Thông tư 28/2015/TT-NHNN Quy định về quản lý, sử dụng chữ ký số, chứng thư số và dịch vụ chứng thực chữ ký số của Ngân hàng Nhà nước

CIRCULAR

MANAGEMENT AND USE OF DIGITAL SIGNATURES, DIGITAL CERTIFICATES AND DIGITAL SIGNATURE CERTIFICATION SERVICE

Pursuant to the Law on the State Bank of Vietnam No. 46/2010/QH12 dated June 16, 2010;

Pursuant to the Law on Credit Institutions No. 47/2010/QH12 dated June 16, 2010;

Pursuant to the Law on Information Technology No. 67/2006/QH11 dated June 29, 2006;

Pursuant to the Law on Electronic Transactions No. 51/2005/QH11 dated November 29, 2005;

Pursuant to the Government’s Decree No. 26/2007/ND-CP dated February 15, 2007 on guidelines for the Law on Electronic Transactions concerning digital signatures and digital signature certification service;

Pursuant to the Government’s Decree No. 106/2011/ND-CP dated November 23, 2011 on amendments to the Government’s Decree No. 26/2007/ND-CP dated February 15, 2007 on guidelines for the Law on Electronic Transactions concerning digital signatures and digital signature certification service;

Pursuant to the Government’s Decree No. 170/2013/ND-CP dated November 13, 2013 on amendments to the Government’s Decree No. 106/2011/ND-CP dated November 23, 2011 on amendments to the Government’s Decree No. 26/2007/ND-CP dated February 15, 2007 on guidelines for the Law on Electronic Transactions concerning digital signatures and digital signature certification service;

Pursuant to the Government’s Decree No. 156/2013/ND-CP dated November 11, 2013 on functions, tasks, powers and organizational structure of the State bank of Vietnam;

At the request of Director of Information Technology Administration;

The Governor of the State bank of Vietnam promulgates a Circular on management and use of digital signatures, digital certificates and digital signature certification service of the State bank of Vietnam.

Chapter I

GENERAL PROVISIONS

Article 1. Scope

This Circular set forth management and use of digital signatures, digital certificates and digital signature certification service in electronic transactions of the State bank of Vietnam (the State bank).

Article 2. Regulated entities

1. Affiliates of the State bank; credit institutions; foreign bank branches; the State Treasury agencies.

2. Other entities using digital signature certification services of the State bank in electronic transactions operated by the State bank.

Article 3. Interpretation of terms

For the purposes of this Circular, these terms below shall be construed as follows:

1. "Digital certificate" means a form of digital certificate issued by the certificate authority (CA) of the State bank.

2. "Digital signature certification service" means a service type provided by the certificate authority of the State bank. Digital signature certification service includes:

a) Generation of a key pair including public key and private key for subscribers;

b) Issuance, renewal, suspension, restoration and withdrawal of the subscribers;

c) Online maintenance of database of digital certificates;

d) The other related services as prescribed.

3. “The CA” (the certificate authority) means a specialized certificate authority of the State bank which is administered and operated by the Information Technology Administration.

4. "Subscriber" means an entity specified in Article 2 whose digital certificate has been issued and accepted by the certificate authority, and who holds a private key that corresponds to the public key listed in that digital certificate.

5. “Subscriber’s organization” means an affiliate of the State bank, credit institution, foreign bank branch, State Treasury agency or another organization that has applied for issuance of the digital certificate on behalf of the individual (the subscriber).

6. “Electronic transactions of the State bank” mean operations and practices of the State bank which take place using electronic methods.

7. "Private key" means a key in the key pair of the asymmetric cryptography, used to generate a digital signature.

8. "Public key" means a key in the key pair of the asymmetric cryptography, used to verify a digital signature which is generated by the corresponding private key in the key pair.

9. "Signer" means the subscriber who uses their private key to digitally sign a data message under their name.

10. "Recipient" means an organization or individual that receives the data messages digitally signed by the signer, using the signer's digital certificate to verify the digital signature in the data message received and conduct concerned activities or transactions.

