Circular No. 05/2010/TT-BNV guides on providing, managing, and using specialized digital signature authentication services for agencies under the political system.

CIRCULAR

GUIDELINES ON THE PROVISION, MANAGEMENT AND USE OF SPECIALIZED DIGITAL SIGNATURE VERIFICATION SERVICES FOR ORGANIZATIONS IN THE POLITICAL SYSTEM

SPECIALIZED DIGITAL SIGNATURE VERIFICATION SERVICES FOR ORGANIZATIONS IN THE POLITICAL SYSTEM

THE MINISTER OF THE MINISTRY OF HOME AFFAIRS

Pursuant to Decree No. 48/2008/NĐ-CP dated April 17, 2008 of the Government stipulating the functions, tasks, powers, and organizational structure of the Ministry of Home Affairs;
Pursuant to Decree No. 26/2007/NĐ-CP dated February 15, 2007 of the Government detailing the implementation of the Electronic Transactions Law regarding digital signatures and digital signature certification services;
At the proposal of the Director of the Government Cryptographic Agency,

REGULATIONS

PART I
GENERAL PROVISIONS

Article 1. Scope of Regulation and Applicability

These Circulars provide guidelines on the provision, management, and use of specialized digital signature verification services for the purpose of verifying information, validating digital signatures, ensuring security and safety of information in electronic transactions conducted by organizations, entities, and individuals within the political system.

Article 2. Specialized Digital Signature Verification Services for Organizations in the Political System

Specialized digital signature verification services for organizations in the political system include:

1. Creation and distribution of key pairs.

2. Issuance and revocation of digital certificates.

3. Publicizing and maintaining online databases of digital certificates.

4. Other related services as prescribed.

Article 3. Organization Providing Specialized Digital Signature Verification Services for Organizations in the Political System

The organization providing specialized digital signature verification services for organizations in the political system, established and maintained by the Government Cryptographic Agency in accordance with Clause 4, Article 6 of Decree No. 26/2007/NĐ-CP dated February 15, 2007 of the Government detailing the implementation of the Law on Electronic Transactions regarding digital signatures and digital signature verification services, is the sole entity responsible for providing specialized digital signature verification services for organizations in the political system.

Address: No. 105 Nguyen Chi Thanh, Dong Da, Hanoi

Email address: [email protected]

Website address: http://ca.gov.vn

Telephone/Fax: (04) 37738668

Article 4. Authority Receiving Requests for Specialized Digital Signature Verification Services for Organizations in the Political System

1. The authority receiving requests for specialized digital signature verification services for organizations in the political system is the cryptographic agency designated by the Director of the Government Cryptographic Agency to be the lead agency in receiving requests for issuance and management of digital certificates (hereinafter referred to as the request receiving authority).

2. The request receiving authorities include:

a) The Cryptographic Bureau - General Staff Department for requests within the scope of the Ministry of National Defense:

Address: No. 7 Nguyen Tri Phuong, Ba Dinh, Hanoi.

Email address: [email protected]

b) The Cryptographic Bureau H48 - Logistics and Technical General Department for requests within the scope of the Ministry of Public Security:

Address: No. 44 Yet Kieu, Hoan Kiem, Hanoi

Email address: [email protected]

c) The Cryptographic Bureau - Ministry of Foreign Affairs for requests within the scope of the Ministry of Foreign Affairs:

Address: No. 1 Ton That Dam, Ba Dinh, Hanoi

Email address: [email protected]

d) The Cryptographic Bureau 893 - Government Cryptographic Agency for requests from other agencies:

Address: No. 60 Nguyen Chi Thanh, Dong Da, Hanoi

Email address: [email protected]

Article 5. Subscriber Manager

1. The heads of Party Committees, Secretaries of the Central Party Office, heads of central agencies of mass organizations, Chairpersons of the Central Committee of the Vietnam Fatherland Front, Directors of the National Assembly Office, Directors of the State President's Office, Chief Justices of the Supreme People's Court, Procurators-General of the Supreme People's Procuracy, State Auditor General, Ministers, Heads of Ministries-equivalent agencies, Heads of government-affiliated agencies, Secretaries of provincial party committees directly under the Central Committee, Chairpersons of Provincial People's Councils, Chairpersons of Provincial People's Committees directly under the Central Committee, and other organizations as prescribed by competent authorities are subscriber managers responsible for managing subscribers under their respective agencies and organizations in accordance with Article 11 of this Circular.

2. Persons specified in Clause 1 of this Article may delegate the responsibility of subscriber manager to the heads of subordinate agencies and units. Lists of delegations shall be sent to the Government Cryptographic Agency at No. 105 Nguyen Chi Thanh, Dong Da, Hanoi.

