CIRCULAR NO. 15/2025/TT-BKHCN REGULATING TECHNICAL REQUIREMENTS FOR DIGITAL SIGNATURE SOFTWARE, DIGITAL SIGNATURE VERIFICATION SOFTWARE AND THE GATEWAY FOR PUBLIC KEY INFRASTRUCTURE SERVICES

CIRCULAR

Regulations on technical requirements for digital signature software, digital signature verification software, and Public Service Authentication Gatewayverify digital signatures and the Gateway for public key signature authentication services

Pursuant to the Law on Electronic Transactions dated June 22, 2023;

BASED ON Decree No. 23/2025/NĐ-CP dated February 21, 2025 of the Government on electronic signatures and trusted services;

Pursuant to Decree No. 55/2025/NĐ-CP dated March 2, 2025 of the Government stipulating the functions, tasks, and organizational structure of the Ministry of Science and Technology;

AT THE SUGGESTION OF THE DIRECTOR OF THE NATIONAL ELECTRONIC CERTIFICATION CENTER;

The Minister of Science and Technology issues this Circular stipulating technical requirements for digital signature software, digital signature verification software, and the Public Service Authentication Gateway.

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

This Circular stipulates the following contents:

1. Technical requirements for digital signature software and digital signature verification software as prescribed in Article 17 of Decree No. 23/2025/NĐ-CP dated February 21, 2025 of the Government on electronic signatures and trusted services.

2. Guidelines for connecting to the Public Service Authentication Gateway established by the Ministry of Science and Technology as prescribed in Article 44 of Decree No. 23/2025/NĐ-CP dated February 21, 2025 of the Government on electronic signatures and trusted services.

Article 2. Applicability

This Circular applies to:

1. Organizations and individuals using digital signature software and digital signature verification software; organizations and individuals developing digital signature software and digital signature verification software; organizations providing authentication services for digital signatures when developing and using digital signature software and digital signature verification software.

2. Organizations providing authentication services for digital signatures; foreign organizations providing authentication services for electronic signatures recognized in Vietnam; managers of information systems serving electronic transactions that use digital signatures when connecting to the Public Service Authentication Gateway.

3. Other related organizations and individuals.

Article 3. Explanation of Terms

In this Circular, the following terms are understood as follows:

1. "Asymmetric key pair" means the public key and the corresponding private key.

2. "Private key" is a component of the asymmetric key pair used to sign data messages.

3. "Public key" is a component of the asymmetric key pair used to verify digital signatures on data messages.

4. "Hash function" is an algorithm that converts input data messages into a fixed-length string called a hash code. Hash functions are used to check the integrity of data messages and create digital signatures.

6. "Signer" is an individual or organization owning a digital signature certificate and using the corresponding private key to perform digital signing on data messages.

7. "Digital signature certificate" is a type of electronic signature certificate issued by an organization providing authentication services for digital signatures to provide information about the public key of an individual or organization, thereby confirming the individual or organization as the signer through the use of the corresponding private key.

8. "Digital signature software" is an independent program or a module of software or a solution with the function of digitally signing data messages.

9. "Digital signature verification software" is an independent program or a module of software or a solution with the function of verifying the validity of digital signatures on signed data messages.

10. "Trust path of the digital signature certificate" is an ordered list of digital signature certificates including the digital signature certificate of the subscriber, digital signature certificates of organizations providing authentication services for digital signatures, and the root trusted digital signature certificate to verify the origin of the digital signature certificate.

Chapter II

TECHNICAL REQUIREMENTS FOR THE FUNCTION OF DIGITAL SIGNATURE SOFTWARE AND DIGITAL SIGNATURE VERIFICATION SOFTWARE

Article 4. General Requirements

Comply with the technical requirements and standards for digital signatures on data messages used for digital signature software and digital signature verification software as set out in Appendix I attached hereto.

