Circular No. 22/2020/TT-BTTTT stipulates technical requirements for digital signature software and digital signature verification software.

CIRCULAR

Regulations on technical requirements for digital signature software and digital signature verification software,digital signature verification software

Pursuant to the Law on Electronic Transactions November 29, 2005;

Pursuant to Decree No. 130/2018/NĐ-CP dated September 27, 2018 of the Government detailing the implementation of the Law on Electronic Transactions regarding digital signatures and digital signature certification services;

Pursuant to Decree No. 17/2017/NĐ-CP dated February 17, 2017, issued by the Government, on the functions, tasks, powers, and organizational structure of the Ministry of Information and Communications;

At the proposal of the Director of the National Electronic Certification Center,

The Minister of Information and Communications issues this Circular stipulating technical requirements for digital signature software and digital signature verification software.

PART I
GENERAL PROVISIONS

Article 1. Scope of Regulation

1. This Circular stipulates technical requirements for digital signature software and digital signature verification software.

2. Technical requirements for digital signature software and digital signature verification software for electronic documents in state agencies are not within the scope of regulation of this Circular.

Article 2. Applicability

1. This Circular applies to agencies, organizations, and individuals choosing to use digital signature software and digital signature verification software in electronic transactions; organizations providing digital signature certification services; organizations and individuals developing applications and using digital signatures.

2. This Circular does not apply to organizations providing specialized government digital signature certification services.

Article 3. Definitions

1. "Organizational Digital Certificate" is a type of electronic certificate issued by an organization providing digital signature certification services to provide identification information for the public key of an agency or organization, thereby confirming that the agency or organization is the signer of the digital signature by using the corresponding private key.

2. "Individual Digital Certificate" is a type of electronic certificate issued by an organization providing digital signature certification services to provide identification information for the public key of an individual, thereby confirming that the individual is the signer of the digital signature by using the corresponding private key.

3. "Organizational Private Key" is the private key corresponding to the organizational digital certificate.

4. "Individual Private Key" is the private key corresponding to the individual digital certificate.

5. "Digital Signature Software" is an independent software program or a component (module) of software or solution with the function of signing a digital signature onto a data message.

6. "Digital Signature Verification Software" is an independent software program or a component (module) of software or solution with the function of verifying the validity of a digital signature on a signed data message.

7. "Trust Path of the Digital Certificate" is the internet address information on the digital certificate indicating the organization providing digital signature certification services that has issued that digital certificate.

Chapter II
TECHNICAL REQUIREMENTS FOR DIGITAL SIGNATURE SOFTWARE AND DIGITAL SIGNATURE VERIFICATION SOFTWARE

Section 1 - Digital Signature Software

Article 4. General Requirements

Comply with technical standards for digital signatures on data messages as set out in the Appendix to this Circular containing the List of Technical Standards for Digital Signatures on Data Messages.

Article 5. Functional Requirements

1. Signing Function:

a) In the case where the signer of the data message is an individual, allow the signer to use their individual private key to sign the data message;

b) In the case where the signer of the data message is an organization, allow the signer to use their organizational private key to sign the data message.

2. Function to check the validity of the digital certificate:

a) Allow checking the digital certificate of the signer of the data message according to the trust path on the digital certificate and must be carried out to the national organization providing digital signature certification services;

b) Content of checking the validity of the digital certificate at the time of signing:

- Validity period of the digital certificate;

- Status of the digital certificate through the list of revoked certificates (CRL) published at the time of signing or by online certificate status checking method (OCSP) in real-time mode if the organization providing digital signature certification services provides OCSP service;

- Cryptographic algorithm on the digital certificate;

- Purpose and scope of use of the digital certificate.

c) Validity of the digital certificate when meeting all the following criteria:

- The time on the digital certificate is still valid at the time of signing;

- Cryptographic algorithms on the digital certificate comply with mandatory technical standards and regulations currently in effect regarding digital signatures and digital signature certification services;

- Status of the digital certificate is active at the time of signing;

- The digital certificate is used for its intended purpose and scope of use.

3. Function to store and delete the following information accompanying the signed data message:

a) The digital certificate corresponding to the private key used by the signer to sign the data message at the time of signing;

b) The list of revoked certificates at the time of signing issued by the organization providing digital signature certification services that issued the digital certificate for signing the corresponding digital signature on the outgoing data message;

c) The certification policy of the organization providing digital signature certification services that issued the digital certificate corresponding to the digital signature on the outgoing data message;

d) The result of checking the status of the digital certificate corresponding to the digital signature on the incoming data message received.

