This Circular stipulates the provision, management, and use of specialized digital signature authentication services for agencies under the political system, managed by the Government Cryptographic Department. It also guides the procedures for creating and distributing key pairs, issuing and revoking digital certificates, as well as the responsibilities of the parties involved.
적용 범위
Agencies, organizations, and individuals under the political system, including the Government Cryptographic Department, the Cryptographic Bureau of the General Staff, the Cryptographic Bureau H48 of the Logistics and Technical General Department, the Cryptographic Bureau of the Ministry of Foreign Affairs, and the Cryptographic Bureau 893 of the Government Cryptographic Department.
핵심 사항
- The organization providing specialized digital signature authentication services is solely managed by the Government Cryptographic Department.
- Certificate applicants must be organizations or individuals under the political system and meet the prescribed conditions.
- The certificate issuance process consists of four steps: application submission, review, certificate creation, and announcement of validity.
- Digital certificates will be revoked upon expiration of their validity period or at the request of judicial authorities or security agencies.
- The account manager is responsible for the accuracy of the information and the transfer of the digital certificate to the user.
🌐 이 문서의 사회적 영향
- Facilitate the use of digital signature authentication services by agencies under the political system.
- Reduce risks related to information security and data confidentiality in electronic transactions.
- Continue to maintain strict management over digital certificates to ensure the legality and effectiveness of political activities.
❓ 자주 묻는 질문
Which agencies are responsible for providing specialized digital signature authentication services?
The sole entity permitted to provide this service is established and managed by the Government Cryptographic Department.
What conditions must users meet to obtain a digital certificate?
Users must be organizations or individuals under the political system and fulfill the obligations and responsibilities of users as prescribed.
What steps does the digital certificate issuance process include?
It includes application submission, review, certificate creation, and announcement of validity. Users must provide complete documentation to the account manager.
Under what circumstances will a digital certificate be revoked?
A digital certificate will be revoked upon expiration of its validity period, if the secret key is disclosed or suspected to be disclosed, if the device storing the secret key is lost, or if there is a change in the authority's position.
What responsibilities does the account manager need to perform?
They must review and approve lists of users requesting certificates and revocation; hand over digital certificates to users; promptly notify the service provider when there is a request for revocation.
전문
|
MINISTRY OF HOME AFFAIRS |
SOCIALIST REPUBLIC OF VIET NAM |
|
Number: 05/2010/TT-BNV |
Hanoi, July 1, 2010 |
CIRCULAR
GUIDELINES ON THE PROVISION, MANAGEMENT AND USE OF SPECIALIZED DIGITAL SIGNATURE VERIFICATION SERVICES FOR ORGANIZATIONS IN THE POLITICAL SYSTEM
SPECIALIZED DIGITAL SIGNATURE VERIFICATION SERVICES FOR ORGANIZATIONS IN THE POLITICAL SYSTEM
THE MINISTER OF THE MINISTRY OF HOME AFFAIRS
Pursuant to Decree No. 48/2008/NĐ-CP dated April 17, 2008 of the Government stipulating the functions, tasks, powers, and organizational structure of the Ministry of Home Affairs;
Pursuant to Decree No. 26/2007/NĐ-CP dated February 15, 2007 of the Government detailing the implementation of the Electronic Transactions Law regarding digital signatures and digital signature certification services;
At the proposal of the Director of the Government Cryptographic Agency,
REGULATIONS
PART I
GENERAL PROVISIONS
Article 1. Scope of Regulation and Applicability
These Circulars provide guidelines on the provision, management, and use of specialized digital signature verification services for the purpose of verifying information, validating digital signatures, ensuring security and safety of information in electronic transactions conducted by organizations, entities, and individuals within the political system.
