World Bank Documentdocuments.worldbank.org/curated/en/679201468038084035/pdf/694… · E...

WORLD BANK

REIMBURSABLE TECHNICAL ASSISTANCE

ITIDA

E-SIGNATURE AND PKI FRAMEWORKS:

INTERNATIONAL BENCHMARKS

FINAL REPORT

WORLD BANK

69473

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

WB /ITIDA RTA e-Signatures / PKI

CONFIDENTIAL Final Report

2 of 60

TABLE OF CONTENTS

I. Executive Summary .......................................................................................... 3 II. Summary of Findings & Recommendations ...................................................... 5 III. Introduction & Background ............................................................................... 6 IV. Overview of existing e-signature and PKI enabling environment in Egypt ....... 8 A Legal Framework .......................................................................................... 8 B Institutional Arrangements ............................................................................. 9 C Expected uses of e-signatures in Egypt ...................................................... 11 V. Benchmarking ................................................................................................ 12 A Enabling Environment issues ...................................................................... 12 B PKI Implementation Issues .......................................................................... 23 VI. Recommendations for strengthening Egypt’s e-signature and PKI enabling environment ........................................................................................................... 36 A As Root CA, ITIDA should develop certificate standards policies ................ 36 applicable to Egypt, and can use its existing relationships with is MoU .................. 36 partners in this regard. ........................................................................................... 36 B Measures to limit the liability of ITIDA as Root CA ....................................... 36 C Clarify which electronic transactions will be subject to PKI .......................... 36 D Training for lawyers and judges on e-signatures issues .............................. 37 E Introducing alternative dispute resolution processes for e-signature matters37 F International Considerations ........................................................................ 37 VII. Glossary ......................................................................................................... 39 VIII. Annexes ......................................................................................................... 41 IX. Bibliography .................................................................................................... 42 ANNEX 1 ............................................................................................................... 44 ANNEX 2 ............................................................................................................... 53 ANNEX 3 ............................................................................................................... 54 A United States .............................................................................................. 54 B State of Washington Pricing (2003) ............................................................ 58



3 of 60

I. Executive Summary

This report provides background information and experiences from other countries

relative to their adoption and implementation of Public Key Infrastructure (PKI) electronic

authentication systems, with particular attention to the underlying enabling environment and

factors affecting use and uptake.

PKI is one technique used to ensure the security of electronic transactions and to

authenticate users. PKI uses public key cryptography and X.509 certificates and provides a

high level of security for electronic transactions.

Every country approaches the use of e-signatures differently. Even in EU Member States

operating under a common set of community-wide Directives, each Member State has a

different approach to use of e-signatures for official purposes, including PKI. Because the

implementation of PKI is so situation-specific, meaningful apples-to-apples “benchmark”

comparisons are difficult.

These different approaches mean that there are different implementation costs - as well as

benefits - derived from the use of PKI, depending, for example, on the modality for issuing

certificates (Root CA vs. outsourced CAs), the scope of use of PKI, as well as the systems

used to deliver the digital certificates (e.g., smart cards vs. simple electronic file transfer).

Because some countries use PKI for limited purposes, comparing “costs” with countries that

chose to use PKI for more or broader purposes, or that use a different modality to deliver

certificates, is difficult without discounting the full range of variables. Also, the “cost” of PKI

should take into account the benefits to be achieved through the use of PKI systems.

In general, the single biggest cost is incurred in the establishment of the certification

process. In the case of Root CAs (as is intended in Egypt) there is additional incremental cost

for each certificate issued, but in other jurisdictions, this cost has been negligible.



4 of 60

Where countries have limited use of PKI, it is usually linked implicitly to a

“weak/strong” signature application environment. “Strong” signatures (using PKI for

example), are appropriate for some on-line transaction activities, requiring a high degree of

verification, while “weak” signatures may be appropriate for others. The legal regime in Egypt

contemplates such a differentiation, and the Government could consider which applications

would be best suited for use of “strong” signatures using PKI.