Article 4. Contents of digital certificate

1. Name of the CA.

2. Name of the subscriber.

3. Name of the subscriber’s organization.

4. Serial number of the digital certificate.

5. Validity period of the digital certificate.

6. Public key of the subscriber.

7. The digital signature of the CA.

8. Restrictions on purposes and scope of use of the digital certificate.

9. Restrictions on legal liability of the CA.

10. Other necessary contents as prescribed by the Ministry of Information and Communications.

Chapter II

DIGITAL SIGNATURE CERTIFICATION SERVICE

Article 5. Issuance of digital certificate

1. Digital certificate to individuals of subscriber’s organization

In seeking a digital certificate for an individual, the subscriber’s organization shall submit 01 (one) application for issuance of digital certificate online, in person, or by post, to the head office of the CA. Documents required:

a) An application form for issuance of digital certificate of the subscriber’s organization, using Form No. 01 hereto appended;

b) An application form for issuance of digital certificate of the subscriber, using Form No. 02 hereto appended.

2. Digital certificate to competent person (legal representative)

In seeking a digital certificate for a competent person (legal representative), the subscriber’s organization shall submit 01 (one) application for issuance of digital certificate online, in person, or by post, to the head office of the CA. Documents required:

a) Documents prescribed in clause 1 of this Article;

b) Valid copy of certificate registered seal specimen of agency, organization that has been issued under the provisions of law on the management and use of seals;

c) Valid copy of document certifying the title of the competent person of organization;

d) For the copies in points b and c, the organization has discretion to choose either a copy from master register or certified true copy or copy together with original for comparison.

3. Within 05 business days after receiving a duly completed application, the CA shall issue a digital certificate to the subscriber and notify the result online or by post. If the application is refused, the CA must provide explanation in writing.

4. The validity period of the digital certificate shall be proposed by the subscriber’s organization but not exceeding 5 years from the effective date.

Article 6. Renewal of digital certificate

1. The digital certificate to be renewed must remain valid.

2. The subscriber’s organization shall send an application form for renewal of digital certificate using Form No. 03 hereto appended online, in person, or by post, to the CA.

3. The application form for renewal of digital certificate shall be sent to the CA at least 10 days before the expiry of the validity period of the digital certificate.

4. Within 05 business days after receiving a duly completed application, the CA shall renew the digital certificate for the subscriber and notify the result online or by post. If the application is refused, the CA must provide explanation in writing.

Article 7. Suspension of digital certificate

1. The digital certificate of a subscriber shall be suspended in any of the following cases:

a) Upon any actual or suspected disclosure of the private key; any loss or unauthorized copy of the token that stores the private key or other breaches of security, the subscriber sends a request for suspension of the digital certificate using Form No. 01 hereto appended online, in person, or by post, to the CA;

b) At the request in writing of the presiding agency, security authority or the Ministry of Information and Communications;

c) At the request in writing of the subscriber’s organization;

d) The CA discovers any defect which likely affects the interests of the subscriber or security of the digital signature certification system;

dd) The time for suspension of the digital certificate is specified in point a, c of this Clause at the request of the subscriber or the subscriber’s organization. The time for suspension of the digital certificate specified in point b of this Clause at the request of the presiding agency, security authority or the Ministry of Information and Communications.

2. Upon any request in Clause 1, the CA shall immediately suspend the digital certificate, notify the result online or by post within 05 business days and update information on the website of the State bank.

Article 8. Reactivation of digital certificate

1. A digital certificate to be reactivated must be in the suspension time.

2. The digital certificate of a subscriber shall be reactivated in any of the following cases:

a) At the request of the presiding agency, security authority or the Ministry of Information and Communications;

b) At the request for reactivation of digital certificate of the subscriber’s organization;

c) The suspension time in the suspension request has ended;

d) The digital certificate has been suspended for the cause mentioned in point d clause 1 Article 7 and these defects have been remedied.

