Commission Implementing Regulation (EU) 2016/799 of 18 March 2016 implementing Regulation (EU) No 165/2014 of the European Parliament and of the Council laying down the requirements for the construction, testing, installation, operation and repair of tachographs and their components (Text with EEA relevance) (c. 799)

ANNEX I C U.K. Requirements for construction, testing, installation, and inspection

Appendix 11

COMMON SECURITY MECHANISMS U.K.

PART B U.K. SECOND-GENERATION TACHOGRAPH SYSTEM

11. VU — EXTERNAL GNSS FACILITY COUPLING, MUTUAL AUTHENTICATION AND SECURE MESSAGING U.K.

11.3. Mutual Certificate Chain Verification U.K.

11.3.2 During VU — EGF Coupling U.K.

CSM_206 During the coupling to an EGF, a vehicle unit shall use the protocol depicted in Figure 4 (section 10.2.1) for verifying the external GNSS facility's certificate chain. U.K.

Notes to Figure 4 within this context: U.K.

— Communication control is out of the scope of this Appendix. However, an EGF is not a smart card and hence the VU will probably not send a Reset to initiate the communication and will not receive an ATR. U.K.

— The Card certificates and public keys mentioned in the figure shall be interpreted as the EGF's certificates and public keys for mutual authentication. Section 9.1.6 denotes these as EGF_MA. U.K.

— The Card.CA certificates and public keys mentioned in the figure shall be interpreted as the MSCA's certificates and public keys for signing EGF certificates. Section 9.1.3 denotes these as MSCA_VU-EGF. U.K.

— The Card.CA.EUR certificate mentioned in the figure shall be interpreted as the European root certificate that is indicated in the CAR of the MSCA_VU-EGF certificate. U.K.

— The Card.Link certificate mentioned in the figure shall be interpreted as the EGF's link certificate, if present. As specified in section 9.1.2, this is a link certificate for a new European root key pair created by the ERCA and signed by the previous European private key. U.K.

— The Card.Link.EUR certificate is the European root certificate that is indicated in the CAR of the Card.Link certificate. U.K.

— Instead of the , the VU shall read the from EF ICC. U.K.

— Instead of selecting the Tachograph AID, the VU shall select the EGF AID. U.K.

— ‘Ignore Card’ shall be interpreted as ‘Ignore EGF’. U.K.