Controller of Certifying Authorities Creating Trust in Electronic

  • Slides: 27
Download presentation
Controller of Certifying Authorities Creating Trust in Electronic Environment - IT Act 2000 Deputy

Controller of Certifying Authorities Creating Trust in Electronic Environment - IT Act 2000 Deputy Controller (Technology) Controller of Certifying Authorities Ministry of Communications & Information Technology

E-Commerce Promotion • Creating Trust in Electronic Environment - Establishing Digital Signature Framework

E-Commerce Promotion • Creating Trust in Electronic Environment - Establishing Digital Signature Framework

 • • Trust in the Paper world Trust issues in the Electronic World

• • Trust in the Paper world Trust issues in the Electronic World Concept of Digital Signatures Role of CAs PKI IT Act Role of CCA

Electronic Commerce • EC transactions over the Internet include – Formation of Contracts –

Electronic Commerce • EC transactions over the Internet include – Formation of Contracts – Delivery of Information and Services – Delivery of Content • Future of Electronic Commerce depends on “the trust that the transacting parties place in the security of the transmission and content of their communications”

Electronic Juridical Statements • Juridical statements which are set up telematically • Computers are

Electronic Juridical Statements • Juridical statements which are set up telematically • Computers are the only means by which contracting parties set up their agreements • Examples include – – – EFT Teleshopping Electronic consultation of data banks Tele-reservation Contracts, deed, agreements Dealing with Public Administrations

The Paper World Documents • A paper document consists of four components – –

The Paper World Documents • A paper document consists of four components – – the carrier ( the sheet of paper) text and pictures ( the physical representation of information) information about the originator measures to verify the authenticity (written signature) • All the four components are physically connected – So, paper is the document • There is only one original – can be reproduced in innumerable copies

The Paper World Signature • Supposed to be unique, difficult to be reproduced, not

The Paper World Signature • Supposed to be unique, difficult to be reproduced, not changeable and not reusable • Its main functions – identification – declaration – proof • The signature is used to identify a person and to associate the person with the content of that document – always related to a physical person

The Paper World Signature (contd) • In all legal systems – Absence of a

The Paper World Signature (contd) • In all legal systems – Absence of a prescription of an exclusive modality of signing e. g. Full name, initials, nickname, real or any symbol. – Token of will and responsibilty – Contractors have the right to rule their own contractural relations, defining also the way each one can sign the agreements. • From a legal point of view, nothing against the introduction of new types or technologies of signature – Digital Signature is a new technology

Electronic World • Electronic document produced by a computer. Stored in digital form, and

Electronic World • Electronic document produced by a computer. Stored in digital form, and cannot be perceived without using a computer – It can be deleted, modified and rewritten without leaving a mark – Integrity of an electronic document is “genetically” impossible to verify – A copy is indistinguishable from the original – It can’t be sealed in the traditional way, where the author affixes his signature • The functions of identification, declaration, proof of electronic documents carried out using a digital signature based on cryptography.

Electronic World • Digital signatures created and verified using cryptography • Public key System

Electronic World • Digital signatures created and verified using cryptography • Public key System based on Asymmetric keys – An algorithm generates two different and related keys • Public key • Private Key – Private key used to digitally sign. – Public key used to verify.

Public Key Infrastructure • Allow parties to have free access to the signer’s public

Public Key Infrastructure • Allow parties to have free access to the signer’s public key • This assures that the public key corresponds to the signer’s private key – Trust between parties as if they know one another • Parties with no trading partner agreements, operating on open networks, need to have highest level of trust in one another

Role of the Government • Government has to provide the definition of – the

Role of the Government • Government has to provide the definition of – the structure of PKI – the number of levels of authority and their juridical form (public or private certification) – which authorities are allowed to issue key pairs – the extent to which the use of cryptography should be authorised for confidentiality purposes – whether the Central Authority should have access to the encrypted information; when and how – the key length, its security standard and its time validity

Certifying Authorities • A CA is an Authority which should : – reliably identify

Certifying Authorities • A CA is an Authority which should : – reliably identify persons applying for key certificates (signatures) – reliably verify their legal capacity – confirm the attribution of a public signature key to an identified physical person by means of a signature key certificate – always maintain online access to the signature key certificates with the agreement of the signature key owner – take measures so that the confidentiality of a private signature key is guaranteed

Certificate based Key Management CA CA User A A B User B CA A

Certificate based Key Management CA CA User A A B User B CA A • Operated by trusted-third party - CA • Provides Trading Partners Certificates • Notarises the relationship between a public key and CA B its owner

Information Technology Act • IT Act 2000 : Basic legal framework for ECommerce -

Information Technology Act • IT Act 2000 : Basic legal framework for ECommerce - promotes trust in electronic environment • IT Act creates a conducive environment for promoting E-Commerce in the country. – Acceptance of electronic documents as evidence in a court of law. – Acceptance of electronic signatures at par with handwritten signatures.