Article 6. Digital Certificate

1. The contents of a digital certificate include:

a) The name of the organization providing the digital certificate;

b) The name of the subscriber;

c) The serial number of the digital certificate;

d) The validity period of the digital certificate;

đ) The public key of the subscriber;

e) The digital signature of the organization providing specialized digital signature certification services for agencies within the political system;

g) Restrictions on the purpose and scope of use of the digital certificate;

h) Other information for management, use, security, and confidentiality purposes as specified by the organization providing digital signature certification services.

2. Validity period of the digital certificate:

a) Not exceeding twenty years for digital certificates of organizations providing digital signature certification services;

b) Not exceeding five years for digital certificates of subscribers.

3. Types of digital certificates for subscribers:

The organization providing specialized digital signature certification services for agencies within the political system provides two types of digital certificates for subscribers:

a) A digital certificate for signing data messages;

b) A digital certificate for encrypting data messages.

Chapter II
DIGITAL SIGNATURE VERIFICATION SERVICES

Article 7. Creation and Distribution of Key Pairs

1. Subscribers' key pairs are created by the organization providing specialized digital signature certification services for agencies within the political system;

2. The private key is stored on a device and transferred to the subscriber through secure methods.

Article 8. Issuance of Digital Certificates

1. Subscribers requesting issuance of digital certificates must meet the following conditions:

a) Being an organization or individual within the political system;

b) Fulfilling the obligations and responsibilities of subscribers as stipulated in Article 13 of this Circular.

2. The process of issuing digital certificates:

a) Subscribers prepare a request for issuance of a digital certificate and send it to the subscriber manager as specified in Article 5 of this Circular (using Form No. 01);

b) The subscriber manager, based on requirements for ensuring security and verifying information in electronic transactions serving their agency's tasks, reviews and compiles a list of subscribers requesting digital certificates and sends it to the authority receiving certification requests (using Form No. 02);

c) Within three working days from the date of receipt of the request for issuance of a digital certificate, the authority receiving certification requests checks the application, and if it is valid, compiles a list of requests for issuance of digital certificates (using Form No. 02) along with a copy of the list of requests for issuance of digital certificates sent by the subscriber manager to the Government Cryptographic Department (by written document or through an active digital certificate);

In case the application is not valid, the authority receiving certification requests guides the subscriber manager to complete the application;

If the request from the subscriber manager is not accepted, the authority receiving certification requests informs the subscriber manager of the reasons and reports to the Government Cryptographic Department;

đ) Upon receipt of the list of requests for issuance of digital certificates from the authority receiving certification requests, the organization providing specialized digital signature certification services for agencies within the political system is responsible for creating digital certificates to issue to subscribers;

e) The issuance of digital certificates to subscribers is carried out as follows: The organization providing specialized digital signature certification services for agencies within the political system transfers the digital certificates to the authority receiving certification requests to transfer them to the subscriber manager; the subscriber manager hands over the digital certificates to the subscribers; the handover process is documented in a handover record (using Form No. 03);

f) After handing over the digital certificate to the subscriber, the subscriber manager submits a request for the effective date of the digital certificate (using Form No. 04) to the Government Cryptographic Department (by written document or through an active digital certificate). The organization providing specialized digital signature certification services for agencies within the political system is responsible for publishing the digital certificate of the subscriber on its website at the address: http://ca.gov.vn. The digital certificate of the subscriber becomes effective from the date it is published by the organization providing specialized digital signature certification services for agencies within the political system. The publication of the contents of the digital certificate is conducted according to the provisions of Article 6 of this Circular.

3. In cases where a request for issuance of a digital certificate for an authorized person of an agency or organization as prescribed by laws on seal management and use is made, in addition to implementing the procedures stipulated in Clause 2 of this Article, the subscriber must provide the following documents to the subscriber manager:

a) A certified true copy of the registration certificate of the seal model of the agency or organization or state position issued in accordance with the laws on seal management and use;

b) A certified true copy of the document confirming the position of the authorized person of the agency or organization or state position.

Article 9. Revocation of digital certificates

1. Revocation of digital certificates in the following cases:

a) The digital certificate has expired;

b) At the written request of the subscriber, confirmed by the subscriber manager (using Form No. 05) in cases where the private key is exposed or suspected to be exposed; the device storing the private key is lost, copied, or other security breaches occur;

c) At the written request (or through an active digital certificate) from investigative agencies or security agencies;

d) At the written request (or through an active digital certificate) from the subscriber manager;

đ) The subscriber changes job positions or retires;

e) In cases where the digital certificate for an authorized person of an agency or organization as prescribed by laws on seal management and use changes positions;

g) The subscriber violates regulations on managing and using the private key and devices storing the private key as stipulated in Article 13 of this Circular.

