jfcjgg; JJo i?\o T^o-33 004/99 REGD.NO. D. L.-3 3004/99 (LUe (Baxette of J3txdia 5RT EXTRAORDINARY *TFT II—Tfn^ 3—3^-13^ (i)
PART H—Scction 3—Sub-section (i) wf*wtK ^ w<?iif>m PUBLISHED BY AUTHORITY *T. 5301 No. 530| •^i f^frft, TgXm, 3TTTRT 26, 2015/9TT5 4, 1937 NEW DELHI, WEDNESDAY, AUGUST 26,2015/BHADRA 4,1937 (^ f£ t f ^£ t 3ifc ̂ R T jfl*TlPt«iit t%*TPT) ^ r f f ^ f t , 25 3PJWf 2016 WT.^F.ft 660(3T).—%^sffa STĈ TT, g w Hlfl")Pl<fl srf^RW, 2000 (2000 ^T 21) ^ t STTTT 87 5TTT
(i)^T?RTn'^?rrer^?n^3r^rq"^ifir< {%f$m R<*HJ Finn, 200I i
(2)^5^TRT^^^rari?pTftrnft^^H^r^nti ] 0*) "srf^rftw ^ ĝ RT M ^ l i f^nr, 2000 (2000 w 21) arf^r | ;
(^) "^?lAVn^$Ff\ ftaft n<w^n*i sr̂ rq- ^TTSK % TRET f%tft ̂ f r f ^ t srf^ar *PT f̂ ra% 3M3ClrtS0!S <>> .
THI QAgETTl OP INDIA i EXTRAORDINARY [PART ll-See, 3{l)] w (I) CD
(w) M "ffafa f ? W fftRTtfT # # f t itTOTT m W^Tffr S T f ^ | f%f% WTW t W ^ f r # pTTSft ^HI«IH^ wrtf f%̂ wrf |;
'twriR w ^fttwr" ft flfsft iwTDiT w *rf^pf srf̂ rtw | Pn^r from trw % *tirt fWte M^rtr^ nfl^iR* wfWhr\ t fait ^ ^ 9 1 >tffa fwr^ wfNr ^ tftf If prrsrftfr f*rwr w WTWwrrpt Mk wtffftw w r jfWfer |;
"tij-ti p f t ^ f p r srflrtw | # M ^ f w wit ifwrsrc arc wr wnr WT *RW t wŵ sfwnr It:
"fafwflr p fmt 11 w?tf pwmr frw •rftfcr | f5rt fmwrf f smf&ft HIWHT w vsr m^tiw4frt1 WTflnj *HITNHH*IO wrttutrir^ftr%%^^eumn % # ? ^ m i m <nniK"iT^t^m'ymiTt;
/ I t m^m tr ̂ ^p^w ^ ^ ^ ^Thrwt #f t*pfa -̂ ̂ (flrww^ f # ^ ) , irr^rw WlT #C W f e f a r ^ gm Tl 1 "it 'di * 1 s>V<* ^ qrf i p WWTf;
n w ^ w pflTsre w f^m ̂ % fa^ iwTfsfer far wrfr % f$r§ ̂ mr w tfri I? shrift $, *T«i U'lM l^rtfl TIHl M*H ̂ i i'̂ n; IVl^l :ij(|M^ ft l-I|'l'«i M f f i W ^ H >IV s-WIHK n/'iNfHn (T) "swwr tr atfhr IWT^C *TT w ^ r ahftr farm* itWhr |;
(?) " f ^ T ^ TO"" t tftf JW SfMtT I fa# IWWTT f3PT % fa? ̂ # T fan" TfT ^ f t f t ^ ^ t ŝ sr ff^r sft'sr̂ pfrr ITTT nftinfar I, *r ̂ r ***t TT T**T TOT %
(w) "?w*r # f tr %t§ 8tm*r arf^r | tfr faft w W ft wft mfm Mk ?r^ ^ w&ffm mm | ŴT w wifar TT ̂ r% ft ̂ f^w TOT | fatf «*f ̂ ^r ̂ rr ^r mw fan | aftr pif ^fr (^) "nipr # T f f W % faff P W # ? t f T WfTWT % «Nfa f̂ fTSTC VT TT^T W% H|far <g? VT t ~flwt ff H ̂ H ̂ % fa? mŵ flrtir WTOW ̂ # |, iTfr ̂ n^wt f t fifa ̂ ^r t ^ T^ (III) î «î *m*i ^W TT wtJ f fa?r *t ̂ w m w ŝTTur *rt ytmwwF wrfax % f ^ i^^^r^^TWT^^fli I ;
HAR wfti fijB fr̂ r wrft ̂ r *f sr^ ̂ nw ̂ r sif^rwr ̂ Pr;