Article 5. Functional Requirements for Digital Signature Software

1. Function to authenticate the signing subject and perform digital signatures:

a) Verify the information of the signing subject on the digital signature certificate and check the validity of the digital signature certificate according to Clause 2 of this Article before allowing the execution of the digital signature;

b) Allow the signing subject to use the private key to perform the digital signature on the data message. The private key stored in the key storage medium used by the signing subject or authorized to be used for digital signatures must comply with the mandatory standards applicable to digital signatures, digital signature certificates on data messages used for digital signature software and digital signature verification software as set out in Appendix I attached hereto;

c) Allow conversion of the format of the data message into formats recommended for digital signature software and digital signature verification software as set out in Appendix I attached hereto;

d) Allow attachment of the digital signature, digital signature certificate, and timestamp of the digital signature to the data message after the digital signature has been performed;

đ) Support installation, integration, and updating of the digital signature certificates of the National Electronic Certification Center, public service certification organizations, and foreign electronic digital signature certificates recognized in Vietnam;

e) Allow attachment of a corresponding timestamp to the data message in cases where the law requires the data message to have a timestamp;

g) Ensure the integrity of the data message that has been signed.

2. Function to verify the validity of the digital signature certificate:

a) Authenticate the information in the digital signature certificate according to the legal provisions on electronic identification and authentication;

b) Verify the digital signature certificate of the signing subject through the trust path of the digital signature certificate or through the list of trusted foreign electronic digital signature certificates recognized in Vietnam. The trust path must link to the original digital signature certificate of the National Electronic Certification Center;

c) Meet the requirements regarding the validity of the digital signature certificate as set out in Appendix II attached hereto.

3. Function to connect to the Public Service Digital Signature Verification Gateway:

a) Develop components, programs, or solutions to facilitate connection to the Public Service Digital Signature Verification Gateway;

b) Comply with the Guidelines for Connecting to the Public Service Digital Signature Verification Gateway established by the Ministry of Science and Technology as stipulated in Article 8 of this Circular.

4. Function to store and delete information accompanying digitally signed data messages, including:

a) The digital signature certificate corresponding to the private key used by the signing subject to sign the data message at the time of signing;

b) The list of revoked digital signature certificates at the time of signing in the signing subject's digital signature certificate;

c) The result of checking the status of the digital signature certificate corresponding to the digital signature on the signed data message.

5. Function to change (add or remove) digital signature certificates of agencies or organizations issuing digital signature certificates:

Allow integration and full display of service certification organizations and lists of trusted foreign electronic digital signature certificates recognized in Vietnam.

6. Function to notify the signing subject of the success or failure of the digital signature on the data message, including:

a) Displaying notifications about the results of verifying the validity of the digital signature certificate;

b) Displaying notifications of successful or unsuccessful digital signatures in Vietnamese;

c) Downloading the signed data message to the device.

Article 6. Requirements for the function of digital signature verification software

1. Function to verify the validity of digital signatures on data messages:

a) Allow authentication of digital signatures on data messages according to the principle that the digital signature is created correctly with the private key corresponding to the public key in the digital signature certificate attached to the digital signature;

b) Allow verification of the digital signature certificate of the signatory subject through the trust path of that digital signature certificate and must link to the National Electronic Authentication Center or be included in the list of trusted foreign electronic signature certificates recognized in Vietnam;

c) Ensure that the digital signature certificate must meet the requirements for the validity of the digital signature certificate and the validity of the digital signature set out in Appendix II issued together with this Circular;

d) Allow verification of the integrity of digitally signed data messages through the following steps: decrypt the digital signature on the data message using the public key in the digital signature certificate to obtain information about the hash code of the data message; use the hash function to create a hash code on the digital signature to generate a hash code for the received data message; compare the matching of the two hash codes to verify the integrity of the digitally signed data message;

đ) Ensure verification of the validity of the digital signature on the signed data message according to the requirements for the validity of the digital signature set out in Appendix II issued together with this Circular;

e) Support installation, integration, and update of digital signature certificates from the National Electronic Authentication Center, public service certification organizations, and digital signature certificates included in the list of trusted foreign electronic signature certificates recognized in Vietnam;

g) Ensure the validity of the time stamp attached to the digital signature in cases where the digital signature is attached with a time stamp;

h) Ensure the integrity of the signed data message.

