Digital Signatures

A digital signature is an electronic method for confirming who signed an electronic record and whether the record was altered after signing. Under the Information Technology Act, 2000, it authenticates a record through an asymmetric cryptosystem and a hash function, using a private key for signing and the corresponding public key for verification.

Statutory basis

Under Section 3, a subscriber may authenticate an electronic record by affixing a digital signature. The Act defines it in Section 2(1)(p) as authentication of an electronic record by a subscriber through the electronic method or procedure prescribed by Section 3.

• Under Section 2(1)(ta), an electronic signature includes a digital signature.
• Under Section 5, an electronic signature affixed in the prescribed manner satisfies a legal requirement for a signature.

How authentication works

Digital signing combines a hash function with an asymmetric key pair. The hash represents the electronic record in a compact, record-specific form, while the key pair links signing and verification operations.

• The signatory applies the signing operation to the record's hash using a private key, which must remain under the signatory's control.
• The recipient verifies the signature with the corresponding public key and compares the result with a newly computed hash of the received record.
• If the record has changed after signing, the hashes will not match and verification will fail. This establishes integrity and supports authenticity and non-repudiation.

Trust through certification

A licensed Certifying Authority issues an electronic signature certificate that associates the subscriber's identity with the public key. Certifying Authorities operate under the supervision of the Controller of Certifying Authorities, creating the trust framework needed for recipients to rely on the public key.

• The subscriber must exercise reasonable care to retain control of the private key and must notify the Certifying Authority if it is compromised.
• A digital signature authenticates the signer and integrity of the record; it does not by itself establish that every statement in the record is factually true.

How UPSC asks this