( ^ ^ w ^ H H H a ^ ^ ^ ' f t i ^ H H ^ ^^ i ^^a r f ^ rT^a t ^^ r r ^a r f ^ i r l ;
fr ffinit^ îifi ifitim iiMim %Hiufaii iifli t ^ ' i r a i m l t wHdn t «t*ttar^;
4 THE GAZETTE OF INDIA : EXTRAORDINARY [PART H—SEC. 3(i)] ^trcfifcr =f^ft f f% f%?ft I ^ + H ^ H ^ ^Rrr^r if f ^ r cR*ff ̂ 3fhc f^ r ^pfl^nff if SFJSTRT f%3T { ^ ) > W ^ H ^m'd<«r | #1dr^r 3rf5r̂ cr f f%?ft srcr ^ T ^ f r ^r$t ^ i ^ w ^ % y f VKJM*"! OTPTT *PT ^44)JI I I + H I ^ H ^m%^f if do? f%w sfk 3rf̂ rar«T dT*r % ^ r if f^iT srnrr | sdr Ruff ^
(2) t ^ ^ ^ ^ ^ 3 r ^ f, qfbnftd-*r$f f f ^ s r f t f ^ m - ^ ^ r f b n f ^ f ^ T 3 ^ ^ : ^ ^ ^ T T ait ^r^r 3W 3if&f̂ ir-H if f t
3.3p£fat̂ TTCR:%*iiwi*) *r^Mr^3(fiJy*ii0H ftf t fd\—f^ft sr^tq'̂ Trrer?:,— (*?) fM t ?fto jsft ^d+<ui r̂r ^ H 3%TT f^raif R4t ~<fr I^FT 1 % Trffireffa" ¥T % s t̂Ucr $Pi4T ^r 3T#T ^aT«R % ^ R % f%TT sfrr ^ ^ ^ ^ ^ ^ n ^ f ^ . ^ f^^ , ^ f g^r STBT | ) v * b r ^ n m r r f %
(2) |?r 4>+?id TT^ |?r ^RWIIH S T ^ ^ T T I
(4) tfrdw 3fhc ?ffR ^ f t T f t ^ VJIH+IO f t cnr s t ^ r f??rr5R w ^FT spmrr ̂ rr^ i
(5) 7HT ^dTSIT ^T WFffdT ^dT5K f̂T ^tdT °Ft *ft f ^ l # # 3ff$RTW ^ t 5TT̂ 1%?T W ?PW I
(6) f ^H^f^d W T ?ft ̂ dT5R W T R gt frMt",— [«rm n-TgTrg3(i)j ^ma^TtWra : 3WWK«I 5 (^) sr^n^r y*uun<KU| Mifil+ift4l Mk f^hre; SRT ar̂ Rftjra' smpr w nfd*ig«i ^ t (^f^i) SIR PH+I ^H41*I ^ WFT *pt^ % f ^ ftnrr *rnrr | ft> asr#*r J^TTSR TTRTT *TT ̂ r srf&f^w $t am 38 % (¥.) #raT^T TRFT *PT UlRqfd sfldl+?H > f f e< 5PTW W% site 3fl*HI$H W W <HT yii>4fcl
(7) 41MTRRT *TR*T W W T̂ T g f ^ ^ - ^ f^rr,- Or) ̂ gf^Rr ^^rr ^t *PR ^ w*ft ¥i3T sfrc ̂ frrenr (ff) ^t ^^r ^^ft | ;
3^+H-T ̂ nrf *RRT ̂ f f ^t ^R5rtf ^ ^ i f t t ^ f% T^id^dT *FRT *£r ^ *RRT ?tr ^t ^rr^ ̂ ^m^ft % f̂ rr̂ nrnTT t
(4) 3fafa1% ̂ trreR SPT +I^IHH ^c^" ̂ f̂ ncr arrtf^ ?npr ^ r aftr ^nft Twid=(dl ?r*R" ^ T f^ra^t I R ^ ^<fdT ̂ r ^T ̂ fT̂ f^n- TRT «n n̂" HC^NH T̂FT f^rr ^nn «IT I
6. af#irfRrreR: iiHfi^i.—(l)^^^RT^witHRd unmm fa«+i g^R-piiiii+sRTf^n"iRT«n", ^t 5Tfe f^ft 3Î hCSRT ^ f%TT f^iRRT ^RT 3TRW 3?W | t W 3W^T 3T^T^T WTfcR*T TTTfS+lR*Tf ^ ^W f ^ y^luIH^ ^"3Tf^|'!lHlRtdl ^T+lc^lHd ^ r t % f ^ f^TT ^ ^ l I I
(2) a^T^r y îun+<"i Eiffel+1rui" % ^ f t ^ ^ t iiui«im ^r ^M\*\ at̂ Rrataff ^t T̂RT ar#!r ^TT«R ^ «j*iviK4 3*% M R - ^ R ^ ^ r ^ r f g w *f ̂ t f Ĥ iumsj f^^^rfr i r^f | <fr^TTSR^r «^md 6 T HB GAZETTE OF INDIA : EXTRAORDINARY [PART I1=SBC. 3 3W?