Article 2. Specialized Digital Signature Verification Services for Organizations in the Political System
Specialized digital signature verification services for organizations in the political system include:
1. Creation and distribution of key pairs.
2. Issuance and revocation of digital certificates.
3. Publicizing and maintaining online databases of digital certificates.
4. Other related services as prescribed.
Article 3. Organization Providing Specialized Digital Signature Verification Services for Organizations in the Political System
The organization providing specialized digital signature verification services for organizations in the political system, established and maintained by the Government Cryptographic Agency in accordance with Clause 4, Article 6 of Decree No. 26/2007/NĐ-CP dated February 15, 2007 of the Government detailing the implementation of the Law on Electronic Transactions regarding digital signatures and digital signature verification services, is the sole entity responsible for providing specialized digital signature verification services for organizations in the political system.
Address: No. 105 Nguyen Chi Thanh, Dong Da, Hanoi
Email address: [email protected]
Website address: http://ca.gov.vn
Telephone/Fax: (04) 37738668
Article 4. Authority Receiving Requests for Specialized Digital Signature Verification Services for Organizations in the Political System
1. The authority receiving requests for specialized digital signature verification services for organizations in the political system is the cryptographic agency designated by the Director of the Government Cryptographic Agency to be the lead agency in receiving requests for issuance and management of digital certificates (hereinafter referred to as the request receiving authority).
2. The request receiving authorities include:
a) The Cryptographic Bureau - General Staff Department for requests within the scope of the Ministry of National Defense:
Address: No. 7 Nguyen Tri Phuong, Ba Dinh, Hanoi.
Email address: [email protected]
b) The Cryptographic Bureau H48 - Logistics and Technical General Department for requests within the scope of the Ministry of Public Security:
Address: No. 44 Yet Kieu, Hoan Kiem, Hanoi
Email address: [email protected]
c) The Cryptographic Bureau - Ministry of Foreign Affairs for requests within the scope of the Ministry of Foreign Affairs:
Address: No. 1 Ton That Dam, Ba Dinh, Hanoi
Email address: [email protected]
d) The Cryptographic Bureau 893 - Government Cryptographic Agency for requests from other agencies:
Address: No. 60 Nguyen Chi Thanh, Dong Da, Hanoi
Email address: [email protected]
Article 5. Subscriber Manager
1. The heads of Party Committees, Secretaries of the Central Party Office, heads of central agencies of mass organizations, Chairpersons of the Central Committee of the Vietnam Fatherland Front, Directors of the National Assembly Office, Directors of the State President's Office, Chief Justices of the Supreme People's Court, Procurators-General of the Supreme People's Procuracy, State Auditor General, Ministers, Heads of Ministries-equivalent agencies, Heads of government-affiliated agencies, Secretaries of provincial party committees directly under the Central Committee, Chairpersons of Provincial People's Councils, Chairpersons of Provincial People's Committees directly under the Central Committee, and other organizations as prescribed by competent authorities are subscriber managers responsible for managing subscribers under their respective agencies and organizations in accordance with Article 11 of this Circular.
2. Persons specified in Clause 1 of this Article may delegate the responsibility of subscriber manager to the heads of subordinate agencies and units. Lists of delegations shall be sent to the Government Cryptographic Agency at No. 105 Nguyen Chi Thanh, Dong Da, Hanoi.
Article 6. Digital Certificate
1. The contents of a digital certificate include:
a) The name of the organization providing the digital certificate;
b) The name of the subscriber;
c) The serial number of the digital certificate;
d) The validity period of the digital certificate;
đ) The public key of the subscriber;
e) The digital signature of the organization providing specialized digital signature certification services for agencies within the political system;
g) Restrictions on the purpose and scope of use of the digital certificate;
h) Other information for management, use, security, and confidentiality purposes as specified by the organization providing digital signature certification services.
2. Validity period of the digital certificate:
a) Not exceeding twenty years for digital certificates of organizations providing digital signature certification services;
b) Not exceeding five years for digital certificates of subscribers.
3. Types of digital certificates for subscribers:
The organization providing specialized digital signature certification services for agencies within the political system provides two types of digital certificates for subscribers:
a) A digital certificate for signing data messages;
b) A digital certificate for encrypting data messages.
