Thông tư 22/2020/TT-BTTTT quy định về yêu cầu kỹ thuật đối với phần mềm ký số, phần mềm kiểm tra chữ ký số do Bộ Thông tin và Truyền thông ban hành

CIRCULAR

TECHNICAL REQUIREMENTS APPLICABLE TO DIGITAL SIGNATURE SOFTWARE AND DIGITAL SIGNATURE CHECKING SOFTWARE

Pursuant to the Law on E-Transactions dated November 29, 2005;

Pursuant to the Government’s Decree No. 130/2018/ND-CP dated September 27, 2018 on guidelines for the Law on E-Transactions regarding digital signatures and digital signature authentication;

Pursuant to the Government’s Decree No. 17/2017/ND-CP dated February 17, 2017 defining the functions, tasks, powers and organizational structure of the Ministry of Information and Communications;

At the request of the Director of the National Electronic Authentication Centre,

The Minister of Information and Communications hereby promulgates a Circular on technical requirements applicable to digital signature software and digital signature checking software.

Chapter I

GENERAL

Article 1. Scope

1. This Circular provides for technical requirements applicable to digital signature software and digital signature checking software.

2. Technical requirements applicable to digital signature software and digital signature checking software for digital signatures on electronic documents of regulatory agencies are not governed by this Circular.

Article 2. Regulated entities

1. This Circular applies to organizations and individuals that opt to use digital signature software and digital signature checking software to make e-transactions; certification authorities; organizations and individuals that develop digital signature applications and use digital signatures.

2. This Circular does not apply to specialized certification authorities of the Government.

Article 3. Definitions

1. “digital certificate for organization” means a form of electronic certificate issued by a certification authority in order to provide identity for the public key of an organization to certify that such organization is the signer of the digital signature by using corresponding private key.

2. “digital certificate for individual” means a form of electronic certificate issued by a certification authority in order to provide identity for the public key of an individual to certify that such individual is the signer of the digital signature by using corresponding private key.

3. “private key for organization” means a key corresponding to the digital certificate for an organization.

4. “private key for individual” means a key corresponding to the digital certificate for an individual.

5. “digital signature software” means independent software or a software module or a solution that performs the function of attaching digital signatures to data messages.

6. “digital signature checking software” means independent software or a software module or a solution that performs the function of checking validity of digital signatures attached to digital signature data messages.

7. “trusted path on a digital certificate” means a web address on a digital certificate showing the certification authority which issued that digital certificate.

Chapter II

TECHNICAL REQUIREMENTS APPLICABLE TO DIGITAL SIGNATURE SOFTWARE AND DIGITAL SIGNATURE CHECKING SOFTWARE

Section 1- Digital signature software

Article 4. General requirements

Technical standards for digital signatures attached to data messages in the List of technical standards for digital signatures attached to data messages promulgated together with this Circular shall be complied with.

Article 5. Functional requirements

1. Attaching digital signatures:

a) If the singer of digital messages attached to data messages is an individual, such signer is allowed to use the individual private key to attach digital signatures to data messages;

b) If the singer of digital messages attached to data messages is an organization, such signer is allowed to use the private key for organization to attach digital signatures to data messages.

2. Checking validity of digital certificates:

a) Digital certificates of persons attaching digital signatures to data messages are checked via the trusted path on such digital certificates and also checked by the national certification authority.

b) The checking of validity of a digital certificate at the digital signature time shall focus on:

- Validity period of the digital certificate;

- Status of the digital certificate through the Certificate Revocation List (CRL) published at the digital signature time or through the Online Certificate Status Protocol (OCSP) in the case where the certification authority provides OCSP services.

- Cryptographic algorithms used on the digital certificate;

- Purposes and scope of the digital certificate.

c) The digital certificate remains valid if the following criteria are met:

- The validity period on the digital certificate remains unexpired at the digital signature time;

- Cryptographic algorithms used on the digital certificate comply with compulsorily applied technical regulations and standards for digital signatures and digital signature authentication which remain effective;

- The digital certificate remains operational at the digital signature time;

- The digital certificate is used for intended purposes and within the intended scope.

3. Storage and cancellation of the following pieces of information attached to digital signature data messages:

a) Digital certificates corresponding to private keys which signers use to sign data messages at the digital signature time;

b) List of certification authorities’ digital certificates revoked at the signature time that correspond to digital signatures attached to outgoing data messages;

c) Validation etiquettes of certification authorities issuing digital certificates that correspond to the digital signatures attached to outgoing data messages;

d) Results of checking of status of the digital certificates corresponding to the digital signatures attached to incoming data messages.

