Introduction
In the modern digital age, digital signatures play a crucial role in securing online transactions and ensuring the authenticity of digital documents. They provide a secure and efficient method of validating identity and protecting data integrity. However, it is important to understand that not all digital signatures hold legal validity. The enforceability of a digital signature in a court of law depends on several factors, including the technology used and the compliance with relevant laws and regulations. In some instances, a digital signature may not meet the necessary criteria to be considered legally binding. Understanding the essential requirements for a legally valid digital signature is vital for businesses and individuals who rely heavily on electronic documentation and communications.
What is a Digital Signature?
A digital signature is a cryptographic method employed to authenticate and preserve the integrity of digital messages, documents, or software. It enables the recipient to verify the sender’s identity and ensures that the content has not been tampered with since it was signed. Each digital signature is generated using a Digital Signature Certificate, which consists of a unique private and public key pair that serves as the individual’s identity.
According to Section 2(1)(p) of the Information Technology Act, 2000 (“IT Act”), a digital signature refers to the authentication of an electronic record by a subscriber using an electronic method or procedure in accordance with the provisions of Section 3.
“Section 2(1)(p) ―digital signature means authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with the provisions of section 3”
“3. Authentication of electronic records.–
(1) Subject to the provisions of this section any subscriber may authenticate an electronic record by affixing his digital signature.
(2) The authentication of the electronic record shall be effected by the use of asymmetric crypto system and hash function which envelop and transform the initial electronic record into another electronic record. Explanation.–For the purposes of this sub-section, ―hash function‖ means an algorithm mapping or translation of one sequence of bits into another, generally smaller, set known as ―hash result‖ such that an electronic record yields the same hash result every time the algorithm is executed with the same electronic record as its input making it computationally infeasible– (a) to derive or reconstruct the original electronic record from the hash result produced by the algorithm; (b) that two electronic records can produce the same hash result using the algorithm.
(3) Any person by the use of a public key of the subscriber can verify the electronic record.
(4) The private key and the public key are unique to the subscriber and constitute a functioning key pair.”
Public Key and Private Key
Digital signatures rely on Public Key Cryptography, a technique that uses a key pair comprising a private and a public key, generated by a mathematical algorithm. The private key, which is used to digitally sign a document, is securely stored by the owner. On the other hand, the public key is made publicly available for verifying the digital signature.
Digital Signature Certificate
The public key is tied to the subscriber by a Digital Signature Certificate (DSC) issued by a Certifying Authority. The DSC contains information about the subscriber’s identity, the issuing Certifying Authority’s details, the certificate’s validity period, and the subscriber’s public key. Additionally, different classes of certificates provide varying levels of assurance, depending on the identity verification procedures followed by the Certifying Authority. In cases where a certificate is revoked by a Certifying Authority, it will be included in the Certificate Revocation List (CRL). Both subscribers and relying parties can consult the Directory of Certificates and CRLs maintained by a CA to validate the authenticity of a certificate.
Classes of Digital Signature Certificates
Digital Signature Certificates are classified into three1 categories based on the level of verification and security:
- Class 1: Verification requirements for Class 1 certificates include Aadhaar eKYC biometric, paper-based application with supporting documents, or Aadhaar eKYC OTP combined with video verification. The private key generation and storage can be done via software.
- Class 2: This level requires verification through Aadhaar eKYC biometric, a paper-based application with supporting documents, or Aadhaar eKYC OTP combined with video verification. Private key generation and storage must be done using a hardware cryptographic device validated to FIPS 140-2 level 2.
- Class 3: Class 3 certificates require Aadhaar eKYC biometric verification, paper-based applications with supporting documents, or personal appearance before the CA (or video verification). Private key generation and storage must be in a hardware cryptographic device validated to FIPS 140-2 level 2.
Additionally, Aadhaar e-KYC OTP or Aadhaar e-KYC Biometric are used for verification in certain instances.