2. The process of revoking digital certificates:

a) All requests for revocation of digital certificates must be notified to the subscriber manager. The subscriber manager sends the request for revocation of the digital certificate to the organization providing specialized digital signature certification services for agencies within the political system. The request for revocation of the digital certificate can be sent through an active digital certificate or by the fastest means possible in writing.

b) Upon receiving a request to revoke the digital certificate, the organization providing specialized digital signature authentication services for agencies within the political system shall immediately render the digital certificate ineffective and announce the revocation of the digital certificate on the website of the organization providing specialized digital signature authentication services for agencies within the political system at the address: http://ca.gov.vn; simultaneously notify in writing (or through an active digital certificate) the agency receiving the authentication request and the user account manager;

c) After receiving the document revoking the digital certificate, the user account manager shall recover the device storing the secret key, return it to the organization providing specialized digital signature authentication services for agencies within the political system through the agency receiving the authentication request. The handover process must be documented according to form number 03.

Chapter III
RESPONSIBILITIES AND LIMITATIONS OF THE PARTIES

Article 10. For the organization providing specialized digital signature authentication services for agencies within the political system

1. Generate key pairs, issue, and revoke digital certificates.

2. Ensure absolute security of the secret key of the digital certificate and handle situations during the provision and management of digital certificates.

3. Manage and operate the technical infrastructure of the digital signature authentication system, ensuring the safe and continuous provision of digital signature authentication services.

4. Fully, accurately, and update information about users during the validity period of the digital certificate and for a minimum of five years from the date the digital certificate expires.

5. Ensure channels for receiving requests to issue, revoke digital certificates, updates, and maintain 24 hours a day, seven days a week online databases regarding digital certificate policies, digital certificates of the organization providing digital signature authentication services, regulations on the provision, management, and use of digital signature authentication services, lists of valid digital certificates, revoked digital certificates, and other necessary information.

6. Guide and inspect organizations and individuals responsible for registration, provision, management, and use of digital signature authentication services.

7. Revoke digital certificates when there is sufficient basis to determine that the user has violated the provisions of this Circular.

8. Comply with other legal regulations concerning the management and use of digital certificates.

Article 11. For the user account manager

1. Examine and approve the list of users requesting issuance, revocation of digital certificates.

2. Be responsible for the accuracy of the information about users requesting issuance, revocation of digital certificates.

3. Hand over digital certificates to users, guide, and inspect users under their authority during the use of digital certificates, secret keys, and the implementation of the provisions of this Circular.

4. Timely notify and request the organization providing specialized digital signature authentication services for agencies within the political system to revoke digital certificates in cases stipulated in Article 9 of this Circular.

5. Organize the storage of user account management request documents for issuing, revoking digital certificates and the handover records between the user account manager and the user.

Article 12. Regarding the agency receiving certification requests

1. Receiving requests, examining files, and compiling a list to propose issuance of digital certificates from the subscriber managers.

2. Receiving, delivering digital certificates and secret key storage devices to the Service Provider for specialized digital signature certification serving agencies within the political system or subscriber managers as stipulated in Articles 8 and 9 of this Circular.

3. Statistics, monitoring, and reporting on the use of digital certificates within their management scope every six months to the Government Cryptographic Office.

4. Managing and maintaining databases on subscribers and digital certificates within their management scope.

Article 13. Regarding subscribers

1. Providing accurate and complete information related to the issuance of digital certificates.

2. Promptly notifying the subscriber manager to revoke their own digital certificate in cases specified at points b, d, e, and g of Clause 1, Article 9 of this Circular.

3. Managing and using secret key storage devices under state secrecy regulations at the "Top Secret" level.

4. Being responsible for fully implementing all regulations, procedures for managing and using digital certificates, and complying with laws governing the management and use of digital certificates and digital signatures.

Chapter IV
IMPLEMENTATION

Article 14. Responsibilities of agencies within the political system

1. Effectively deploying and applying digital certificates and digital signature certification services.

2. Proposing issuance of digital certificates for subscribers under their management based on security and information verification requirements for electronic transactions serving agency tasks.

Article 15. Responsibilities of the Government Cryptographic Agency

1. Managing and directing the Service Provider for specialized digital signature certification serving agencies within the political system to ensure effective provision of digital certificates and certification services based on planned needs of agencies within the political system.

2. Cooperating with relevant agencies to integrate digital signatures into applications to ensure security and information verification.

3. Studying and applying appropriate digital signature technologies for information technology applications serving agencies within the political system.

4. Assisting the Minister of Home Affairs in guiding, monitoring, and inspecting the implementation of this Circular.

Article 16. Effective Date

1. This Circular takes effect from August 15, 2010.

2. During implementation, if issues arise, they should be promptly reported to the Ministry of Home Affairs (through the Government Cryptographic Office) for consideration and resolution.