2. Function to store and revoke information accompanying digitally signed data messages:

a) The digital signature certificate corresponding to the digital signature on the signed data message;

b) A list of revoked digital signature certificates at the signing time, shown in the digital signature certificate attached to the signed data message;

c) The result of checking the status of the digital signature certificate corresponding to the digital signature on the signed data message.

3. Function to change (add, remove) digital signature certificates of agencies, organizations issuing digital signature certificates;

4. Function to notify in writing or by symbol whether the verification of the validity of the digital signature is valid or invalid:

a) Display notification of the validity of the digital signature on the signed data message in Vietnamese;

b) Display information about the digital signature and the digital signature certificate on the signed data message, with at least the following fields of information: information about the agency, organization issuing the digital signature certificate; information about the signatory subject; information about the management unit of the digital signature certificate; information about the signing time or time stamp (if any); the integrity of the signed data message; the validity of the digital signature at the signing time; the period of validity of the digital signature certificate.

Chapter III

NATIONAL PORTAL FOR PUBLIC KEY INFRASTRUCTURE SERVICES

Article 7. National Portal for Public Key Infrastructure Services

1. The National Portal for Public Key Infrastructure Services established by the Ministry of Science and Technology is prescribed in Decree No. 42/2022/NĐ-CP.

2. The National Portal for Public Key Infrastructure Services established by the Ministry of Science and Technology serves to connect public key infrastructure services with information systems supporting electronic transactions using digital signatures to ensure the authenticity, integrity, and non-repudiation of data messages.

Article 8. Connecting to the Public Digital Signature Certification Service Gateway established by the Ministry of Science and Technology

1. Organizations providing public digital signature certification services shall connect to the Public Digital Signature Certification Service Gateway established by the Ministry of Science and Technology, specifically:

a) Implementing the connection guidance set out in Appendix III attached to this Circular;

b) Providing technical specifications, parameters, and information for connecting to the National Electronic Certification Center;

c) Updating technical parameters or information for connecting when there are changes, to be provided to the National Electronic Certification Center.

2. Information systems serving electronic transactions that integrate with the Public Digital Signature Certification Service Gateway established by the Ministry of Science and Technology must ensure the authenticity, integrity, and non-repudiation of data messages, specifically:

a) Implementing the connection guidance set out in Appendix III attached to this Circular;

b) Ensuring that the digital signing function of the information system serving electronic transactions using digital signatures complies with the provisions of Article 5 of this Circular;

3. The National Electronic Certification Center shall provide and update technical specifications, parameters, and information for connecting to the Public Digital Signature Certification Service Gateway.

4. The focal point for supporting and guiding connections to the Public Digital Signature Certification Service Gateway established by the Ministry of Science and Technology is the National Electronic Certification Center and the Ministry of Science and Technology.

Chapter IV

IMPLEMENTATION PROVISIONS

Article 9. Implementation Organization

1. The National Electronic Certification Center is responsible for guiding the implementation of the contents of this Circular and publishing information as prescribed in Clause 3 of Article 8 of this Circular.

2. Organizations providing public digital signature certification services, foreign organizations providing digital signature certification services recognized in Vietnam shall be responsible for publishing digital certificate information related to the organization providing digital signature certification services and digital signature standards on their electronic news pages.

Article 10. Effective Date

1. This Circular takes effect from the date of issuance.

2. Circular No. 22/2020/TT-BTTTT dated September 7, 2020 of the Ministry of Information and Communications regarding technical requirements for digital signature software, digital signature verification software ceases to be effective from the date this Circular takes effect.

3. Information systems when developing and integrating software and applications using digital signatures shall comply with the provisions of this Circular.

4. The Head of the Office, Director of the National Electronic Certification Center, Heads of agencies and units under the Ministry, Directors of Provincial Departments of Science and Technology under central cities, state management agencies for electronic transactions as prescribed by law, relevant organizations and individuals are responsible for implementing this Circular.

5. During the implementation process, if there are difficulties or obstacles, agencies, organizations, and individuals shall promptly report to the Ministry of Science and Technology (National Electronic Certification Center) for consideration and resolution./.