3. The subscriber’s organization shall send a request for reactivation of digital certificate using Form No. 05 online, in person, or by post, to the CA.

4. Within 05 business days after receiving a duly complete request for reactivation of digital certificate, the CA shall reactivate the digital certificate for the subscriber and notify the result online or by post. If the request is refused, the CA must provide explanation in writing.

Article 9. Revocation of digital certificate

1. The digital certificate of a subscriber shall be revoked in any of the following cases:

b) At the request of the presiding agency, security authority or the Ministry of Information and Communications;

b) At the request in writing of the subscriber’s organization;

c) The subscriber’s organization disbands or goes bankrupt as prescribed by law;

d) It finds just cause to determine that the subscriber violates regulations governing management and use of private key and token thereof as specified in clause 1, clause 2 Article 15 of this Circular.

2. The subscriber’s organization shall send a request for revocation of digital certificate using Form No. 06 online, in person, or by post, to the CA.

3. Upon any request in Clause 1, the CA shall immediately revoke the digital certificate, notify the result online or by post within 05 business days and update information on the website of the State bank.

Article 10. Generation and delivery of keys

1. A key pair of the subscriber is generated by the subscriber or the CA.

2. If a subscriber generates his/her own key pair, the subscriber must generate them prior to the activation expiration date as mentioned in the notification of issuance of digital certificate. If the subscriber fails to generate a key pair before the activation expiration date, the subscriber’s organization shall send a request for change of activation code before the said date using Form No. 08 to the CA in order to extend the time for key generation. When the expiration date mentioned in the notification of issuance of digital certificate has passed and the subscriber still wishes to use the digital certificate, the subscriber shall follow the procedures as prescribed in Article 11.

3. In order for the CA to generate a key pair on behalf of the subscriber, the subscriber shall, in person, request the CA to do so. The CA shall generate the key pair and deliver it to the subscriber.

4. The subscriber shall use the token on the private key following the instructions of the CA.

Article 11. Key pair modification

1. In seeking modification of the key pair, the subscriber must ensure the digital certificate remains valid. When digital certificate expires and the subscriber still wishes to use that digital certificate, the subscriber shall follow the procedures as prescribed in Article 5.

2. The subscriber’s organization shall send a request for modification of the key pair using Form No. 07 online, in person, or by post, to the CA.

3. Within 05 business days after receiving a duly complete request for modification of key pair, the CA shall modify the key pair for the subscriber and notify the result online or by post. If the application is refused, the CA must provide explanation in writing.

Article 12. Update and disclosure

The CA shall make public, update and maintain 24 hours a day and 7 days a week on the website of the State bank the following:

1. Circular on management and use of digital signatures, digital certificates and digital signature certification service.

2. The list of active, suspended or revoked digital certificates of subscribers.

3. Other information.

Chapter III

RESPONSIBILITIES OF PARTIES TO DIGITAL SIGNATURE CERTIFICATION SERVICE

Article 13. Responsibility of the CA

1. Issue, renew, suspend, revoke, and reactivate digital certificates and modify key pairs for subscribers upon request.

2. Manage and operate the system of digital signature certification service of the State bank.

3. Initiate back-up plan to keep the digital signature certification service of the State bank safe and uninterrupted.

4. Store sufficient, accurate and updated information of subscribers for the management of digital certificates through their validity period.

5. Deliver keys and digital certificates to subscribers.

6. Provide subscribers with information about scope and restrictions of digital certificates, security requirements and other information that likely affects the interests of the subscribers.

7. Ensure channel to receive requests for suspension and revocation of digital certificates available 24 hours a day and 7 days a week.

8. Store information about suspension, revocation of digital certificates or modification of key pairs for at least 5 years since the date of suspension, revocation or modification.

9. Make public a list of active, suspended or revoked digital certificates.

10. Provide information about software and manuals related to management and use of digital signatures, digital certificates and digital signature certification service.

Article 14. Responsibility of subscriber’s organization

1. Register the digital certificate of the competent person (legal representative) who, on behalf of the subscriber’s organization, digitally signs documents related to the digital certificate.