Realizing the benefits of PKI will depend in part on the trust of users in the overall

system. In part this trust will be based on the enabling environment, including the practices

and policies of the Root CA.

A summary of findings and recommendations can be found in Section II. These

recommendations are aimed at enhancing trust in the system, which should therefore encourage

use. Clarifying the scope of application of PKI will be one factor affecting costs (and

benefits).



5 of 60

II. Summary of Findings & Recommendations

As Root CA, ITIDA should develop certificate standards policies applicable to

Egypt, and can use its existing relationships with its MoU partners to assist in

that regard.

Consider measures to limit the liability of ITIDA as Root CA

Clarify which types of electronic activities will be subject to PKI (“electronic

signatures” under Egyptian law) and which activities (“electronic

writings/documents”) will not require PKI– allowing choice of authentication

measure appropriate to the level of security desired.

Consider training for lawyers and judges on e-signatures issues.

Consider introducing alternative dispute resolution processes for e-signature

matters.

Consider introducing “party autonomy” and reconcile with UNCITRAL

Convention on Electronic Contracting.



6 of 60

III. Introduction & Background

This report is being delivered pursuant to the agreement (Agreement) between the

Ministry of Communications and Information Technology of the Arab Republic of Egypt

(MCIT) and the World Bank (Bank) for the provision by the Bank of technical assistance

(RTA) to MCIT and certain of its affiliates. One of those affiliates is the Information

Technology Industry Development Authority (ITIDA).

The purpose of this report is analyze international benchmarks regarding the enabling

environment for e-signatures and PKI frameworks validating Egypt’s existing and emerging e-

signature/PKI initiatives and (ii) make recommendations regarding strengthening the existing

e-signature/PKI enabling environment in Egypt.

As discussed further in this report, the method for authenticating users of electronic

signatures chosen in Egypt is based on public/private key infrastructure (PKI), although other

methods are contemplated in Egypt’s legal enabling framework. PKI uses asymmetric

encryption (as distinguished from symmetric systems, where the “secret” (private) key is

known only to the party holding it, and that when matched with the “public key” (held by third

party) forms a “pair” that ensure the authenticity of the data message. This system involves a

3rd

party to ensure that the encryption of the data message attached to the signature has not

been corrupted1;

PKI is generally recognized as a preferred authentication method when high levels of

certainty regarding the identity of the user are required.2

Other types of electronic authentication and their salient features are summarized below :

1 Both the UNCITRAL model laws on e-Commerce and on Digital Signatures contemplate the use of,

although are not based on the exclusive use of PKI mechanisms. PKI is well-suited for “e-commerce” transactions among and between parties not known or with no prior relation to each other. 2 ACN.9/630/Add.3 - Possible future work on electronic commerce Comprehensive reference document

on elements required to establish a favorable legal framework for electronic commerce: sample chapter on international use of electronic authentication and signature methods, UNICTRAL, available at: http://daccessdds.un.org/doc/UNDOC/GEN/V07/822/59/PDF/V0782259.pdf?OpenElement (UNCITRAL Future Work).

http://daccessdds.un.org/doc/UNDOC/GEN/V07/822/59/PDF/V0782259.pdf?OpenElement



7 of 60

symmetric encryption (pre-arranged shared cryptology where the same “key” is

used to encrypt a data message at the point of origin and decrypt it at the receiving

end, the secrecy of which must be maintained by both parties;

passwords (this is a symmetric process and a common application is ATM

technology);

tokens (these are like passwords, insofar as the “password” is embedded in the

“token” – these can be either physical tokens (cards) or electronic tokens);

digital biometrics (such as retinal or other scanning requires agreed protocols and

standards of hardware and software);

secure closed systems (dedicated computer-to-computer links or private

networks); and

blended systems (for example, using one of the above digital technologies

combined with an orthogonal confirmation, such as a telephone confirmation).

This report focuses on the PKI experiences of other countries that use PKI.

Methodological Note: This report is based primarily on desk research and on interviews

conducted with ITIDA over two missions in September 2006 and March 2007. Further,

telephone and email consultations were made with PKI administrators in Brazil and Canada.