^€ 'fW | l f T̂fTW SfrfV̂ TTr Wt^ J ^ ^ f r f ^ r f ŝ WTW afrr aWN" fWf 83T sNfa^WTTsn; W IiPfW f t ftftfWT^T t^^^mm^m ____ \ ^ TFTff ipppn -̂a tFTT^qjurWlrt̂ 180-4 SfflrfWfart *nwtpf#1 atKUflu, |F5^w *fiW ([2048,4098 ft?]); *!*•%<«! 1.6 « TreiMrqw #7, tftQjftj;** affin f̂RfrS280 flpWftqrt^t-26B,'(t-3841 3T*frB21 LCAdES nmpRfr6128, 2, FAdES with CAdES $yi4iKU*wi 3181 H Rmipa' l (O) tflfP «H" ̂ ^ *T ̂ ^ * * ^ ' f*S ̂ ^ ^ ^ ^ ^ * * * fflWfc ^ $# (fat TH^R $# ÎJT m%\ I) w 3^|ir $WTO* 3ĥ t? iwrwr afrr p f t r̂aft (ftrt ^w fsft (SO % f̂t%wrrt*pr aftr H^HHHH »Mla<"i qsr OT#T mm nfl^iGfl arf¥rw w (^) ^m f t ww, ^ w r o ^ f^twpr wm (wff̂ np), i T ^ f ^frf^fw «lta t r ? ^ f f f (JT) ffWTSTWWf % | I ^ * H Wf im&m W fa $WTW# tUtf f?ff i^ BW ̂ T m^^TT, |lT Sp^^HttK"! % f l f ^ f ^ ft^T WWT| I
(3) it*wii*m*i atft^ fmsR-fWW % itfta* ¥ flnj, pffsrwrr W W ^ T fllwrfWlrw j w ^wr= (*) pwrtt ftft, fcwffifrwSfaw ftflr #r ftttff % ww fWT^IT p^T w fp f TOT ;
tftfrr ̂ wffftw w rrfftr wfr i f mm ftft* w #*rwf nfbw:
(̂ WJWfNlFWlmf%,=== (I) WWTTOW! % wrw prmt «K* t f# w?FTtw # wfr twfrg | ;
(II) mrf%t pmR WT # ff tw # wr f sfcnhfj w^r «farratf #r rrsrr *r$f | ;
(Hi) ^ w m f f w w r f r f f w f f m ^ ^ ^ f H ^ (*f) wrtwr wwrirw # wffew 7* i IWT arrtpiT ;
W^wfF tmm ^r nfltor »rc ITWW % flnj f^rr w?n aiftw wmwm CTTT ;
(?T) rti ^ ^w^ww *tawr ^ *rr?w tow sjfww$nrt sft spr*fw $ w^r | w S ^ T (?) fmsrr ?̂nl>~<m %+f, #uiM-f.nl # sj?fTf $aft *fr* ff^m f»ft ^i*fid< («rft m^|f) w f ^ r rtc |^, pwmr w fPW %JT wn îr ifK ^ T P T tffffrftt pwrw^ ̂ r m w 04 ^r f?^w T^nw ^ t f*nfT tffc iwrat ^w pfr w aoQ w w w ?w f w i r e ^ If ffw eoa ?frtr j^fr prmw ^ W ^ r i
(4) w^ftf ffffr, ^ t rrfNf #r ww? ̂ wt ̂ w^w^w ihftr p m ^ m wm wwm m̂ wr i
(i) jfo %mm wr wwtwtwt jwnre wr M # ŵ ?^Tft^ < ! M T t wi^ ftwr ̂ r ŵ wr i
(6) ft^fftw fwwr w> IWT^T ^r wrw ft ^m^ wmww#«(4«,Hi(*iiiwwiiwwJlti («0 f N w ITTT wĵ w ̂ ^ : i m fwwfts W^WPT, 5(t srg;w^ ,?wr<jftwr m f M ^ # ^ f ^ iF r r> r^^» i ^ fwr f 'ww iTW^ (?T) arp^r ^i"n»<"i r̂flrwftwT ^ T f t fa i ptr nft ŵ m r n ^ «f l i |^r f#< ^RT^ ^ A W T I #W ^w % flr^ %VT mm I fa ^?T SN^T tranrc p»wpn T̂ >ffoffr? # *nrr 8 THE GAZETTii OF INDIA : EXTRAORDINARY [PART II—SEC, 3(i)] (*0 afl-wm y*mmi sif&rf?r KVI+M R H U < N*U«WI sftr aif.wm 9*mm yiR^R ai^f^Rf ^T 3q_4l*i I W I H ^ yRN$<<T g^t % W R qr f^nr srr +&jn t
(7) 3brW£r Rfgmr^r T^wn^r apfcto ̂ TTSP: ̂ r ^5R^^^f^f^f? i f%^f?Tft^^nt? t - - (30 m^r ff ĉTTsrf̂ r «*WÎ «I qr TT̂> ^nr* ^sfa snnt ^npft, w srrtffo m? ran? *nft (B) TT^ ^#¥ ?TTPT ^nr f̂ fffT w OT^T *nnr wiPM §<TT IMI«II (<D^wTl) % J^T *rr
10. T ? R T W ^ af#T ? w m ^r H^(MH.—(D U+H^vf st#T ^TTSK ^ *R*rnrr EPT ^rrcrr %
(2) ^TTSTC; f ^ H M * ^ ^t PlMfanict % FTWH' $ ^rr f̂ TT ^I '^II— pFO stê tf ffif^w^wr % ̂ T H fare # T$ (Ĵ TT^R: ĴTPTT W %^lf^r T^T *ST TCRTH l^rr WF^TT;
^ m « n ;
OH) ^^rrsR^t % Trf?r 509 w w r ^ <HciRw ^ ffi, ftft t^Rn^n^r ^fhr ^?nw: t
(w) n̂rrefR g ^ r 3f TIC^J ?t^f % fvtxr-- f̂ fPfT ail 0^1*1^ < (^IT3^) ^T ̂ f t W 5R ̂ TT 3fk \ ^ W cR̂ *f ĉTTefR^Tt STCT