Certifying Authorities
Section 24(1) of the Information Technology (Certifying Authorities) Rules, 2000 specifies that no individual or entity may issue a Digital Signature Certificate unless granted a license to do so by the Controller. The rules empower the Controller of Certifying Authorities to license and regulate Certifying Authorities (CAs). CAs play a critical role in issuing DSCs, confirming the authenticity of public keys, and maintaining the necessary infrastructure for secure digital signature management. It is the obligation of the CAs to ensure that the digital signature infrastructure complies with the IT Act, rules, regulations, and the Certification Practice Statement approved by the CCA. CAs are liable for ensuring the level of assurance provided by the certificates they issue.
A list of recognized Certifying Authorities is available on the official website of the Controller of Certifying Authorities at:
https://cca.gov.in/licensed_ca.html](https://cca.gov.in/licensed_ca.html), with prominent CAs including SafeScrypt, E-Mudra, and Protean, etc.
Documents for Which Digital Signature is Invalid
Section 1(4) of the IT Act specifies that the provisions of the Act do not apply to documents or transactions listed in the First Schedule. Therefore, digital signatures are not valid for certain documents, as outlined in the First Schedule of the Act. These documents include:
- Negotiable Instruments: Other than a cheque, as defined in Section 13 of the Negotiable Instruments Act, 1881.
- Power of Attorney: As defined in Section 1A of the Powers-of-Attorney Act, 1882.
- Trusts: As defined in Section 3 of the Indian Trust Act, 1882.
- Wills: As defined in Clause (h) of Section 2 of the Indian Succession Act, 1925, including other testamentary dispositions by whatever name they may be called.
- Contracts for Sale or Conveyance of Immovable Property: Any contract for the sale or conveyance of immovable property or any interest in such property.
Validity of Digital Signature and Its Evidentiary Value
Section 15 of the IT Act outlines the guidelines for creating a valid and secure digital signature. The requirements include:
- Uniqueness: The digital signature should be unique and capable of uniquely identifying the parties involved in the electronic transaction.
- Linking to the Electronic Record: The signature should be linked to the electronic document in such a way that any alteration to the document after signing will invalidate the signature.
The IT Act recognizes electronic records signed with digital signatures as legally valid and admissible as evidence in court. Several sections of the IT Act and the Bharatiya Sakshya Adhiniyam, 2023, ensure that digital signatures are legally recognized.
Section 4 of the IT Act establishes the presumption of authenticity for electronic records signed with a digital signature. It states that if an electronic record is authenticated using a digital signature, the document must be considered duly signed by the person who owns that signature unless proven otherwise.
Section 41(2) of the the Bharatiya Sakshya Adhiniyam, 2023 provides that when the Court has to form an opinion as to the electronic signature of any person, the opinion of the Certifying Authority which has issued the Electronic Signature Certificate is a relevant fact.
Further, for a digital signature to be legally valid, it must be issued by a licensed Certifying Authority, and the associated Digital Signature Certificate must be valid within the prescribed time period. The legal framework established under Section 35 of the IT Act further emphasizes the legal requirements for DSCs and Certification Authorities.
Section 43A of the IT Act holds Certifying Authorities accountable if they issue faulty certificates, rendering them liable for any resulting damage or loss.
If a digital signature complies with the required legal standards and the appropriate rules, it will be treated as valid evidence in court, with an assumption of authenticity for the associated electronic records.
Landmark Judgments
One notable judgment related to the validity of digital signatures is the case State of Maharashtra v. Dr. Praful B. Desai (2003)2. In this case, the Supreme Court of India upheld the validity of digital signatures and electronic records under the IT Act, 2000. The court recognized the importance of digital signatures in facilitating electronic transactions and acknowledged their legal standing as a valid means of authentication.
Conclusion
Digital signatures are an indispensable tool in today’s digital landscape, offering a secure and efficient method for authenticating electronic records. However, for a digital signature to be legally valid, it must adhere to the prescribed guidelines and be issued by a licensed Certifying Authority. Businesses and individuals who rely on digital signatures for their electronic transactions must ensure that they meet the necessary legal requirements to avoid disputes and ensure enforceability in a court of law.
The IT Act a robust framework for the legal recognition of digital signatures, ensuring their validity and evidentiary value. With the growing reliance on electronic transactions, understanding the principles of digital signatures and their legal implications is crucial for ensuring secure and legally binding online documents and transactions.
Footnotes
1 https://cca.gov.in/classes_of_certificates.html
2 2003 (4) SCC 601
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