8 of 60

IV. Overview of existing e-signature and PKI enabling environment in Egypt

This chapter reviews (i) the existing legal enabling framework for the use of e-

signatures/PKI in Egypt, (ii) the key institutional arrangements (functions and organization) of

ITIDA within this enabling framework, and (iii) the main purposes for which e-signatures will

be used in Egypt.

A. Legal Framework

The legal framework that establishes the basis for legal recognition of electronic

signatures in Egypt consists of two primary instruments – Law # 15 of 2004 Regulating E-

Signature and Establishing ITIDA (Law) and MCIT Decree # 109 of 2005 Issuing Executive

Regulations of Law # 15 of 2004 (Decree).3

The Law establishes the legal functional equivalence of electronic signatures and

electronic documents. The Law also establishes ITIDA and grants it certain powers, inter alia,

in the area of e-signatures under the Law, including licensing of e-signature services and

issuing digital certificates. Except for references to digital certificates (which are normally

associated with PKI systems), the Law is technology neutral. In a departure from best practice

in e-signature legislation globally, the Law does not contain a “party autonomy” provision

which would enable the parties to a particular electronic transaction to establish a framework

as between themselves of how they would authenticate each other. Also, the only “scope”

provisions (i.e., a description of the types of transactions that the Law applies to and what types

of activity are beyond its application) is the reference in article 14 of the Law to civil,

commercial and administrative dealings.

The main legal instrument implementing the Law is the Decree. The Decree sets forth

provisions regarding the establishment of so-called public and private key infrastructure (PKI)

for purposes of authenticating the users of e-signatures and the content of electronic

3 Both available at: http://www.itida.gov.eg/E-Signature_Regulations.asp

http://www.itida.gov.eg/E-Signature_Regulations.asp



9 of 60

documents, including the role that ITIDA will play as the root certifying authority (Root CA)

and in the regulating certificate service providers (CSPs). In that sense the Decree is not

entirely technology neutral. While under the Law, there is no stated preference for the kind of

legally recognizable e-signature, a PKI preference is emerging under the decree, though it is

understood that use of PKI-based e-signatures will be mandatory. In principle this might mean

that while other forms of electronic signature that otherwise meet the requirements under the

Law, they might not be presumptively be granted legal functional equivalence to a wet ink

signature on paper, requiring the party or parties to meet the burden of proof that the electronic

signature was valid.

B. Institutional Arrangements

Under the Law and the Decree, ITIDA acts as the root certifying authority (Root CA) for

issuing digital certificates in Egypt. ITIDA will ultimately determine the validity of every

digital certificate in Egypt, and will certify “foreign”-issued certificates as well. ITIDA will

license other entities to issue digital certificates as Certificate Service Providers (CSP), who in

turn will issue digital certificates to end users in the private sector. On the public side, ITIDA

will license a Government Certificate Authority (Gov CA) to issue digital certificates for

official use. Figure 1 shows the organization of the Root CA structure. A “trust center” will

be built around the Root CA that will operate around the clock, the physical attributes of which

will ensure the highest degree of security for the operational integrity of ITIDA’s activities as

Root CA.



10 of 60

Figure 1

Source: ITIDA

4

In this capacity ITIDA will be acting as the Root CA and will be licensing other CSPs.

As part if its functions as Root CA, ITIDA will be operating a secure Root CA Trust Center.

The Root CA Trust Center will be responsible for issuing certificates to CSPs, issuing smart

cards, providing time stamping services and other matters related to the provision of electronic

signatures. The Trust Center will be a secure psychical place within ITIDA consisting of a

multiple layer, secure-entry facility, as well as layered security for access to the Root CA’s

systems. Hardware and software for Key generation will not be linked to the Root CA’s other,

Internet-related networked systems. The Root CA Trust Center will not issue certificates

directly to end users.

ITIDA has entered into Memoranda of Understanding (MoUs) with Germany and Korea.