(iii) ireflTsrf̂ r ^ T T ^ ^ R H ^ ^i^'w ^ r % f ^ g '•HMfJiy s r ^ w ĵ̂ r # ^ R T ^ i r i [qPTIMggT3(0] *Wl ~m WTO : gM^T^I = 9 ^?rnt ^ W ^ H ^ af=T>r*1 tf/fflltiK Hl*1^i ^ f r ^ ^ r fn»r w*r l^fWRfSlW ptTT^T^r^TTW *rttffyfiife'¥lf3l*<5 ^mnn^f i f^r • WTttTT H^1>TIT TTR^ w r ^ f t 3275 RTSfl̂ rfiJrcr m*rf$$q % *ror o l^W 509 W I T T 'PT afcfl^S V$t ^ ^5fr ^ | ^T WW! TO | §WF% l i 1 ^ ^ r r wr MfiN1 w l cf * ffwr 3 vfr̂ ff *r< nw^tf t f mmn w w r row * Mtwfs *f swa ^ f ' f t ^ ^ f t t i ' i 3 ' i ^ r ^ p ; wrNwrforcrr9T^rr an^4i«i'398e f%^-9 9fW(^lt362S Iw64 ^ ^ t 4 6 4 Q T^r^256 tpwHNIqW 180-4 sd i r ^ # r * f t w l #W*T 1,5 % ffTC WFW, 2§8 Q ai*M (fShiTf̂ *rf¥ff%), ^wpnw-^mr€t-#i4^. sfrw^ft 3741 http;//www,w3,orQ/TR/2001/REC-xml-c14n.2Q010315 2, %5frj^r Tî T^TT f̂ 1,1 (fMf^Nt w\ wft *$m |) hUp://www,w3.org/200e/12/xml-c14n11 http://www.w3,org/TR/2Q01/ReG- xml -c14n-20010315 2, %*ftf^<' T^^-t^r 1,1 (f^rfMt w ^frr ̂ wr ^) ' ;^..„ ~^HW/f$~£, < http://www.w3,org/TR/2Q01/ReG- 10 THE GAZETTE OF INDIA : EXTRAORDINARY [PART II—SEC. 3(i)] ^rrarf%w http://www.w3.org/2006/12/xml-c14n11 TTWT^TT^'-TTWT^TTTW *^M"< ( c r w ^ i ^ l f r ) *if+<e| 1.0. 3w*j3#t http://www.w3.Org/TR/1999/REC-xslt-19991116 XPath - RFC 3653 •Huffed T̂T LRÎ Rdd f%^T^TT^r^T3l«VIH 3r#jrfFcrT5R y^iun^f (#tT3?R) TTW.509 ̂ 3 sivfotf+Tfr Trnf?^ ftrerat % S I^TR srrd *fa> jsft tr^ftf^fT 3?ro^nrTff^fhT^r-i m^m 1.5 ^fWT^ q ^ l ^ f ) tf-256, <JT-384, *TT <ft-521 ^Nfcrfsr ̂ Rmju; sm?r SITT^ 3ii<m+,+n 6283 afk XAdES •atro^r aiRtrq^jr 6283 #?: PAdES XAdES %*IFT n ^ W T c ? ^ ^hm"f% '̂W^Hd jfr^FTtRPtR^daiKi^^ 3161
12. ii«Hm*i^ 3t#!r^rT^T^T^rRi^+H sfrcP^^f ^ H M ! ^ T ^ T ^ R H I ^ * « K ^ , arafg;:— <Signature ID?> <Signed lnfo> <canonicalizatian Method/> <Signature Method/> (<Reference'UR!?> (<Transforms>)?
<nio(s<it M<athnrt> <Digest Value> </Reference>+ </Signed lnfo> <Signature Value> (<Keylnfo> {Key Name) (Key Value) (Retrieval Method) (<X509 Data> (X509 SKI) http://www.w3.org/2006/12/xml-c14n11 http://www.w3.Org/TR/1 [MPT H-TgPS 3 ( j ) ] ^RtT ^>1 W ^ : 3flMiqH"1 H_ (X509 Subject Name) (X509 Certificate) 1 (X509 CRL) (X509 Digest) </x509 Data>) </Keyinfo>) (<Object 1D?>)* </Signature> ^ t " ? " 9JfT TT T^fi ^TT 3<reRfa ft^T ̂ t ^3fr<rr | ; " + " i ^ - m q t i>yMivnM^t^ f r%^-sF i fe r r%; arVr"*"
13. 3T#T ^ T R R f ^ T TTR^rT.— ̂ FcTTSTC ter a fa ^ ^ ^ T f ^ # ^TT^ 3 f€ fa ^ ^ ^ ^ ^ ^ H c ^ m
(i) snfto i^rrsn; M^mm % f%̂ I^^TT vflsftftfl srf&f^nr % srefk ̂ ir€r srtoforft irpfcsfa
(ii) *rrerft%3n^% f^rr rr^r.509 ym«i4i 3rRr;
(iv) Mmun-uui STRJ+IR^ (€trr) % f̂ tT asrf?r?rr̂ r f̂mrT r̂ srrf&rRr vfid\+M (sMrt^rft) % r̂
(v) w , «mTr1^rTT l^ (^ )%f%^ ; f l ^ *^ [W.tf. 19/26/2015-^ftq;]
MINISTRY OF COMMUNICATIONS AND INFORMATION TECHNOLOGY (Department of Electronics and Information Technology) NOTIFICATION New Delhi, the 25th August, 2015 G.S.R. 660(E).—In exercise of the powers conferred by section 87 of the Information Technology Act, 2000 (21 of 2000), the Central Government hereby makes the following rules, namely:— I. Short title and commencement.—
(1) These rules may be called the Digital Signature (End entity) Rules, 2015.
(2) They shall come into force on the date of their publication in the Official Gazette.