Chapter II
DIGITAL SIGNATURE VERIFICATION SERVICES
Article 7. Creation and Distribution of Key Pairs
1. Subscribers' key pairs are created by the organization providing specialized digital signature certification services for agencies within the political system;
2. The private key is stored on a device and transferred to the subscriber through secure methods.
Article 8. Issuance of Digital Certificates
1. Subscribers requesting issuance of digital certificates must meet the following conditions:
a) Being an organization or individual within the political system;
b) Fulfilling the obligations and responsibilities of subscribers as stipulated in Article 13 of this Circular.
2. The process of issuing digital certificates:
a) Subscribers prepare a request for issuance of a digital certificate and send it to the subscriber manager as specified in Article 5 of this Circular (using Form No. 01);
b) The subscriber manager, based on requirements for ensuring security and verifying information in electronic transactions serving their agency's tasks, reviews and compiles a list of subscribers requesting digital certificates and sends it to the authority receiving certification requests (using Form No. 02);
c) Within three working days from the date of receipt of the request for issuance of a digital certificate, the authority receiving certification requests checks the application, and if it is valid, compiles a list of requests for issuance of digital certificates (using Form No. 02) along with a copy of the list of requests for issuance of digital certificates sent by the subscriber manager to the Government Cryptographic Department (by written document or through an active digital certificate);
In case the application is not valid, the authority receiving certification requests guides the subscriber manager to complete the application;
If the request from the subscriber manager is not accepted, the authority receiving certification requests informs the subscriber manager of the reasons and reports to the Government Cryptographic Department;
đ) Upon receipt of the list of requests for issuance of digital certificates from the authority receiving certification requests, the organization providing specialized digital signature certification services for agencies within the political system is responsible for creating digital certificates to issue to subscribers;
e) The issuance of digital certificates to subscribers is carried out as follows: The organization providing specialized digital signature certification services for agencies within the political system transfers the digital certificates to the authority receiving certification requests to transfer them to the subscriber manager; the subscriber manager hands over the digital certificates to the subscribers; the handover process is documented in a handover record (using Form No. 03);
f) After handing over the digital certificate to the subscriber, the subscriber manager submits a request for the effective date of the digital certificate (using Form No. 04) to the Government Cryptographic Department (by written document or through an active digital certificate). The organization providing specialized digital signature certification services for agencies within the political system is responsible for publishing the digital certificate of the subscriber on its website at the address: http://ca.gov.vn. The digital certificate of the subscriber becomes effective from the date it is published by the organization providing specialized digital signature certification services for agencies within the political system. The publication of the contents of the digital certificate is conducted according to the provisions of Article 6 of this Circular.
3. In cases where a request for issuance of a digital certificate for an authorized person of an agency or organization as prescribed by laws on seal management and use is made, in addition to implementing the procedures stipulated in Clause 2 of this Article, the subscriber must provide the following documents to the subscriber manager:
a) A certified true copy of the registration certificate of the seal model of the agency or organization or state position issued in accordance with the laws on seal management and use;
b) A certified true copy of the document confirming the position of the authorized person of the agency or organization or state position.
Article 9. Revocation of digital certificates
1. Revocation of digital certificates in the following cases:
a) The digital certificate has expired;
b) At the written request of the subscriber, confirmed by the subscriber manager (using Form No. 05) in cases where the private key is exposed or suspected to be exposed; the device storing the private key is lost, copied, or other security breaches occur;
c) At the written request (or through an active digital certificate) from investigative agencies or security agencies;
d) At the written request (or through an active digital certificate) from the subscriber manager;
đ) The subscriber changes job positions or retires;
e) In cases where the digital certificate for an authorized person of an agency or organization as prescribed by laws on seal management and use changes positions;
g) The subscriber violates regulations on managing and using the private key and devices storing the private key as stipulated in Article 13 of this Circular.
