2. Digital Signature Cryptography

3. Digital signature ‘Digital signature’ means authentication of any electronic record by means of an electronic method or procedure in accordance with the provisions of Section 3 Electronic record means data, record or data generated, image or sound, received or sent in an electronic form or microfilm or computer generated fiche Digital Signature Certificate to be issued by Certifying Authority Asymmetric Crypto System and hash functions details - as prescribed

4. Digital Signature Basically a digital signature is a two way process, involving two parties: The signer (creator of the digital signature) and The recipient (verifier of the digital signature). A digital signature is complete, if and only if, the recipient successfully verifies it.

5. Need for Digital Signature It has been realized that Internet being a public network would never be secure enough and there would always be a fear of interception, transmission errors, delays, deletion, authenticity or verification of an electronic message using Internet as a medium. Hence the goal was to protect the message, not the medium.

6. The art and science of keeping messages secure is cryptography Plain Text Encryption Decryption Cipher Text

7. Symmetric Cryptography Asymmetric Cryptography

8. Symmetric Cryptography When a single secret key is used to maintain communication between the sender and the receiver, it is referred to as a symmetric cryptography or private-key cryptographic system. Here, both encryption and decryption use the same key.

9. Plain Text Encryption Decryption Cipher Text Encryption Key(K1)Decryption Key(K2) Symmetric Cryptography K1 = K2

10. Asymmetric Cryptography For both the processes of encryption and decryption two different keys are used. It is referred to as a asymmetric cryptography or public-key cryptographic system.

11. Plain Text EncryptionDecryption Cipher Text Encryption Key(K1)Decryption Key(K2) Asymmetric Cryptography K1 = K2

12. ENCRYPTION Message 2 The Internet knows no geographical boundaries. It has redefined time and space. Advances in computer and telecommunication technologies have led to the explosive growth of the Internet. This in turn is affecting the methods of communication, work, study, education, interaction, leisure, health, governance, trade and commerce. Encrypted Message 2 a520eecb61a770f947ca856cd675463f1c95 a9a2b8d4e6a71f80830c87f5715f5f5933497 8dd7e97da0707b48a1138d77ced56feba2b4 67c398683c7dbeb86b854f120606a7ae1ed9 34f5703672adab0d7be66dccde1a763c736c b9001d0731d541106f50bb7e54240c40ba7 80b7a553bea570b99c9ab3df13d75f8ccfddd eaaf3a749fd1411 Message 1 Central to the growth of e-commerce and e- governance is the issue of trust in electronic environment. Encrypted Message 1 9a46894335be49f0b9cab28d755aaa9cd985 71b275bbb0adb405e6931e856ca3e5e569e dd135285482 DECRYPTION Encrypted Message 1 9a46894335be49f0b9cab28d755aaa9cd98571b 275bbb0adb405e6931e856ca3e5e569edd13528 5482 Message 1 Central to the growth of e-commerce and e- governance is the issue of trust in electronic environment. Encrypted Message 2 a520eecb61a770f947ca856cd675463f1c95a9a2b 8d4e6a71f80830c87f5715f5f59334978dd7e97da 0707b48a1138d77ced56feba2b467c398683c7db eb86b854f120606a7ae1ed934f5703672adab0d7 be66dccde1a763c736cb9001d0731d541106f50b b7e54240c40ba780b7a553bea570b99c9ab3df13 d75f8ccfdddeaaf3a749fd1411 Message 2 The Internet knows no geographical boundaries. It has redefined time and space. Advances in computer and telecommunication technologies have led to the explosive growth of the Internet. This in turn is affecting the methods of communication, work, study, education, interaction, leisure, health, governance, trade and commerce. Same Key SYMMETRIC Different Keys [Keys of a pair – Public and Private] ASYMMETRIC [PKI]

14. Hash Function [compression function, contraction function, message digest, finger print, cryptographic checksum, message integrity check, and manipulation detection code ] A Hash Function is a mathematical algorithm that takes a variable length input string and convert it to a fixed length output string [ called hash value]

15. Hash Function Message (Any Length) HASH Hash is a fixed length string 128 bit MD5 160 bit SHA-1

16. Digital Signature

17. Basically a digital signature is a two way process, involving two parties: –The signer (creator of the digital signature) and –The recipient (verifier of the digital signature). A digital signature is complete, if and only if, the recipient successfully verifies it.