4 http://www.itida.gov.eg/E-Signature.asp

http://www.itida.gov.eg/E-Signature.asp



11 of 60

Figure 2

Source: ITIDA

5

C. Expected uses of e-signatures in Egypt

It is expected that digital signatures will be used in a wide variety of transactional

contexts ranging from B-2-C to C-2-G and G-2-G transactions. C-2-G transactions range from

drivers licensing to tax payments and beyond.

[ITIDA to Expand on contemplated uses of PKI and expected delivery mechanisms]

5 Ibid.



12 of 60

V. Benchmarking

This chapter evaluates different aspects of the e-signatures enabling environment and

implementation in Austria, Brazil, Canada, Germany, Malaysia, Mauritius, Mexico, Singapore,

South Africa, South Korea, Thailand and the United Kingdom as follows:

Enabling Environment issues:

legal basis for use of PKI (institutional arrangement and scope of application)

institutional arrangements (operational and functional attributes), role in

certification process

security (i.e. robustness of user authentication; weak vs. strong e-signature)

“party autonomy”, and recognized authentication alternatives

interoperability – cross border recognition and “cross-certification”

PKI Implementation Issues:

applications for e-signatures PKI (for e-government processes)

distribution of e-signatures (smart cards, soft tokens, “password”, etc.)

cost of issuing certificates

The main lessons learned concerning each category and the relevance of these lessons to

the situation in Egypt follow, and are supported with country examples. This benchmarking

focuses on key issues of rolling out PKI-based e-signatures in Egypt.

A. Enabling Environment issues

A summary matrix of the benchmarking of the enabling environment is provided as

Annex 1. The matrix shows, in tabula format, the findings for each country against the

benchmarking criteria.

A theme cutting across the different enabling environment issues the importance of



13 of 60

creating and publishing certificate practices and policies, a key element in the non-legal part of

the enabling environment for PKI. This is especially true in case of Root CAs, as will be the

situation in Egypt. These practice statements and policies can cover the legal basis for the

activity, the institutions involved in PKI and their respective obligations and responsibilities,

operational requirements, as well as security controls, for example.6

1. Legal basis for use of PKI (institutional arrangement and scope of application)

With few exceptions (e.g., Australia), countries seeking to promote either approach (e.g.

promoting the establishment of certificate issuers or accreditors) generally set out the

requirements to become a certification authority (“CA”) by statute or regulation. Australia has

chosen to forego the legislative route and to initiate a policy approach known as “Gatekeeper”7,

which provides the infrastructure in which government agencies can ensure the authenticity,

integrity, and confidentiality of online activities. Any person or body that receives

accreditation under Gatekeeper becomes a CA. It appears to date that a small number of

agencies have received accreditation in Australia: eSign Australia Pty Ltd., The Australian

Taxation Office, Health eSignature Authority Pty Ltd.8 and Telstra Corporation Limited.

As regards the scope of application for e signature legislation, although a wide range of

areas can be subject to e-signatures, most countries do provide for exclusions. For instance in

Austria, the following transactions are excluded from the applicability of the e signature law:

inheritance laws, legal transactions requiring officials certification, judicial or notarial

authentication; land or companies registration or guarantee declarations. A similar exclusion is

provided for in the e signature law of Singapore (See Annex 1). In Thailand, for example, the

law applies to “all civil and commercial transactions except those excluded by a Royal Decree”

thereby reserving to the authorities a wide discretion to determine the scope of the law’s

applicability.

2. Institutional Arrangements

The role of institutions in the certification process can be two-fold. An institution may act

6 See, e.g., Certification Practice Statement, Version 1.1, Korean Information Security Agency, 2001.

See,also , PKI Assessment Guidelines, American Bar Association, Information Security Committee, Section of Science and Technology Law, 2003, for a general overview of policy content and guidelines. 7 http://www.agimo.gov.au/infrastructure/gatekeeper

8 This organization is transitioning into Medicare Australia later in 2007.

http://www.agimo.gov.au/infrastructure/gatekeeper



14 of 60

as a certificate issuer or serve as an accreditation body for organizations seeking to become

certificate issuers.

Two different accreditation methods exist, namely licensing and voluntary accreditation.