4. Change (addition or reduction) of digital signatures of certification authorities.

5. Notification (in alphabetical letters/symbols) of checking whether a digital signature is valid or not.

Section 2-Digital signature checking software

Article 6. General requirements

Technical standards for digital signatures attached to data messages in the List of technical standards for digital signatures attached to data messages promulgated together with this Circular shall be complied with.

Article 7. Functional requirements

1. Checking of validity of digital signatures affixed to data messages:

a) Digital signatures affixed to data messages are verified according to the principle: a digital signature is generated from a private key corresponding to the public key on the digital certificate;

b) Digital certificates of persons attaching digital signatures to data messages are checked via the trusted path on such digital certificates and also checked by the national certification authority.

c) Information about persons attaching digital signatures to data messages are checked and verified focusing on the following:

- Validity period of the digital certificates;

- Status of the digital certificates through the Certificate Revocation List (CRL) published at the time of attaching the digital signature or through the Online Certificate Status Protocol (OCSP) in the case where the certification authority provides OCSP services.

- Cryptographic algorithms used on the digital certificates;

- Purpose and scope of the digital certificates.

d) A digital certificate remains valid if the following criteria are met:

 - The validity period on the digital certificate remains unexpired at the digital signature time;

- Cryptographic algorithms used on the digital certificate comply with compulsorily applied technical regulations and standards for digital signatures and digital signature authentication which remain effective;

- The digital certificate remains operational at the digital signature time;

- The digital certificate is used for intended purposes and within the intended scope.

dd) Integrity of digital signature data messages is checked as follows:

- Decrypt the digital signature on each data message to obtain information about the hash value;

- Use the secure hash algorithm that generated the hash value on the digital signature to generate a hash value for the data message;

- Compare the two hash values to check if whether they match, thereby checking the integrity of the digital signature data message.

e) A digital signature on the data message is considered valid if:

- Information about the signer has been checked and verified;

- The signer’s digital certificate remains valid at the signature time;

- Digital signature on the data message matches the private key corresponding to the public key on the digital certificate and integrity of the data message is ensured.

2. Storage and cancellation of the following pieces of information attached to digital signature data messages:

a) Digital certificates corresponding to digital signatures attached to incoming digital signature data messages;

b) List of certification authorities’ digital certificates revoked at the signature time that correspond to with digital signatures attached to incoming data messages;

c) Validation etiquettes of certification authorities issuing digital certificates that correspond to digital signatures attached to incoming data messages;

d) Results of checking of digital certificate status appropriate for digital signatures attached to incoming data messages.

3. Change (addition or reduction) of digital signatures of certification authorities.

4. Notification (in alphabetical letters/symbols) of checking whether a digital signature is valid or not.

Chapter III

IMPLEMENTATION CLAUSE

Article 8. Implementation

1. The National Electronic Authentication Centre shall provide guidelines for the implementation of this Circular.

2. Public certification authorities and specialized certification authorities of organizations shall publish technical specifications (documents and tool sets), digital certificates related to certification authorities and standards for digital signatures on websites of the certification authorities.

3. Organizations and individuals that develop digital signature applications and use digital signatures shall comply with technical requirements and manuals for digital signature software and digital signature checking software.

Article 9. Grandfather clause

Organizations and individuals using digital signature software and digital signature checking software before the effective date of this Circular shall keep using them until they are changed, upgraded or replaced shall comply with the regulations laid down in this Circular.

Article 10. Effect

1. This Circular comes into force from November 01, 2020.

2. Chief of Office, National Electronic Authentication Centre, heads of agencies and units affiliated to the Ministry of Information and Communications, Directors of Departments of Information and Communications of provinces and central-affiliated cities, and relevant organizations and individuals are responsible for the implementation of this Circular.

3. Difficulties that arise during the implementation of this Circular should be promptly reported to the Ministry of Information and Communications (the National Electronic Authentication Centre) for consideration and resolution./.

APPENDIX

LIST OF TECHNICAL STANDARDS FOR DIGITAL SIGNATURES ATTACHED TO DATA MESSAGES
(Enclosed with the Circular No. 22/2020/TT-BTTTT dated September 07, 2020 of the Minister of Information and Communications)

---------------

This document is handled by Luật Dương Gia. Document reference purposes only. Any comments, please send to email: dichvu@luatduonggia.vn