18. Scanned but not Digital Signatures Concept of Digital Signatures Digital Signatures bab3dbfba30eedc0c52dacfc144df4d9c6508502

19. Signed Messages Message + Signature Message + Signature Hash Decrypt Signature With Sender’s Public Key Decrypt Signature With Sender’s Public Key SIGN hash With Sender’s Private key SIGN hash With Sender’s Private key Message + signature Message + signature COMPARE Calculated Hash Calculated Hash Message Sender Receiver Hash Signed Message Sent thru’ Internet if OK Signatures verified

20. Signed Messages Message + Signature Message + Signature Hash Decrypt Signature With Sender’s Public Key Decrypt Signature With Sender’s Public Key SIGN hash With Sender’s Private key SIGN hash With Sender’s Private key Message + signature Message + signature COMPARE Calculated Hash Calculated Hash Message Sender Receiver Hash Signed Message Sent thru’ Internet if OK Signatures verified

21. Hash Value, Digital Signatures Signature Algorithm SHA1RSA Message 1 This is a sample message for demonstration on digital signatures. This will be used to generate a message digest using sha1 and generating 160 bit digest Hash Value 1 7a08f27d5282b673fbb97cd028a7451292c052c8 Digital Signature 1 bab3dbfba30eedc0c52dacfc144df4d9c6508502 Message 3 This is a sample message for demonstration on digital signatures. This will be used to generate a message digest using sha1 and generating 160 bit digest. Hash Value 3 cd7db886d5e0e63d48c6c4358c86aa3d6e2afe86 Digital Signature 3 71892180a9af4dd59ceb285eda5cfc3e9b72aaf8 Message 2 This is a sample message for demonstration on digital signatures. This will be used to generate a message digest using sha1 and generating 160 bit digest. Hash Value 2 b3cafe1ea21f290ad8be71b510297d038b68a7f9 Digital Signature 2 5335ba87f67cfc65d7ea2d7dced44ea3dc16282c A dot is added at the end of the message Adding a space between bit and digest Signer’s Private Key Signer’s Private Key Signer’s Private Key

22. Paper signatures v/s Digital Signatures ParameterPaperDigital Authenticity May be forgedCan not be copied Integrity Signature independent of the document Signature depends on the contents of the document Non- repudiation a.Handwriting expert needed b.Error prone a.Any computer user b.Error free V/s

23. Paper signatures v/s Digital Signatures ParameterPaperDigital Purpose To authenticate the message as originating from purported signer Evidence distinctive, attributable to the signer only Signer Identification Notary /witnessesTrusted Third Party (CA) V/s

24. Digital signatures are based on asymmetric, or public key, cryptography and are capable of fulfilling the demand of burgeoning e- commerce by not only providing message authentication, integrity and non-repudiation function but also making it highly scalable.

25. The basic problem with the aforesaid digital signature regime is that it operates in online, software driven space, without human intervention. Sender sends a digitally signed message; recipient receives and verifies it. The only requirement is that both sender and the recipient to have digital signature software at their respective ends.

26. Law & E-Governance

27. Primary Legal Issues Surrounding E-Governance Adopting a functional equivalent approach Facilitating efficient Government-Citizen interface. The focus is to give due legal recognition to digital signatures and electronic records.

28. Legal Recognition of Electronic Records and Digital Signatures Legal recognition to electronic records and digital signatures.[Section 4& 5]. Use of electronic records and digital signatures in government and its agencies for filing, issue, grant, receipt or payment of money [Section 6]. Electronic records or information, whenever retained, as required by law must be retained in the format in which it was originally generated, sent or received[Section 7].