While several U.S. states, Singapore and Malaysia have chosen to issue licenses to certification

authorities, the United Kingdom, Germany, Ireland, South Africa and the Canadian province of

Quebec have chosen a system of voluntary accreditation. An example of voluntary

accreditation in the United Kingdom is tScheme9. The organization develops sets of criteria

called Approval Profiles for commercially offered trust services. These profiles permit service

providers - who can demonstrate that their services meet these sets of criteria - to use the

tScheme approval mark. In order to obtain permission to use the mark, a trust service provider

is assessed using the relevant profiles by an independent tScheme-recognized assessing body.

Following independent certification of compliance with the tScheme criteria, the trust service

is granted approval by tScheme Ltd, including the right to display the tScheme mark.

The two systems described above (tScheme in the U.K. and Gatekeeper in Australia) do

not differ fundamentally in their approaches and actually impose similar criteria for those

seeking to become authentication service providers.

Institutions, as noted above, may issue certificates. In the United States, the ACES10

Program was created to facilitate access to government services offered by agencies through

use of information technologies, including on-line access to computers for purposes of

reviewing, retrieving, providing, and exchanging information. One organization, Operational

Research Consultants, is authorized to act as a shared service provider and to provide digital

certificates to US government institutions. In Canada, Public Works and Government Services

Canada operates a Certification Authority as a shared service provider to federal government

departments and is seeking to extend its client base to provincial governments as well.

Further complicating the description of the role of institutions in the management of

digital certificates, is the fact that they may not issue certificates to end users or accredit

certificate issuers but provide the “trust anchor” for the underlying Public Key Infrastructure

(“PKI”).

9 http://www.tscheme.org/about/index.html

10 Access Certificates for Electronic Services

http://www.tscheme.org/about/index.html



15 of 60

Large PKIs often have a hierarchical trust model. This means that a common root Certificate

Authority (“CA”) that signs the “signing” certificates of CAs that issue certificates to end

users. Using a rough manufacturing analogy, the Root CA provides the machinery (signs the

“signing certificate”) that permits wholesales to provide certificates to retailers who in turn

provide it to customers. Customers trust the retailer because they know the Root CA is backing

the “product”.

A hierarchical trust model provides the “trust” between different CA systems subordinate

to the root and between different applications. An institution will be identified to serve as the

policy authority for the PKI and operate the root CA. In controlling the Certificate Policy that

governs the Root CA and by operating the Root CA itself, the institution maintains control

over the PKI while allowing for distributed key and certificate management.

In India, one of the objectives of the Information Technology Act of 200011 is to promote

trust in electronic environments. The Act creates the office of the “Controller of Certifying

Authorities”, which has the responsibility of acting as a “Root” Authority to certify the

technologies and practices of all the Certifying Authorities licensed to issue digital certificates.

It also licenses Certification Authorities and acts as a regulator to ensure that legislative

requirements are satisfied. Similarly in Singapore and Malaysia, the Minister appoints a

Controller of Certification Authorities with a supervisory and monitoring role. In South

Africa, the Director General of the Department of Communications acts as an Accreditation

Authority with a similar supervisory and monitoring role as the Comptroller in Singapore.

In other jurisdictions, agencies may be provided with a more global “role” with respect to

the issuance and management of digital certificates. In Tunisia, the National Digital

Certification Agency was created to:

Secure the electronic transactions and exchanges;

Cross-certify or mutually recognize foreign Certification Authorities;

11

Available online at: http://unpan1.un.org/intradoc/groups/public/documents/APCITY/UNPAN010239.pdf See section 18(b) for Root Certifying Authority role and section 20 for role as National Repository of Digital Signature Certificates.

http://unpan1.un.org/intradoc/groups/public/documents/APCITY/UNPAN010239.pdf



16 of 60

Manage digital certificates;

License digital certification services providers;

Evaluating cryptographic tools;

Provide security solutions based on digital certification for networks and for Internet

and Intranet services; and

Provide training in digital signature, encoding techniques and public key

infrastructure.12

The approach in Mauritius is similar to that taken in Tunisia. Under section 18 (z) of the

Information and Communication Technologies Act 200113, the ICT Authority is to act as the

Controller of Certification Authorities (“CCA”). The Controller of Certifying Authorities as

the “Root” Authority certifies the technologies, infrastructure and practices of all the

Certification Authorities licensed to issue digital certificates.14

Interoperability with other PKIs in other domains (e.g. financial, health) or in other

countries can be at root level. See the section on Interoperability below.