2. Manage, collect information, and update a list of subscribers in the organization. Review the list of subscribers at least every 3 month to ensure: (i) the list of subscribers and positions to be issued with digital certificate in conformity with their jobs and work requirements; (ii) any employee who is laid off or transferred to another workplace must have the digital certificate revoked as soon as possible; (iii) digital certificates about to expire must be renewed in a timely manner to maintain the practices thorough and uninterrupted.

3. Send periodical or ad-hoc reports as prescribed in Article 17 of this Circular.

4. Take responsibility for accuracy of the digital certificate documentation sent to the CA under their management.

5. Send the digital certificate documentation online through the website of the State bank, or by post, or in person to the CA; the digital certificate documentation submitted online must bear the digital signature of the competent person issued by the CA.

6. Instruct, inspect and enable the subscribers to manage and use the digital certificates and private keys in accordance with this Circular.

7. Communicate in a timely manner to the CA for suspension or revocation of the digital signature of the competent person in case where the competent is temporarily laid off or laid off, is transferred to another position or workplace.

8. Communicate in a timely manner to the CA for suspension or revocation of the digital signature of the subscriber in case where the subscriber is temporarily laid off or laid off, is transferred to another workplace; the subscriber changes new job and no longer uses the digital certificate and other circumstances as needed by the subscriber’s organization.

Article 15. Responsibility of subscriber

1. Use the digital certificate with proper purposes.

2. Keep and use the private key and data in the token of the private key confidential; do not share or lend the password or the token of the private key.

3. Communicate in a timely manner to the CA and the subscriber’s organization upon discovery of actual or suspected breach of security regarding the digital certificate or private key.

4. Comply with other regulations on issuance, management and use of the digital certificate.

Article 16. Responsibility of signer and recipient

1. Before accepting a digital signature of the signer, the recipient must examine the following:

a) Validity, scope of digital certificate and liability limit of the signer and digital certificate of the CA;

b) The digital signature generated by the private key corresponding to the public key in the digital certificate of the signer.

2. The recipient shall incur any damage on occurrence of any circumstances below:

a) The recipient fails to comply with Clause 1;

b) The recipient who has known or is notified of the untrustworthy of the digital certificate and private key of the signer but still accept that digital certificate.

Chapter IV

IMPLEMENTATION

Article 17. Reporting

The subscriber’s organization shall send reports to Information Technology Administration affiliated to the State bank as follows:

1. Periodical reports on management and use of digital certificates:

a) Time: every 06 months, no later than January 15 and July 15 of every year;

b) Method: Sending report in writing and Excel file (Microsoft) online using Form No. 09 to the Information Technology Administration affiliated to the State bank.

2. Ad-hoc reports upon request of the CA.

Article 18. Violations and actions taken, complaints and dispute settlement

The violations and actions taken, complaints and dispute settlement concerning digital signatures and digital signature certification service of the CA, subscribers, and subscriber’s organizations shall comply with law on digital signatures and other relevant laws and regulations.

Article 19. Entry in force

This Circular comes into force as of February 1, 2016 and supersedes Circular No. 12/2011/TT-NHNN dated May 17, 2011.

Article 20. Implementation

1. Information Technology Administration shall:

a) Provide guidelines for management and use of digital signatures, digital certificates and digital signature certification service;

b) Monitor and inspect the implementation of this Circular.

2. Bank Supervision and Inspection Agency shall cooperate with Information Technology Administration in inspecting the implementation of this Circular by credit institutions and foreign bank branches.

3. The heads of affiliates of the State bank, Directors of branches of the State Bank of provinces and central-affiliated cities; Presidents of the Board of Directors, Presidents of the Member assembly, General Directors (Directors) of credit institutions and foreign bank branches, State Treasury agencies shall implement this Circular.

---------------

This document is handled by Luật Dương Gia. Document reference purposes only. Any comments, please send to email: dichvu@luatduonggia.vn