 15 para. 1 and 4, 11 para. 3 Signature Ordinance (SigV) by the SRC attestation body accredited by the Federal Network Agency and an addendum to extend the attestation (addition of manufacturer details). Due to the transitional measures according to Regulation (EU) No. 910/2014, Article 51, para. 1, the product is considered a QSCD according to the said regulation.
Description	The product “STARCOS 3.6 QES C1” is a secure signature creation device (SSCD) according to SigG and SigV. The card is a dual interface card, meaning it has both a contact-based and a contactless interface. The product consists, among other things, of the semiconductor (IC) M7893 B11 from Infineon, the STARCOS 3.6 COS C1 card operating system, and an application for generating qualified signatures. The product is a health professional card for German healthcare telematics, meaning that in addition to the dedicated application for generating qualified electronic signatures, other applications are located on the card according to the requirements of Gematik for the health professional card’s file system. SRC certifies that the product “STARCOS 3.6 QES C1” from Giesecke+Devrient Mobile Security GmbH meets the requirements according to § 17 para. 1 and 3 no. 1 SigG as well as § 15 para. 1 and 4, Annex 1, I, 1.1 to 1.3 SigV. Due to the transitional measures according to Regulation (EU) No. 910/2014, Article 51, para. 1, the product is considered a QSCD according to the said regulation.