2. The process of revoking digital certificates:
a) All requests for revocation of digital certificates must be notified to the subscriber manager. The subscriber manager sends the request for revocation of the digital certificate to the organization providing specialized digital signature certification services for agencies within the political system. The request for revocation of the digital certificate can be sent through an active digital certificate or by the fastest means possible in writing.
b) Upon receiving a request to revoke the digital certificate, the organization providing specialized digital signature authentication services for agencies within the political system shall immediately render the digital certificate ineffective and announce the revocation of the digital certificate on the website of the organization providing specialized digital signature authentication services for agencies within the political system at the address: http://ca.gov.vn; simultaneously notify in writing (or through an active digital certificate) the agency receiving the authentication request and the user account manager;
c) After receiving the document revoking the digital certificate, the user account manager shall recover the device storing the secret key, return it to the organization providing specialized digital signature authentication services for agencies within the political system through the agency receiving the authentication request. The handover process must be documented according to form number 03.
Chapter III
RESPONSIBILITIES AND LIMITATIONS OF THE PARTIES
Article 10. For the organization providing specialized digital signature authentication services for agencies within the political system
1. Generate key pairs, issue, and revoke digital certificates.
2. Ensure absolute security of the secret key of the digital certificate and handle situations during the provision and management of digital certificates.
3. Manage and operate the technical infrastructure of the digital signature authentication system, ensuring the safe and continuous provision of digital signature authentication services.
4. Fully, accurately, and update information about users during the validity period of the digital certificate and for a minimum of five years from the date the digital certificate expires.
5. Ensure channels for receiving requests to issue, revoke digital certificates, updates, and maintain 24 hours a day, seven days a week online databases regarding digital certificate policies, digital certificates of the organization providing digital signature authentication services, regulations on the provision, management, and use of digital signature authentication services, lists of valid digital certificates, revoked digital certificates, and other necessary information.
6. Guide and inspect organizations and individuals responsible for registration, provision, management, and use of digital signature authentication services.
7. Revoke digital certificates when there is sufficient basis to determine that the user has violated the provisions of this Circular.
8. Comply with other legal regulations concerning the management and use of digital certificates.
Article 11. For the user account manager
1. Examine and approve the list of users requesting issuance, revocation of digital certificates.
2. Be responsible for the accuracy of the information about users requesting issuance, revocation of digital certificates.
3. Hand over digital certificates to users, guide, and inspect users under their authority during the use of digital certificates, secret keys, and the implementation of the provisions of this Circular.
4. Timely notify and request the organization providing specialized digital signature authentication services for agencies within the political system to revoke digital certificates in cases stipulated in Article 9 of this Circular.
5. Organize the storage of user account management request documents for issuing, revoking digital certificates and the handover records between the user account manager and the user.
Article 12. Regarding the agency receiving certification requests
1. Receiving requests, examining files, and compiling a list to propose issuance of digital certificates from the subscriber managers.
2. Receiving, delivering digital certificates and secret key storage devices to the Service Provider for specialized digital signature certification serving agencies within the political system or subscriber managers as stipulated in Articles 8 and 9 of this Circular.
3. Statistics, monitoring, and reporting on the use of digital certificates within their management scope every six months to the Government Cryptographic Office.
4. Managing and maintaining databases on subscribers and digital certificates within their management scope.
Article 13. Regarding subscribers
1. Providing accurate and complete information related to the issuance of digital certificates.
2. Promptly notifying the subscriber manager to revoke their own digital certificate in cases specified at points b, d, e, and g of Clause 1, Article 9 of this Circular.
3. Managing and using secret key storage devices under state secrecy regulations at the "Top Secret" level.
4. Being responsible for fully implementing all regulations, procedures for managing and using digital certificates, and complying with laws governing the management and use of digital certificates and digital signatures.
Chapter IV
IMPLEMENTATION
Article 14. Responsibilities of agencies within the political system
1. Effectively deploying and applying digital certificates and digital signature certification services.
2. Proposing issuance of digital certificates for subscribers under their management based on security and information verification requirements for electronic transactions serving agency tasks.
