Decree No. 130/2018/ND-CP dated September 27, 2018 of the Government on detailing the Law on E-Transactions regarding digital signatures and digital signature certification services

DECREE

Detailing the Law on E-Transactions regarding digital signatures and digital signature certification services^[1]

Pursuant to the June 19, 2015 Law on Organization of the Government;

Pursuant to the November 29, 2005 Law on E-Transactions;

Pursuant to the June 29, 2006 Law on Information Technology;

Pursuant to the November 25, 2015 Law on Charges and Fees;

At the proposal of the Minister of Information and Communications;

The Government promulgates the Decree detailing the Law on E-Transactions regarding digital signatures and digital signature certification services.

Chapter I

GENERAL PROVISIONS

Article 1. Scope of regulation

This Decree prescribes in detail digital signatures and digital certificates; and the management, provision and use of digital signatures, digital certificates and digital signature certification services.

Article 2. Subjects of application

This Decree applies to agencies and organizations that manage or provide digital signature certification services, and agencies, organizations and individuals that use digital signatures, digital certificates and digital signature certification services in e-transactions.

Article 3. Interpretation of terms

In this Decree, the terms below are construed as follows:

1. “Key” means a sequence of binaries (0 and 1) used in cryptosystems.

2. “Asymmetric cryptosystem” means a cryptosystem which is able to create key pairs each consisting of a private key and a public key.

3. “Private key” means one key in a key pair in an asymmetric cryptosystem, which is used to create a digital signature.

4. “Public key” means one key in a key pair in an asymmetric cryptosystem, which is used to verify the digital signature created by the corresponding private key in the key pair.

5. “Digitally signing” means incorporating a private key into a software program for the automatic creation and attachment of a digital signature to a data message.

6. “Digital signature” means a type of e-signature which is created by transformation of a data message using an asymmetric cryptosystem whereby the person having the initial data message and public key of the signer may accurately determine:

a/ Whether such transformation is created with the private key corresponding to the public key in the same key pair;

b/ Whether the integrity of a data message has been kept since the transformation.

7. “Digital certificate” means a type of e-certificate which is issued by a digital signature certification authority with a view to providing identification information for the public key of an agency, organization or individual to certify that such agency, organization or individual signs the digital signature using the corresponding private key.

8. “Valid digital certificate” means a digital certificate which has not expired, or has not been suspended or revoked.

9. “Public digital certificate” means a digital certificate which is issued by a public digital signature certification authority.

10. “Foreign digital certificate” means a digital certificate which is issued by a foreign digital signature certification authority.

11. “Subscriber” means an agency, organization or individual that is issued a digital certificate, accepts that certificate and holds a private key corresponding to the public key shown in such certificate.

12. “Signer” means a subscriber who uses his/her private key to digitally sign a data message with his/her own name.

13. “Recipient” means an organization or individual that receives a data message digitally signed by a signer, and uses the digital certificate of such signer to verify the digital signature in such data message.

14. “Digital signature use application” means an information technology application permitting the integration and use of digital signatures for verification.

15. “Digital signature certification authority” means an e-signature certification authority that provides digital signature certification services.

16. “Public digital signature certification authority” means an organization that provides digital signature certification services for agencies, organizations or individuals for use in public activities. The provision of digital signature certification services by public digital signature certification authorities is a conditional business as prescribed by law.

Click download to see the full text