Supporting France Identité

Digital identity requires several kinds of evidence

France Identité brings together mobile application security, electronic identification requirements and European recognition. Stelau supported Agence France Titres across three complementary processes: CSPN application certification, certification of the electronic identification means at the high assurance level, and the European peer review.

The work connects the actual protection mechanisms to assessment requirements, then makes that demonstration clear and verifiable.

Preparing the application assessment

Our contribution combines security targets and cryptographic specifications with an analysis of sensitive flows: authentication, user data handling and server communications.

Audits and penetration tests inform hardening recommendations. The areas examined include communication protection, encrypted storage and device security mechanisms. Exchanges with the CESTI security evaluation centre support the formal assessment process.

Documenting high assurance

• Mapping critical functions and eIDAS requirements.
• Demonstrating authentication mechanisms and their reliability.
• Preparing technical and organisational documentation.
• Supporting the ISMS and its alignment with ISO/IEC 27001.

Preparing the European review

The peer review subjects the French implementation to a shared examination with other Member States. We help prepare assessment checkpoints, formalise evidence, analyse interoperability and support exchanges with the review working groups.

Results and ongoing work

The iOS and Android applications obtained CSPN certification and elementary qualification. The electronic identification means was certified at the high assurance level, with a positive European review.

Ongoing work addresses maintaining security, extending features and preparing for evolving European digital identity journeys. Certification is a milestone; teams must then maintain their evidence and adapt protections as the system evolves.