Definitions—(l)In these rules, unless the context otherwise requires,— ^a) A n " u i w i u tho Information TAf-hnnlngy A c t 2000(2t o f 2000);
(b) "canonicalisation", in relation to a xml digital signature, means the process of converting electronic record that has more than one possible representation into a 'standard', 'normal', or 'canonical form' in which the variations 12 THE GAZETTE OF INDIA: EXTRAORDINARY [PART 11--SKC 3(1)].
in representation of electronic record shall be standardised by applying consistent rules, primarily as part of the xml digital signature creation and verification processes;
(c) "counter signature" means a signature on a previous signature in a series of signatures, affixed after the verification the signature on electronic record and subsequent signatures on previous signatures serially;
(d) "detached signature" means the signature that is stored independent of electronic record being signed;
(e) "digestniethod element", in relation to a xml digital signature, means the digest algorithm to be used for theoriginal data object or transformed, if any 'xml transforms' exists;
(f) "digestvalue element" means the value of the digest;
(g) "end entity" means the subscriber or system on behalf of the subscriber in whose name the Electronic Signature Certificate is Issued;
(h) "end entity signature" means authentication of any electronic record by an end entity by means of a digital signature, electronic method or procedure in accordance with the provisions of sections I » I A t>e*h* Aotj .
(1) "enveloped signature" means enveloping of the signature and the initial electronic record into another electronic record;
S (j) "enveloping signature" means a signature over a electronic record that is referenced and contained within the signature element;
(k) "initial electronic record", in the context of xml digital signature process* means canonicaiised and transformed formofsigncdlnfo;
(1) "keyinfo element" means an element that enables key information to be packaged along with the signature element;
(m) "long term signature" means a signature element that is made verifiable for a long term by implementing measures to enable the detection of unauthorised alterations of signature;
(n) "manifest element", In relation to a xml digital sipature, means a structure to carry a list of reference elements processing model defined by the application;
(o) "object element" means an optional element of xml digital signature, which is used for enveiopina signature whsfA th* data object being signed Is included in (.lie xrill;
(p) "ocsp responded means an online service that provides revocation status of a digital signature certificate;
(q) "online certificate status protocol" means an online certificate-revocation checking protocol that enables relyingparties to determine the revocation status of an Identified digital signature certificate;
(r) "parallel signatures" means one or more independent signature over the same electronic record in which the ordering of the signatures is not important;
(s) "reference element", in relation to a xml digital signature, means an element that carries a references to data objects, an optional list of transforms to be applied prior to digest (xml transforms), digestmethod and digestvalue value of referenced data objects;
(t) "slgnedinfo", in relation to a xml digital signature, means an element that contains a set of information to be signed for creating an xml signature, where it shall contains references to the data object that Includes the canonicalisation and signature algorithms;
(u) "signature" means digital signature or xml digital signature;
(v) "signature value" means an airman* that tke actual value of the digital signature,
(w) "signaturemethod " means an element that contains the algorithm used for signature generation and this algorithm identifies all cryptographic functions involved In the signature generation;
[qm it-grog 3(j)J iqRff ^T TOTS ; WBWrW 13
(x) "signatureproperties" means an element that provides a way to carry additional information about the signature, such as a time stamp or any other information which are defined by application;
(y) "time stamp" means a notation that indicates the correct date and time of an action and Identity of the person or device that sent or received the time stamp and is enforced using time stamp token;
(z) "time stamp token " moans a cryptographically secure confirmation generated by applying digital signature of a time stamping service provider that Includes the time when the confirmation was generated;
(za) "time stamping service provider" means a trusted entity authorised to generate time stamps;
(2b) "xml" means Extensible Markup Language that provides a standard methodology with formal syntax to identify elements of information, describe the structure of data and also to store data in an Independent manner, shall have the following properties,—
(i) with xml, content and presentation are separate;
(ii) the structure of xml data in a particular context is described using either xm! schema or a document type definition;
(Hi) xml schema or a document type definition are stored separately from die xml document itself and can be us«d to iraliduU. a g ir tn mill dwvuiiiEiu AJI bUiifUi jimiiuc,
(zc) "xml digital signature element" means an element that defined by standard xml schema for capturing the result of a digital signature operation applied to arbitrary data, in xml format, shall satisfy the following,—
(i) xml digital signature element shall exist as a standalone document or envelop the data object that it signs;
(II) xm! digital signature element shall have signedinfo, signature value, keyinfo, object and has id attribute of type child elements in order in which they appear;
(zd) "xml digital signature" means the digital signature on xml electronic record;
(ze) "xml document" means a document with xml logical and physical structure that Is used to carry data elements, composed of declarations, elements, comments, character references, and processing instructions and a physical structure composed of entitles, starting with the root, or document entity;
(zf) "xml schema" means a set of pre-defined or user defined keywords and their attributes arranged In a structured manner, shall satisfy the following,—
(i) should be used for a particular purpose where as a schema describes the structure of an xml document and provides specification of element names that indicates which elements are allowed in an xml document, and in what combinations; and
(il) should provide extended functionality such as data types, inheritance, and presentation rules and default values for attributes;
<zg; "xmi transform" means an element mat specify an optional ordered list of processing steps applied to the data objects before it was digested where the transforms Include canonicalization, encoding or decoding, extensible style sheet language transformations, xpath filtering, and xml schema validation;
(zh) "xml namespace" means a uniform resource Identifier (uri) reference where the mechanisms described in the specification are used in xml documents as element types and attribute names and also to use various xml vocabularies without having name collision.
(2) Words and expressions used herein and not defined but defined in the Act shall have the meanings respectively assigned to them in the said Act,
3. Manner of authentication of Information by means of digital signature,—A digital signature shall,—
(a) be created and verified by cryptography which concerns with transforming electronic record into seemingly unintelligible forms;
(b) use Public Key Cryptography, which employs an algorithm using two different but mathematical related keys; one key (called tho private key) for creating a digital signature and another key (called the public key) for verifying a digital signature;
(c) use an hash function for creating and verifying a digital signature which required to make digital signature generation and verification efficient.
