Rule, 2004

Text

Reproduced from the document India Code holds for this instrument. The Gazette prints Hindi and English side by side and this is the English; the Department's own PDF remains the authority.

axette of <3txdia

EXTRAORDINARY

*TPT1I—T3^3—^^T-T30^ (i)

PUBLISHED BY AUTHORITY

No. 492] NEW DELHI, FRMAY, NOVEMBER 5, 2004/KARTIKA 14,1926 f f '• :••' ••• '•••y': : •

MINISTRY OF COMMUNICATIONS AM) INFORMATION TECHNOLOGY

(Department of Information Technology)

NOTIFICATION

New Delhi, tlie 29lh October, 2004

G.S.R 735(E).—In .exercise of llie powers conferred by clause (e) of sub-section (2) of Section 87, read with

Section 16 of the Information Technology Act, 2000 (21 of 2000), the Central Government hereby makes tlie following rules, namely:—

1. Short title and commencement—(1) These rules may be called the Information Technology (Security Proce­ dure) Rules, 2004.

(2) They shall come into force on die date of thcirpublicatiou in the Official Gazette.

2. Definitions.—In these rules, unless the context otherwise requires,—

(a) "Act" means Uie Information Technology Act, 2000 (21 of 2000);

(b) "digital signature" means authentication of any electronic record by a subscriber by means of an elec­ tronic method orprocedure in accordance with die provisions of Section 3 of die Act;

(c) "hardware token" means a token which canbe connected to any computer system using Universal Serial Bus (USB) port;

(d) "smart card" means a device containing one or more integrated circuit cliips, wliich perform Uie functions of a computer's cendre processor, memory and input or output interface;

(e) words and expressions used in diese rules and not defined but defined in die Act shall have the meaning respectively assigned to diem in die Act.

3. Secure electronic record.—An electronic record sliall be deemed to be a secure electronic record for the purposes of die Act if it has been audienticated by means cf a secure digital signature.

4. Secure digital signature.—A digital signature shall be deemed to be a secure digital signature for die pur­ poses of the Act if the following procedure has been applied to it, namely:—

(a) that the smart card or hardware token, as die case may be, with cryptograpliic module, in it, is used to create die key pair;

(b) dial the private key used to create die digital signature always remains in die smart card or hardware token as die case may be;

(c) that the hash of the content to be signed is taken from tlie host system to tlie smart card or hardware token and tlie private key is used to create tlie digital signature and tlie signed hash is returned to tlie host system;

(d) that tlie information contained in tlie smart card or hardware token, as the case may be, is solely under tlie control of the person who is purported to have created the digital signature;

(e) that tlie digita 1 signature can be verified by using tlie public key listed in tlie Digital Signature Certificate issued • to that person;

(f) that tlie standards referred to in rule 6 of tlie Information Technology (Certifying Authorities) Rules, 2000 have been complied with, in so far as they relate to the creation, storage and transmission of the digital signature: and

(g) that tlie digital signature is linked to the electronic record in such a manner that if the electronic record was altered tlie digital signature would be inval idated. • S. LAKSHMINARAYANAN, Add! Secy.

Provisions this rule answers to

Read out of the instrument itself: an enabling provision is one it says it was made under, which is the power it rests on. The rest it names without resting on.

Other instruments under the same Act

All of the The Information Technology Act, 2000