Chương II Thông tư 41/2017/TT-BTTTT: Quy định về ký số, kiểm tra chữ ký số trên văn bản điện tử trong cơ quan nhà nước

Chapter II

DIGITAL SIGNING AND VERIFICATION OF DIGITAL SIGNATURE ON ELECTRONIC DOCUMENTS OF REGULATORY AGENCIES

Article 6. Digital signing on e-documents

1. The digital signing is done through digital signature software; the successful or unsuccessful digital signing of e-documents must be notified through the software.

2. Digital signing on e-documents

a) In case of personal signer, through digital signature software, the competent person shall use the private key to digitally sign the e-document;

b) In case of corporate signer, through digital signature software, the clerical staff assigned to use the seal secret key of the corporate shall digitally sign the e-document;

3. Information about digital signatures of personal or corporate signer on e-documents shall be displayed in accordance with regulations of the Ministry of Home Affairs.

4. Information about the personal or corporate signer shall be managed in the database accompanying the digital signature software. Information subject to management is specified in Clause 4, Article 1 of the Government's Decree No. 106/2011/ND-CP dated November 23, 2011.

Article 7. Verification of digital signature on e-document

1. Digital signature on e-document shall be verified as follows:

a) Decrypt the digital signature with the corresponding public key;

b) Verify the information of the personal signer on the digital certificate attached to the e-document; The verification of digital signer shall comply with Article 8 of this Circular;

c) Check the integrity of the digitally-signed document.

2. The digital signature on the e-document is valid when the verification of information about the digital certificate of the digital signer at the signing time is still valid, the digital signature is created by the secret key corresponding to the public key on digital certificate and the integrity of the e-document is ensured.

3. Information about the personal or corporate signer on e-documents must be managed in the database accompanying the digital signature validation software. Information subject to management is specified in Clause 4, Article 1 of the Government's Decree No. 106/2011/ND-CP dated November 23, 2011.

Article 8. Examination of validity period of the digital certificate

1. The validity of a digital certificate at the time of digital signing shall be checked following the steps below:

a) Examine the validity of the digital certificate through the certificate revocation list (CRL) published at the time of digital signing or through OCSP;

b) To check the digital certificate of a personal signer on an e-document, it is required to pay a visit to the Root CA.

2. A digital certificate is valid when it meets all of the following criteria:

a) It still remains valid at the time of signing;

b) It is consistent with the scope of use and legal liability of the signer;

c) The status of the digital certificate is still active at the time of digital signing.

3. The digital certificate is invalid when it fails to meet one of the criteria in Clause 2 of this Article.

Article 9. Profile attached to digitally-signed document

1. Profile attached to digitally-signed document includes:

a) Regarding outgoing documents:

- Digital certificate of the personal signer at the time of signing;

- The certificate revocation list (CRL) at the time of signing of CA;

- Certificate practices statement of CA at the time of signing;

- Liability of the signer;

- Certificate of valid time stamp at the time of signing.

b) Regarding incoming documents:

- Digital certificates corresponding to digital signatures on incoming documents;

- The certificate revocation list (CRL) at the time of signing of CA;

- Certificate practices statement of CA at the time of signing;

- Liability of the signer;

- Certificate of valid time stamp at the time of receipt.

3. Profile attached to the e-document shall be managed using digital signature software, digital signature validation software suitable with the storage time of the e-document as prescribed.

Article 10. Cancellation of profile attached to digitally-signed document

1. The profile attached to e-document shall be cancelled together with the e-document.

2. The cancellation of profile attached to e-document may not prejudice other e-documents and shall ensure the ordinary course of the system.

3. The profile attached to e-document shall be cancelled using a software.