Facilitating Cross Border Trade and Commerce through Mutual Recognition of Digital Signatures/Certifying Authorities

Controller of Certifying Authorities(CCA)

Ministry of Communications & Information Technology,

Government of India

Website:cca.gov.in,E-mail:info@cca.gov.in

Digital Signature Usage in AFACT member countries

Many of the AFACT members like Japan,S. Korea,India,Chinese Taipei have already implemented Electronic Signature Act/IT Act ,modelled on UNCITRAL's Model Law, providing legal validity to documents signed digitally , at par with paper signature.

The use of Digital Signatures is already widespread in many AFACT member countries and is increasing further due to presence of strong,secure and robust PKI environments

Why Digital Signatures?For using Internet as a safe and secure medium for e-Commerce and e-GovernanceMost countries have given Legal Validity to Documents signed digitally.Electronic documents are convenient for copying,transmission,storage.Reduces dependence paper based documents , hence environment friendly.Digital Signatures provide Authenticity(assurance of the genuineness of the source/signer), Integrity(assurance that document hasn't been changed after signing) and Non-repudiation(the signer cannot later deny signing the document ) to electronic documents.

Current Scenario : Public Key Infrastructure (PKI)

Digitally signed documents are signed using a Private Key and verified using corresponding Public Key.Some Trusted Agency is required which certifies the association of an individual with the key pair. Such trusted agencies are called “Certifying Authorities”(CA).Most countries issue licenses to

agencies which operate as CAs.Documents signed using Digital Signature Certificates

issues by such recognized Certifying Authorities are legally equivalent to documents signed manually in

most countries. However, a CA which is legally recognized in country “X” may not be legally recognized in country “Y”

Click for certificate generation demo

Limiting Recognition of Certifying Authorities creates few inconveniences

Mr “Good-Trader” in a country “Utopia” has a Digital Signature Certificate issued by “SecureCA”,a recognized Certifying Authority in “Utopia” and wants to sign a document and send it to Mr “Good-Customer” in another country “Heaven”.

However, “SecureCA” is not a recognized Certifying Authority “Heaven”, and hence the digitally signed document lacks legal validity in “Heaven” . To increase Mr. Good-Trader's traders problems , no recognized Certifying Authority of “Heaven” is having local presence in “Utopia”

A possible SolutionThe two countries “Utopia” and “Heaven” can have an arrangement through which Recognized , Licensed Certifying Authorities in both the countries are mutually recognized and Digital Signatures Certificates issued by them are accepted

The Controller of Certifying Authorities(India), which is the regulator and facilitator of PKI Environment in India , is in process of notifying regulations for recognition of Foreign Certifying Authorities.Many countries have already established arrangements for such mutual recognition.

It is proposed, to have two sets of Regulations.

• One for recognized Foreign Certifying Authorities operating under a Regulatory Authority comparable to that in India.

• Other set of Regulations for those Foreign Certifying Authorities , which are not operating under a Regulatory Authority.

For Foreign Certifying Authorities operating under a Regulatory

Authority

It is proposed that a Digital Signature Certificates issued by a Foreign Certifying Authority ,which has been authorized to issue Digital Signature Certificates by legally recognized regulatory authority of its country , will be recognized in India, if the Controller of Certifying Authorities enters into a memorandum of understanding with the recognized foreign regulatory authority.

Before entering into a Memorandum of Understanding , the Controller will ensure that the laws of the country under which such regulatory authority is established , require a level of reliability at least equivalent to that required for issue of a Digital Signature Certificate under the IT Act of India ,2000.

Foreign Certifying Authorities not operating under any Regulatory Authority

Many countries do not have PKI Regulators like India. Such Certifying Authorities may also apply for recognition (after regulations in this regard are published) , if the Controller is satisfied about their reliability , security and fulfillment other conditions

We look forward to enter in MoUs with PKI Regulators from various countries for mutual recognition of Certifying Authorities.The details of Regulations in this regard will be available soon.

Path Ahead

1. The Indian Regulations in this regard are to be published soon.(these will be available at cca.gov.in)

2. PKI Regulators need to work together to establish mutually acceptable Inter-operability Guidelines,security and audit criteria. However,in case countries whose IT Act/Electronic Signature Act is based on Model UNCITRAL Laws have some commonalities which will help in evolving such Guidelines.

3. MoUs for mutual recognition.

Thank You!!!cca.gov.in