4. Creation of digital signature—(1) The signatory shall, while signing an electronic record or any other item of information, first apply an hash function in the signatory's hardware or anfVwnm 14 THE GAZETTE OF INDIA ; EXTRAORDINARY [PARTU—SEC. 3fiJ]
(2) The hash function shall produce a hash result.
(3) The signatory's hardware or software shall then transform the hash result into a digital signature using signatory's private key and signature algorithm.
(4) The contextual information like date and time, shall be then made part of the digital signature.
(5) The counter signatures or parallel signatures or both may also be applied to electronic record.
(6) The following information may also be a part of signature,-—
(a) the signatory's public key signature certificate(s);
(b) the public key certificate(s) of the licensed Certifying Authorities which used to verify the authenticity of the digital signature certificate issued to the signatory;
(c) the self signed certificate generated by the Controller used to verify the authenticity of the public key certificate of the licensed Certifying Authorities;
(d) the certificate revocation list(s) maintained by the licensed Certifying Authorities, and the controller which is used to check whether the digital signature certificate has been revoked under section 38 the Act;
(e) online certificate status protocol responder certificates and online certificate status protocol responses that may be used in lieu ot certificate revocation iisu
(7) To create long term valid digital signature,—
(a) a timestamp shall be applied initially to the signed data including the certificates and revocation information;
(b) ensure that initial time stamp shall cover all the data and signature(s);
(c) a nested time stamp option shall be used to ensure signature validity past the time stamping service provider's (tssp) key or algorithm expiry where the nesting of time stamps implies that a subsequent time stamp shall be applied to the prior time stamp;
(d) signature(s) and time stamps may be embedded in the data itself or stored separately as standalone.
5. Verification of digital signature.—(l)The verification of a digital signature shall be accomplished by computing a new hash result of the original electronic record by means of the hash function used to create a digital signature and by using the public key and the new hash result, the verifier shall check—
(a) if the digital signature was created using the corresponding private key and shall be applicable for parallel and counter signatures applied on the electronic record, if present;
(b) the time when the digital signature was created.
(2) To verify counter signature, the signature on electronic record and thereafter signature on previous signature serially i ljall b e vbi i f ibd.
(3) To verify parallel signature, signature on electronic record shall be verified independently.
(4) To verify long term signature, the initial timestamp and all subsequent time stamp applied on the each prior timestamp shall be verified.
6. Verification of Digital Signature Certificate.—(1) The self signed certificate generated by the Controller, which begins the trust chain for the public key infrastructure, shall be used to verify the authenticity of the public key certificate of the licensed Certifying Authorities.
(2) The public key certificate of the licensed Certifying Authorities shall be used to verify the authenticity of the digital signature certificate issued to the subscribers.
(3) The certificate revocation list maintained by the licensed Certifying Authorities shall be checked to confirm whether the certificate of the licensed Certifying Authorities is valid or whether it has been revoked under section 38 the Act.
(4) While verifying the validity of a digital signature the corresponding digital signature certificate shall chain up through the public key certificate of the issuing Certifying Authority to the self signed certificate of the Controller and if any of the certificates in the trust chain is not trusted the signature shall not be verified.
(5) The Digital Signature Certificate shall be verified with respect to time of signature created.
(6) The chain of certificates shall be verified in accordance with the standards specified in rule 7.
(7) If the certificate validity is less than one hour, the checking of revocation list shall not be required.
i [*TR Il-ig^rg 3(j)] **Ku" ^1 TFF& : sraî TTFT 15,
7. Digital signature standards.—The most important standards that shall be applicable for different activities associated with digital signature functions are as under— Products Cryptographic hash function RSA Public Key Technology Encryption and digital signature Validation of Digital Signature Certificate ECC curve Long term signature formats Time stamp token Standards SHA-2 as specified in F1PS 180-4 PKCS#1 RSA Encryption Standard ([2048,4096 bit)); Version 1.5 PKCS#7, CMS RFC 5280 NISTP-256,P-384,orP-521 l.CAdES RFC 5126,
2. PAdES with CAdES As specified R!U3]t>i
8. Manner of authentication of information by means of xml digital signature.— A xml digital signature shall,—
(a) be created and verified by cryptography which concerns with transforming electronic record into seemingly unintelligible forms;
(b) use Public K.ey Cryptography, which employs an algorithm using two different but mathematical related keys, one key (called the private key) for creating a xml digital signature and another key (called the public key) for verifying a xml digital signature;
(c) use an cryptographic hash function for creating and verifying a xml digital signature;
(d) use canonicalization and xml transformation to create standard electronic record prior to creation and verification of xml digital signature;
(e) authenticate xml documents which contain data as references and corresponding hashes, which is affected by the use of hash algorithm, canonicalization, xml transformation and public key algorithm.
9. Creation of xml digital signature.—(1) To sign an electronic record or any other item of information, the signatory shall first constructs reference elements, xml digital signature element, signedinfo, keyinfo and signaturevalue.
(2) For the purpose of reference element generation, the signing software shall— ^J creaie reierente^s) cituisin.(a) rritu i-afonsince to tk» itam of in-form at inn, vml transform elementfsl (optional), digest algorithms and digest value;
(b) optionally apply xml transform(s) to each referenced object in a sequential order;
(c) apply the hash function in the signatory's hardware or software to each reference elements, store the hash result m the reference element;
(d) ensure that if the object element is created, it shall not have a manifest element;
(e) ensure that exclusive canonicalization "without comments" has been mandatorily specified in addition to any other transforms.