29. Publication of Electronic Gazette The IT Act provides that the rule, regulation, order, bye-law, notification or any other matter could now also be published in the Electronic Gazette apart from the Official Gazette [Section 8].

30. Limited Electronic Governance Rights It does not confer a right upon any person to insist that any Ministry or Department of the Central or State government (or any authority or body) to accept, issue, create, retain or preserve any document in the form of electronic records or to participate in any monetary transaction in the electronic form[Section 9].

31. Issue of Privacy

32. “Privacy is where technology and the law collide.” - Richard Smith (who traced the ‘I Love You’ and ‘Melissa viruses’)

33. Internet is not a private network. It is a shared- information network. As and when you log onto the Internet and navigate on the World Wide Web, your digital profile is being created. The same technology that makes it easy for you to find what you want when you want on the Internet also makes it easy for others to learn about you.

34. Though the Constitution of India has not guaranteed the right to privacy as a fundamental right to the citizens but nevertheless, the Supreme Court has come to the rescue of common citizen, time and again by construing “right to privacy” as a part of the right to “ protection of life and personal liberty”.

35. Privacy:Three Legal Principles

36. That the individual’s right to privacy exist and any unlawful invasion of privacy would make the ‘offender’ liable for the consequences in accordance with law; That there is constitutional recognition given to the right of privacy which protects personal privacy against unlawful governmental invasion; That the person’s “right to be let alone” is not an absolute right and may be lawfully restricted for the prevention of crime, disorder or protection of health or morals or protection of rights and freedom of others;

37. Freedom of Expression

38. The Indian Constitution lays down under Article 19 certain fundamental rights to every citizen. The Art. 19 uses the expression ‘freedom’ and mentions the several forms and aspects of it, which are secured to individuals, together with the limitations that could be, placed upon them in the general interest of the society.

39. Art.19(1)(a) provides “that all the citizens shall have the right to freedom of speech and expression”. But it should be read with sub-Art. (2), which imposes reasonable restrictions imposed by the State relating to 1.defamation; 2.contempt of court; 3.decency or morality; 4.security of the State; 5.friendly relations with foreign states; 6.incitement to an offence; 7.public order; and 8.maintenance of the sovereignty and integrity of India.

40. Thus fundamental right to freedom of speech and expression extends to the Internet medium as well. Every citizen has a freedom to acquire or share kowledge (or information) using Internet and related resources, subject only to reasonable restrictions.

41. Role of CERT-IN Computer Emergency Response Team – India, the single authority for issue of instructions in the context of blocking of websites. CERT-IN has to instruct the DoT to block the website after, 1.Verifying the authenticity of the complaint; 2.Satisfying that action of blocking of website is absolutely essential.

42. CERT-IN [Gazette Notification (Extraordinary) No. G.S.R. 181 (E), dated 27th February, 2003]is based on the premise that such blocking can be challanged if it amounts to restriction of freedom of speech and expression.

43. However, the websites promoting hate content, slander, or defamation of others, promoting gambling, promoting racism, violence and terrorism and other such material, in addition to promoting pornography, including child pornography, and violent sex can reasonably be blocked since all such websites may not claim constitutional right of free speech. Blocking of such websites may be equated to “balanced flow of information” and not censorship.

44. The following officers can submit the complaint to the Director, CERT-IN: Secretary, National Security Council Secretariat Secretary, Ministry of Home Affairs Foreign Secretary or a representative not below the rank of Joint Secretary Secretaries, Dept. of Home Affairs of each of the States and of the Union Territories CBI, IB, DG of Police of all the States Secretaries or Heads of all (IT Departments) of all the States and Union Territories not below the rank of Joint Secretary of Central Government Chairman of NHRC, Minorities Commission or SC or ST Commission or National Women Commission The directive of the court

45. “The law is the last interpretation of the law given by the last judge.” - Anon.