Article 15. Responsibilities of the Government Cryptographic Agency
1. Managing and directing the Service Provider for specialized digital signature certification serving agencies within the political system to ensure effective provision of digital certificates and certification services based on planned needs of agencies within the political system.
2. Cooperating with relevant agencies to integrate digital signatures into applications to ensure security and information verification.
3. Studying and applying appropriate digital signature technologies for information technology applications serving agencies within the political system.
4. Assisting the Minister of Home Affairs in guiding, monitoring, and inspecting the implementation of this Circular.
Article 16. Effective Date
1. This Circular takes effect from August 15, 2010.
2. During implementation, if issues arise, they should be promptly reported to the Ministry of Home Affairs (through the Government Cryptographic Office) for consideration and resolution.
|
THE MINISTER |
FORM NO. 01
(Issued pursuant to Circular No. 05/2010/TT-BNV dated July 1, 2010
of the Minister of Home Affairs)
SOCIALIST REPUBLIC OF VIET NAM
Independence - Freedom - Happiness
--------------
APPLICATION FOR ISSUANCE OF DIGITAL CERTIFICATE
To: <Subscriber Manager> (1)
Full Name (in capital letters) …Gender: Male □ Female □
Date of Birth: …/……./…Place of Birth:…
ID Card Number/Passport Number: …Date of Issue:…Place of Issue:…
Permanent residence address:...
Workplace: …Telephone: …Fax:…
Position: …Agency/Unit:…
Email Address (2)…Telephone NR …Mobile Phone…
Previous Digital Certificate Number (if applicable): …Date of Issue …Expiry Date:…
Requested Validity Period (maximum five years from the date of issuance):…years…
Attached Documents (3):
- A valid copy of the registration certificate for the official seal issued according to the law on seal management and use.
- A valid copy of the confirmation document of the authority position issued by the agency, organization, or state function.
- I hereby declare that the information provided above is true. If it is false, I will bear full responsibility under the law.
- If my request for a digital certificate is approved, I promise to strictly comply with all regulations regarding the management and use of digital signatures, digital certificates, and digital signature certification services.
|
Date…. month …. year ….. |
APPLICANT'S SIGNATURE AND Note: (1) Persons specified in Article 5 of Circular No. …/2010/TT-BNV |
(2) The email address is the main contact address for the subscriber provided by the agency or organization (digital certificates are only issued to users with email addresses belonging to agencies within the political system).
(3) In case of requesting a digital certificate for the authority holder of an agency or organization according to the law on seal management and use.
<The agency of the subscriber manager or the agency receiving certification requests>
FORM NO. 02
(Issued pursuant to Circular No. 05/2010/TT-BNV dated July 1, 2010
of the Minister of Home Affairs)
|
<Number, code> LIST OF APPLICATIONS FOR ISSUANCE OF DIGITAL CERTIFICATES Number of registrations: … |
SOCIALIST REPUBLIC OF VIET NAM |
|
Registration List: |
ID Card Number/Passport Number/Date of Issue/Place of Issue
Respectfully submitted to: ...
Agency/Unit Name
Province/City
|
Serial number |
Full Name |
Place of birth |
Authority Position (*) |
Previous Digital Certificate Number (if applicable) |
…,date … month … year … |
Position |
SUBSCRIBER MANAGER |
Email address |
OR HEAD OF THE AGENCY RECEIVING |
|
1 |
|||||||||
|
2 |
|
|
CERTIFICATION REQUESTS (*) In case of requesting a digital certificate for the authority holder of an agency or organization according to the law on seal management and use, clearly write the authority position and name of the agency or organization that received the registration certificate for the official seal. RECORD OF DELIVERY AND RECEIPT OF DIGITAL CERTIFICATES |
Today, at ... hours... on ... day ... month ... year ..., at ..., we include:
Unit:...