4. Function to change (add, remove) the digital certificate of the organization providing digital signature certification services.

5. Function to notify (in writing or by symbol) the signer whether the signing of the data message was successful or not.

Section 2-Digital Signature Verification Software

Article 6. General Requirements

||| Adhere to technical standards for digital signatures on data messages as set out in the Appendix List of Technical Standards for Digital Signatures on Data Messages attached to this Circular.

Article 7. Functional Requirements

1. Function to verify the validity of digital signatures on data messages:

a) Allow verification of digital signatures on data messages according to the principle that the digital signature is created correctly with the private key corresponding to the public key on the digital certificate;

b) Permit verification of the digital certificate of the signer on the data message along the trust path on the digital certificate and must be carried out until the national digital signature certification service provider organization;

c) Permit verification and authentication of information about the signer on the data message implementing all the following contents:

- Validity period of the digital certificate;

- Status of the digital certificate through the list of revoked certificates (CRL) published at the time of signing or by online certificate status checking method (OCSP) in real-time mode if the organization providing digital signature certification services provides OCSP service;

- Cryptographic algorithm on the digital certificate;

- Purpose and scope of use of the digital certificate.

d) Validity of the digital certificate when meeting all the following criteria:

- The time on the digital certificate is still valid at the time of signing;

- Cryptographic algorithms on the digital certificate comply with mandatory technical standards and regulations currently in effect regarding digital signatures and digital signature certification services;

- Status of the digital certificate is active at the time of signing;

- The digital certificate is used for its intended purpose and scope of use.

e) Permit verification of the integrity of digitally signed data messages:

- Decrypt the digital signature on the data message to obtain hash code information;

- Use a secure hash algorithm that generated the hash code on the digital signature to create a hash code for the data message;

- Compare the matching of the two hash codes to check the integrity of the digitally signed data message.

f) A digital signature on a data message is valid when:

- The verification and authentication of the signer's information is correct;

- The signer's digital certificate at the time of signing is still valid;

- Verify the digital signature on the data message correctly with the private key corresponding to the public key on the digital certificate and the data message ensures integrity.

2. Function to store and revoke the following information accompanying digitally signed data messages:

a) Corresponding digital certificates for digital signatures on sent digitally signed data messages;

b) Revocation lists of digital certificates at the time of signing from the digital signature certification service provider organization corresponding to the digital signature on the sent data message;

c) Certification rules of digital signature certification service provider organizations issuing digital certificates corresponding to the digital signatures on the sent data message;

d) The result of checking the status of the digital certificate corresponding to the digital signature on the incoming data message received.

3. Function to change (add, remove) digital certificates of digital signature certification service providers.

4. Function to notify (in writing/or symbolically) whether the verification of the validity of the digital signature is valid or invalid.

Chapter III
IMPLEMENTING PROVISIONS

Article 8. Implementation Organization

1. The National Electronic Certification Center is responsible for guiding the implementation of the contents of this Circular.

2. Public digital signature certification service providers, specialized digital signature certification service providers for agencies and organizations shall publish technical specifications (documents and toolkits), related digital certificates, and digital signature standards on the electronic news website of the digital signature certification service provider organization.

3. Organizations and individuals developing applications, using digital signatures are responsible for complying with technical requirements and usage guidelines for digital signature software and digital signature verification software.

Article 9. Transitional Provisions

Agencies, organizations, and individuals currently using digital signature software and digital signature verification software before the effective date of this Circular continue to use until changing, upgrading, or replacing new software, comply with the provisions of this Circular.

Article 10. Effective Date

1. This Circular takes effect from November 1, 2020.

2. The Director of the Office, the Director of the National Electronic Certification Center, Heads of Ministries, Departments under the Ministry, Directors of Provincial Departments of Information and Communications, organizations, and individuals related to this Circular are responsible for its implementation.

3. During the implementation process, if there are difficulties or obstacles, agencies, organizations, and individuals should promptly report to the Ministry of Information and Communications (National Electronic Certification Center) for review and resolution./.

ANNEX

TECHNICAL STANDARDS LIST FOR DIGITAL SIGNATURES ON DATA MESSAGES

(Issued together with Circular No. 22/2020/TT-BTTTT dated September 7, 2020
1. Amending and supplementing Clause 2, Article 3 as follows:)