Frequently Asked Question

A: A digital signature (standard electronic signature) produces an electronic “fingerprint” that is unique to both the document and the signer. Digital signatures can ensure the authenticity of the signer, as well as the integrity of the contents of the document being signed. Any changes made to the document after it has been signed will invalidate the digital signature, thereby protecting against signature forgery and information tampering.

A: While both handwritten and digital signatures (standard electronic signatures) are legally-binding, only digitally signatures are reliable in electronic world.

A: No, The Digital signature changes with content of the message.

A: Yes. Based on the standards digital signatures has the potential to “seal” documents by

♦ Providing evidence of user identity

♦ Guaranteeing data integrity

♦ Ensuring non-repudiation of signed electronic documents

A: Public Key Infrastructure (PKI) refers to the infrastructure that is essential for a provable and acceptable digital signature (standard electronic signature). PKI encompasses different components, which include a Certificate Authority (CA), end-user enrolment software, and tools for managing, renewing and revoking keys and certificates.

A: In cryptography, a digital signature certificate is issued to an individual or organization, stating their public key along with their identity.

A: A DSC certifies the public key of the signer, generally by a trusted third-party.Non-repudiation is achieved by proving the authenticity of the signer (user or organization) and its public key.

A: X.509 is the industry standard for digital signature certificate format. It defines the various mandatory and optional attributes that can be defined within the certificate.

A: A Certificate Revocation List (CRL) is a list of certificates that have been revoked, and therefore the relying party (user or organization) should no longer trust it.

A: A root certificate is a self-signed certificate used to identify the Root Certifying Authority (CA). The root certificate serves as an anchor of trust in a trust hierarchy that starts from the end-entity certificate up to the root.

A: Digital signature certificates have an explicit start date and an explicit expiration date. This is because, the keys associated with a certificate and the algorithms used have to be frequently updated owing to the increasing security threats.

A: RA interacts with the subscribers (individuals / organizations) for providing CA services, like verification of the physical or real identity of the subscribers. The RA is subsumed in the CA, which takes total responsibility for all actions of the RA.

A: No, there is no threat to the security of the owner / users digital signature, if the private key lies on the crypto token and does not leave the crypto-token.

A: depends upon the how the subscriber (individual / organization) has kept his private keys. If private key is not stored securely, then it can be misused without the knowledge of its owner.

A: Yes

A: Yes. On moving from one department to another, if the procedures in place so demand, then the existing certificate has to be revoked and a new one issued. In any case, the digital signature generated is different each time, even if the same key has been used.

A: The sanctity of such a certificate will be as per the agreement between outside CA and a licensed CA in India. Such an agreement has to be approved by the CCA.

A: It is not mandatory. However, certificates could be issued for different purposes to the same individual. e.g. by the bank where the individual has an account as a customer, by the government to its official.

A: A subscriber (individual or organization) can obtain DSC by applying to any of the licensed CA (Certifying Authority) that has been granted license by the office of Controller of Certifying Authorities (CCA) for issuing Digital Signature Certificate under Section 24 of the Indian IT-Act 2000. Some of the CA’s who have been granted permission or license by the CCA are: e-Mudhra, (n)Code Solutions, IDRBT etc... .

A: The cost of a DSC depends upon a class, type and validity of the certificate. Also the costs may from CA to CA, and it is up to the subscriber to choose it.

A: The time taken by a CA to issue a DSC may vary from three to seven days.

A: A subscriber (individual or organization) can obtain DSC by applying to any of the licensed CA (Certifying Authority) that has been granted license by the office of Controller of Certifying Authorities (CCA) for issuing Digital Signature Certificate under Section 24 of the Indian IT-Act 2000. Some of the CA’s who have been granted permission or license by the CCA are: e-Mudhra, (n)Code Solutions, IDRBT etc... .

A: Digital Signatures are legally admissible in an Indian court of Law, as provided under the provisions of Indian IT Act 2000.

A: Encryption in Public Key Cryptography is done by encrypting the message by using the public key of the receiver so that only the receiver will be able to decrypt the message using his/her private key. This approach also ensures that there is no need to share any keys between the sender and receiver.

A: No. A Digital Signature Certificate is issued only for the purpose of Digital Signing. For encryption, one can use an Encryption Certificate obtained from the CA. However it may be noted that, an encryption certificate is required only for receiving encrypted messages, as for sending an encrypted message, the sender will be using the public key of the receiver’s encryption certificate.

A: The continuous advancements made in computing, warrant change of algorithms, key sizes etc.. to increase the security and reduce the vulnerabilities. Therefore it becomes essential to have a limited validity period for a Digital Certificate.

A: Yes, the legal validity of a digitally signed document depends on the validity of the digital signature certificate used at time at which it was signed.

A: Keys are generally stored in a pin-protected, tamper-proof cryptographic USB hardware token, supplied by the Certifying Authority.

A: It depends on your requirement. However it is advisable to go for Class-3 Certificates, especially when you need to use services that require high level of assurance.