FORM NO. 03
(Issued pursuant to Circular No. 05/2010/TT-BNV dated July 1, 2010
of the Minister of Home Affairs)
SOCIALIST REPUBLIC OF VIET NAM
Independence - Freedom - Happiness
-----------------
Unit Address:...
Both parties agree on the delivery and receipt of digital certificates as follows:
I. Transferor:
The Deliverer has delivered to the Receiver: ... (in words:...) set(s) of digital certificates, specifically as follows:
Secret Key Storage Device Serial Number
Representative:…
Position:…
II. Transferee:
The Deliverer has delivered to the Receiver: ... (in words:...) set(s) of digital certificates, specifically as follows:
Secret Key Storage Device Serial Number
Representative:…
Position:…
Reason for Delivery and Receipt (1)
Effective Date of Digital Certificate (2)
|
Serial number |
Full Name |
Certificate serial number |
(Day/Month/Year) |
Notes (3) |
This record of delivery and receipt is made in two copies, the Deliverer retains one copy, and the Receiver retains one copy. (1) "New Issuance" in case of new issuance of digital certificates |
"Revocation" in case of revocation of digital certificates |
|
1 |
||||||
|
2 |
||||||
|
… |
(2) In case of new issuance of digital certificates, clearly indicate the effective date of the digital certificate
|
REPRESENTATIVE OF THE TRANSFERRING PARTY |
REPRESENTATIVE OF THE RECEIVING PARTY |
Note:
(3) In case of revocation of digital certificates lacking secret key storage devices, clearly indicate the reason.
FORM NO. 04
<Agency of the Subscriber Manager>
Regarding the request for the effective date of the digital certificate
Number of Requests: …
(Issued pursuant to Circular No. 05/2010/TT-BNV dated July 1, 2010
of the Minister of Home Affairs)
|
Request List: Email Address (*) |
SOCIALIST REPUBLIC OF VIET NAM |
|
Registration List: |
NOTICE
Time of Handover of Digital Certificates to Subscribers
Respectfully submitted to: Government Cryptographic Board
Requested Effective Date
(*) The email address is the contact address used by the subscriber to request the issuance of a digital certificate.
|
Serial number |
Full Name |
APPLICATION FOR REVOCATION OF DIGITAL CERTIFICATE |
Certificate serial number |
Period for transferring the digital certificate number to the subscriber (1) "New Issuance" in case of new issuance of digital certificates |
Effective time of the request (1) "New Issuance" in case of new issuance of digital certificates |
|
1 |
/ / |
||||
|
2 |
|||||
|
… |
|
|
CERTIFICATION REQUESTS |
Today, at ... hours... on ... day ... month ... year ..., at ..., we include:
(*) The email address is the communication mailbox of the subscriber that has been used to apply for the digital certificate.
FORM NO. 05
(Issued pursuant to Circular No. 05/2010/TT-BNV dated July 1, 2010
of the Minister of Home Affairs)
SOCIALIST REPUBLIC OF VIET NAM
Independence - Freedom - Happiness
--------------
APPLICATION FOR WITHDRAWAL OF DIGITAL CERTIFICATE
Dear: <Subscriber Manager>
Full name of subscriber (in uppercase letters) …Gender:…
Date of birth: …Place of birth:…Nationality:…
ID Card Number/Passport Number: …Date of Issue:…Place of Issue:…
Permanent residence address:...
Workplace: …Telephone: …Fax:…
Position: …Department:…Email address(*):…
Home phone:…Mobile phone:…
Request to revoke digital certificate:…
Digital certificate number: …Date of issue …Expiry date…
Reason for revocation: …
|
Date…. month …. year ….. |
APPLICANT'S SIGNATURE AND Note: (1) Persons specified in Article 5 of Circular No. …/2010/TT-BNV |
Note: (*) The email address is the contact mailbox that the subscriber has used to request issuance of the digital certificate.
원본 문서(PDF)
관계도
문서를 클릭하면 열립니다. 빨간 테두리＝효력을 변경하는 관계.