(3) For the purpose xml digital signature generation, the signing software shall—
(a) create signedinfo element with signaturemethod, canonicalisation method and reference^);
(b) apply canonicalisation to signedinfo and calculate the hash value of canonicalised signedinfo using the hashing algorithms implied by the signaturemethod;
(c) ensure that,—
(i) the signatory has seen all the contents of the document before signing;
(ii) the contents display requirements, in the case of automated signing process, is not required;
{\l\) 10 Sign IIlUlUpIC I t i u u i ™ t v 6 * t b « ,
(a) each resource shall be rendered on the screen;
16 T! IE OAgKTTE OF INDIA : EXTRAORDINARY [PART II—SEC, 3(i)J
(b) each referenced xml resource shell he rendered using xsit and the xslt shall he the last transform done to render the resource on the screen;
(c) each non xml resource shall he rendered using mimetype Attribute mentioned In the object;
(d) generate the signature using the signature algorithm and the hash, the signatory's private key, and the public key parameters (if applicable) and perform bnse64 encoding of the signature result and use It to form signal urevalue;
(e) construct the signature element that Includes signedlnfo, Items of Information, keylnfo with *509 certificate element and signaturevalue and the x509 certificate element shall carry the signatory's x5Q9 public key certificate,
(4) The contextual information like date and time, shall be then made part of the xmi digital signature.
(5) The counter signatures or parallel signatures or both may also be applied to electronic record, •
(6) The following Information may also be a part ol'slgnature—
(a) the public key certlflcate(s) of the licensed Certifying Authorities which used to verify the authenticity of the digital signature certificate Issued to the signatory;
(bj Uw atir Milieu certificate generated by the Controller used to verify the authenticity of the public key certificate of the licensed Certifying Authorities;
(c) the certificate revocation llst(s) maintained by the licensed Certifying Authorities and controller which Is used cheek whether the digital signature certificate has been revoked under section 38 the Act;
(d) online certificate status protocol responder certificates and online certificate status protocol responses may be used in lieu of certificate revocation list,
(7) To create long term valid xml digital signature—
(a) a timestamp shall be applied Initially to the signed document, where the Initial time stamp shall cover all the electronic record and slgnature(s);
(b) a nested time stamp option shall be used to ensure signature validity past the time-stamping service provider (tsspj's key or algorithm expiry where as nesting of time stamps implies that a subsequent time stamp shall be applied to the prior time stamp;
(c) signature(s) and time stamps may be embedded In the data Itself or stored separately as standalone.
(0. Verification of xml digital signature. - ( I ) The verification of the xml digital signature shall be accomplished by signature validation, reference validation and certificate validation and an xml digital signature shall be treated valid only I ('signature validation, reference validation and certificate validation as specified below are complied with.
(2) To accomplish signature validation—
(a) canonical form of signedlnfo as produced during reference validation shall be used;
(b) canonical form of signaturemethod using the canonical lotion method shall be obtained;
(c) the public key contained in the signatory's x509 certificate that Is included In the xmi digital signature, the canonlcalisied form of signedlnfo signaturevalue, and canonlcaltsled form of signaturemethod shall be used to verify the signature,
(3) To accomplish reference validation^
(a) canonlcaiise the signedlnfo element based on the canon icalisation method In the signedlnfo shall be used;
(b) for each reference in the signedlnfo— (I) if transformations were applied by the signatory, then the verifier software may de-reference the uniform resource identifier (url) and execute transforms provided by the signatory In the reference element;
(II) compute digest of referenced item using the digestmethod specified In Its reference element;
(iil) compare the computed digest value against dlgestvalue in the signedlnfo reference; If there la any mismatch or validation fails;
(4) The Digital Signature Certificate Included in the xml digital signature shall be verified in accordance with the fwnvMoiifl gpvctflad In rule 6,
(5) To verify counter signature, the signature on electronic record first and signature on previous signature shall be verified serially, [*jgj l i - ^ r g 3(i)] ^Rcf ^T *|sPT:f : srarqKT 17
(6) 1 o verify parallel signature, signature on electronic record shall be verified independently.
(7) To verify long term signature, the initial timestamp and all subsequent time stamp applied on the each prior timestamp shall be verified.
11. The xml digital signature standards.—The most important standards that shall be applicable for different activities associated with xrol digital signature functions are as under— The Product XML Digital Signature Standard XML "Namespace • Signature encoding Signature Value Encoding Reference element Digest Signature Algorithm Signature block Canonicalization Transform Algorithms Signature Type Digital Signature Certificate Standard RFC 3275 with the following constraint o Manifest is not permitted inside Object, o Keylnfo containing X509Certificate element is mandatory.
o The Reference Processing shall use the Exclusive Canonicalization(without comments) in addition to other transforms.
o For XML resource. XSLT shall be the last transform done to enable the rendering of the documeni on screen.
o For rendering of document on the screen o Each referenced XML resource shall be implemented using XSLT.
o Each non XML resource shall be implemented using Mime Type attribute mentioned in the object.