Information Technology Act. . . contd – Acceptance of electronic documents by the government.

Information Technology Act. . . contd – Acceptance of electronic documents by the government. – Defines digital signatures based on asymmetric public key cryptography – Provides for the creation of Certifying Authorities to issue public key certificates – digital certificates for electronic authentication of users in electronic commerce.

Information Technology Act. . . contd – Provides for Controller under the IT Act

Information Technology Act. . . contd – Provides for Controller under the IT Act to license the Certifying Authorities and to ensure that none of the provisions of the Act are violated. – Provides for dealing with offences in the cyber space in the form of hackers and other criminals trying to gain access into databases and other business sites. – Provides for the establishment of Cyber Appellate Tribunal to try cases under this Act for speedy adjudication of cases arising out of this Act. – Provides for appropriate changes in the Bankers Act and the Indian Evidence Act.

The Controller of Certifying Authorities (CCA) • Appointed by the Central Government under section

The Controller of Certifying Authorities (CCA) • Appointed by the Central Government under section 17 of the IT Act. • Came into existence on November 1, 2000. • Aims at promoting the growth of E-Commerce and E-Governance through the wide use of digital signatures.

CCA has to regulate the functioning of CAs in the country by • Licensing

CCA has to regulate the functioning of CAs in the country by • Licensing Certifying Authorities (CAs) under section 21 of the IT Act and exercising supervision over their activities. • Certifying the public keys of the CAs, i. e. their Digital Signature Certificates more commonly known as Public Key Certificates (PKCs). • Laying down the standards to be maintained by the CAs, • Addressing the issues related to the licensing process

The licensing process • Examining the application and accompanying documents as provided in sections

The licensing process • Examining the application and accompanying documents as provided in sections 21 to 24 of the IT Act, and all the Rules and Regulations there- under; • Approving the Certification Practice Statement(CPS); • Auditing the physical and technical infrastructure of the applicants through a panel of auditors maintained by the CCA.

Audit Process • Adequacy of security policies and implementation thereof; • Existence of adequate

Audit Process • Adequacy of security policies and implementation thereof; • Existence of adequate physical security; • Evaluation of functionalities in technology as it supports CA operations; • CA’s services administration processes and procedures; • Compliance to relevant CPS as approved and provided by the Controller; • Adequacy to contracts/agreements for all outsourced CA operations; • Adherence to Information Technology Act 2000, the rules and regulations thereunder, and guidelines issued by the Controller from time-to-time.

PKI Standards Public Key Cryptography · RSA - Asymmetric Cryptosystem · Diffie-Hellman - Asymmetric

PKI Standards Public Key Cryptography · RSA - Asymmetric Cryptosystem · Diffie-Hellman - Asymmetric Cryptosystem · Elliptic Curve Discrete Logarithm Cryptosystem Digital Signature Standards · RSA, DSA and EC Signature Algorithms · SHA-1, SHA-2 - Hashing Algorithms Directory Services (LDAP ver 3) · X. 500 for publication of Public Key Certificates and Certificate Revocation Lists · X. 509 version 3 Public Key Certificates · X. 509 version 2 Certificate Revocation Lists PKCS family of standards for Public Key Cryptography from RSA · PKCS#1 – PKCS#13 Federal Information Processing Standards (FIPS) · FIPS 140 -1 level 3 and above for Security Requirement of Cryptographic Modules

Key Size mandated by the CCA • CA – 2048 -bit RSA-key • User

Key Size mandated by the CCA • CA – 2048 -bit RSA-key • User – 1024 -bit RSA-key

Licensed Certifying Authorities • Provides services to its subscribers and relying parties as per

Licensed Certifying Authorities • Provides services to its subscribers and relying parties as per its certification practice statement (CPS) which is approved by the CCA as part of the licensing procedure. – – – – Identification and authentication Certificate issuance Certificate suspension and revocation Certificate renewal Notification of certificate-related information Display of all these on its website Time-stamping

End entities, subscribers and relying parties • The End entities of RCAI are the

End entities, subscribers and relying parties • The End entities of RCAI are the Licensed CAs in India. • Subscribers and relying parties using the certificates issued by a CA need to be assured that the CA is licensed by the CCA. • They should be able to verify the licence through an indicator in the PKCs issued by a CA.

PKI Hierarchy CCA Directory of Certificates CRLs Subscriber CA CA Subscriber CA Relying Party

PKI Hierarchy CCA Directory of Certificates CRLs Subscriber CA CA Subscriber CA Relying Party Directory of Certificates CRLs Subscriber

Trust in Electronic Environment in India • • • CCA : Root of trust,

Trust in Electronic Environment in India • • • CCA : Root of trust, National Repository Licensed CAs Digital signatures for signing documents Certificates, CRLs for access by relying parties PKI operational Other provisions of the IT Act – Cybercrimes not to go unpunished