FORM NO. 01

(Issued pursuant to Circular No. 05/2010/TT-BNV dated July 1, 2010

of the Minister of Home Affairs)

SOCIALIST REPUBLIC OF VIET NAM
Independence - Freedom - Happiness
--------------

APPLICATION FOR ISSUANCE OF DIGITAL CERTIFICATE

To: <Subscriber Manager> (1)

Full Name (in capital letters) …Gender: Male □ Female □

Date of Birth: …/……./…Place of Birth:…

ID Card Number/Passport Number: …Date of Issue:…Place of Issue:…

Permanent residence address:...

Workplace: …Telephone: …Fax:…

Position: …Agency/Unit:…

Email Address (2)…Telephone NR …Mobile Phone…

Previous Digital Certificate Number (if applicable): …Date of Issue …Expiry Date:…

Requested Validity Period (maximum five years from the date of issuance):…years…

Attached Documents (3):

- A valid copy of the registration certificate for the official seal issued according to the law on seal management and use.

- A valid copy of the confirmation document of the authority position issued by the agency, organization, or state function.

- I hereby declare that the information provided above is true. If it is false, I will bear full responsibility under the law.

- If my request for a digital certificate is approved, I promise to strictly comply with all regulations regarding the management and use of digital signatures, digital certificates, and digital signature certification services.

(2) The email address is the main contact address for the subscriber provided by the agency or organization (digital certificates are only issued to users with email addresses belonging to agencies within the political system).

(3) In case of requesting a digital certificate for the authority holder of an agency or organization according to the law on seal management and use.

<The agency of the subscriber manager or the agency receiving certification requests>

FORM NO. 02

(Issued pursuant to Circular No. 05/2010/TT-BNV dated July 1, 2010

of the Minister of Home Affairs)

ID Card Number/Passport Number/Date of Issue/Place of Issue

Respectfully submitted to: ...

Agency/Unit Name

Province/City

Today, at ... hours... on ... day ... month ... year ..., at ..., we include:

Unit:...

FORM NO. 03

(Issued pursuant to Circular No. 05/2010/TT-BNV dated July 1, 2010

of the Minister of Home Affairs)

SOCIALIST REPUBLIC OF VIET NAM
Independence - Freedom - Happiness
-----------------

Unit Address:...

Both parties agree on the delivery and receipt of digital certificates as follows:

I. Transferor:

The Deliverer has delivered to the Receiver: ... (in words:...) set(s) of digital certificates, specifically as follows:

Secret Key Storage Device Serial Number

Representative:…

Position:…

II. Transferee:

The Deliverer has delivered to the Receiver: ... (in words:...) set(s) of digital certificates, specifically as follows:

Secret Key Storage Device Serial Number

Representative:…

Position:…

Reason for Delivery and Receipt (1)

Effective Date of Digital Certificate (2)

(2) In case of new issuance of digital certificates, clearly indicate the effective date of the digital certificate

Note:

(3) In case of revocation of digital certificates lacking secret key storage devices, clearly indicate the reason.

FORM NO. 04

<Agency of the Subscriber Manager>

Regarding the request for the effective date of the digital certificate

Number of Requests: …

(Issued pursuant to Circular No. 05/2010/TT-BNV dated July 1, 2010

of the Minister of Home Affairs)

NOTICE

Time of Handover of Digital Certificates to Subscribers

Respectfully submitted to: Government Cryptographic Board

Requested Effective Date

(*) The email address is the contact address used by the subscriber to request the issuance of a digital certificate.

Today, at ... hours... on ... day ... month ... year ..., at ..., we include:

(*) The email address is the communication mailbox of the subscriber that has been used to apply for the digital certificate.

FORM NO. 05

(Issued pursuant to Circular No. 05/2010/TT-BNV dated July 1, 2010

of the Minister of Home Affairs)

SOCIALIST REPUBLIC OF VIET NAM
Independence - Freedom - Happiness
--------------

APPLICATION FOR WITHDRAWAL OF DIGITAL CERTIFICATE

Dear: <Subscriber Manager>

Full name of subscriber (in uppercase letters) …Gender:…

Date of birth: …Place of birth:…Nationality:…

ID Card Number/Passport Number: …Date of Issue:…Place of Issue:…

Permanent residence address:...

Workplace: …Telephone: …Fax:…

Position: …Department:…Email address(*):…

Home phone:…Mobile phone:…

Request to revoke digital certificate:…

Digital certificate number: …Date of issue …Expiry date…

Reason for revocation: …

Note: (*) The email address is the contact mailbox that the subscriber has used to request issuance of the digital certificate.