RFC 3986 UTF-8 RFC 3629 Rasc64 RFC 4648 SHA256 MPS 180-4 SHA256withRSA FKCS-1 Version 1.5 a Exclusive (without comments), XML-EXC-CI4N, RFC 3741 Canonical XML
1. Canonical XML 1.0 (omits comments) littpi/AvwwwS.ore'TR/lOOiyREC nml ol-tn 20010315
2. Canonical XML 1,1 (omits comments) http://www.w3.org/2006/12/xml-cl4nll Exclusive (without comments), XML-EXC-C14N, RFC 3741 Canonical XML-
1. Canonical XML LO (omits comments) http://www.w3 .org/TR/2001/REC-xml- cl to-20010? 15 2, Canonical XML 1.1 (omits comments) http://www.w3.org/2006/! 2/xml-c 14n 11 XSLT-XSL Transforms (XSLT) Version 1.0. W3C http://www.w3.org/TR/1999/REC-xslt-19991116 XPath-RFC 3653 enveloped or enveloping or detached (DER) X-309 Vi issued as per interoperability guidelines 1 ^ ' H ^ H - ^ http://www.w3.org/2006/12/xml-cl4nll http://www.w3 http://www.w3.org/2006/ http://www.w3.org/TR/1999/REC-xslt-19991 _US THE GAZETTE OF ]NDIA : EXTRAORDINARY [PART H—SEC. 3 (j)] Public Key Algorithms ECC curve Long Term Signature formats Time Stamp Token RSAPKCS-1 Version 1.5 NISTP-256,P-384JorP-52] LXMLERS RFC 6283 and XAdES
2. XMLERS RFC 6283 and PAdES with XAdES As specified RFC 3161 in XML notation
12. The basic Syntax of xml digital signature and terms used in the rule shall be as follows, namely:- <Signature ID?> <Signedlnfo> <Canon icalizationMethod/> <S ignatureMetllod/> (<Reference URI?> (<Transforms>)?
<DtgestMethod> <DigestValue> </Reference>+ </SignedInfo> <SignatureValue> (<KeyInfo> (KeyName) (KeyValue) (RetrievalMethod) (<X509Data> (X509SK1) (X509SubjectName) (X509Certificate) (X509CRL) (X509Digest) </x509Data>) </keyihfo>) (<Object ID?>)* </Signature> I _.. ... _ _ _ ™ _ „ _ _ ^ _ _ Wliere "?" denotes zero or one occurrence; "+" denotes one or more occurrences; and "*" denotes zero or more occurrences" [qFT l\-W*Z 3(i)] . ^R3 *ET WTO : 3P3!*mTT 1£
13. Digital Signature functions Standard.— The manner of digital signature creation and verification, in respect of signature profile and signature format, shall also conform to the following guidelines issued by Controller, namely:-
(i) Interoperability Guidelines for Digital Signature Certificates issued under Information Technology Act;
(ii) X.509 Certificate Policy for India PK.I;
(iii) Signature profiles;
(iv) Online Certificate Status Protocol (OCSP) Service Guidelines for Certifying Authorities (CA);
(v) Time Stamping Services Guidelines for Certifying Authorities (CA).
[F.No. 19/26/2015-CCA] TAPAN RAY, Addl. Secy.
Tt f t^ f t , 25 3TW, 2015 wr.w.fa. 661(3T).— ̂ f a flTSfnr, SĴ PTT ifYifiM srrlrf̂ rfT, 2000 (2000 w 21) #r srrcr 16 % *rnr Tf^r SIFT 87 ̂ t STOKT (2) ̂ nts1 (T) srcr STSTT ?ir*it ?r ^rnr ^AT^T ^^TT t̂sriPi<fi (*J<.ISII urstmi) f^PT, 2004 W afhC t?fr*FT *&$ % f^r f^rfM%?T f^WWmtfr|, 3RT^ :-- 1 .(1) ^r f^mt ^r ?if$rHr ?mr g w ifl̂ HPifl ( ^ r r TjfitaryttfnFT f^pr, 201511
2. ^ r r ifl̂ nRifl (^:§TT ̂ r r ) f̂ r*r, 2004 *f,- (?) %PT2f, ^(^)%FrrffqTplHpif^d w^WT^Trnrr, apsrr^:- (arRrir ftunr) R w , 2015 # qfbnf^a | , ?r JPW: w r̂ a*«f strr wt S^FT 3 W arf^f^rsr aftr f ^ w t ^ t i " ;
(«r) pfcpT41, ̂ w (^)%wr'RRnRlRlct «i« <ii wnpn, arefq;:- "(**) 3i#*r ^rrsrr (att%T R*w) f^w, 2015 V Pfew 7 m f ^ r 12 *f RRtd JTT F̂T w, ^ r ^r?
^T^T #^r atfr̂ r ^ r r e r r % ^ R , *TST<UI Mk 4I\NUI %|, ^ H M H cp̂ f ^ ?prr | ; #c t*rr. TT. 1O/26/2015 rfhfrrrj <PR Tpr, srqr *rf%̂ fc*nT : ĝ r PTTT wr^r % <.MH*I, 3mTmmr, w r H, ^ 3, s w (i) ^ arRrg^Rr *f. wT.̂ rf̂ . 735(3T).
' lTfr^29 3TW^r2014^Kr^fr%crr%^7TTr ^ | NOTIFICATION New Delhi, the 25th August, 2015 G.S.R. 661(E).—In exercise of the powers conferred by clause (e) of sub-section (2) of Section 87 read with Section 16 of the Information Technology Act, 2000 (21 of 2000), the Central Government hereby makes the following rules to amend me Information Technology (Security Procedure) Rules, 2004.
1.(1) These rules may be called the Information Technology (Security Procedure) Amendment Rules, 2015.
(2) They shall come into force on the date of their publication in the Official Gazette.
2. In the Information Technology (Security Procedure) Rules, 2004,—
(a) in rule 2, for clause (e)> the following clause shall be substituted, namely:— "(e) words and expressions used in these rules and not defined but defined in the Act and the Digital Signature (bna entity) Rules, 2015 shall have the same meaning respectively assigned for them in the said Act and rules,";