So-called “Bridge CA s” provide facilitate one entity accepting certificates issued by

another entity for a transaction by providing a connection between the PKI infrastructures of

different institutions ensuring interoperability of those infrastructures and establishment and

promotion of best practices and standardization.

While institutional aspects of the enabling environment are normally associated with

formal, governmental organizations, private sector, industry led initiatives can also play a role.

For example, the PKI Forum of Singapore15

, an industry led initiative, founded the Singapore

PKI Technology Support Center (SPTC) for testing of PKI.

3. Security of Digital Certificates

12

For further information, visit: http://www.certification.tn/index.php?id=95 13

Available at: http://www.gov.mu/portal/goc/ncb/file/ictact.pdf 14

See http://www.icta.mu/it/elec_sig.htm 15

www.pkiforumsingapore.org.sg .

http://www.certification.tn/index.php?id=95

http://www.gov.mu/portal/goc/ncb/file/ictact.pdf

http://www.icta.mu/it/elec_sig.htm

http://www.pkiforumsingapore.org.sg/



17 of 60

The level of assurance associated with them determines the security associated with

certificates. CAs often issue certificates having different levels of assurance or for different

forms of key generation The type of certificate to be used is often associated with the purposes

for which the certificates are intended to be used. Similarly, one might view the “strength” of

signature is a function of the security associated with the certificate and the authentication of

the certificate holder.

An important distinguishing characteristic between certificates is where key generation

occurs and how it is stored (more on this in the next section). Another important distinguishing

characteristic is the degree to which certificate holders are authenticated. Less secure

certificates might have online authentication and browser key generation. More secure

certificates might have in-person authentication with key generation occurring in tokens. The

CA’s Certificate Policies are the documents that describe the degree of security to be

associated with each level of assurance it offers with the certificates it issues. Certificate

authorities often readily make their certificate policies available.

Canada’s federal model PKI certificate policies are available at:

http://www.tbs-sct.gc.ca/pki-icp/guidedocs/cert-policy/aboutCP_e.asp. Those used by Canada’s

Financial Transactions and Reports Analysis Centre (FINTRAC) are available at:

http://www.fintrac.gc.ca/reporting--declaration/pki/CP_e.pdf

In the United States, the policy framework governing the public key infrastructure (PKI)

component of the Federal Enterprise Architecture is available at:

http://www.cio.gov/ficc/documents/CommonPolicy.pdf. This policy framework incorporates six

specific certificate policies: (i) a policy for users with software cryptographic modules, (ii) a

policy for users with hardware cryptographic modules, (iii) a policy for devices, (iv) a high

assurance user policy, (v) a user authentication policy, and (vi) a card authentication policy.

Australia’s PKI Framework has three Digital Certificate categories – Special, General

and High Assurance for Individuals and businesses – which are mapped to the four levels of

risk in the Australian Government e-Authentication Framework.16 The Certificate Policy for

16

The authentication framework can be found at http://www.agimo.gov.au/infrastructure/authentication/agaf_b .

http://www.tbs-sct.gc.ca/pki-icp/guidedocs/cert-policy/aboutCP_e.asp

http://www.fintrac.gc.ca/reporting--declaration/pki/CP_e.pdf

http://www.cio.gov/ficc/documents/CommonPolicy.pdf

http://www.agimo.gov.au/infrastructure/authentication/agaf_b



18 of 60

Businesses can be found at:

http://www.agimo.gov.au/__data/assets/file/53619/General_Business_Certificate_Policy_Specification.

rtf

Europe’s approach to digital certificates has been the most structured of such initiatives.

The EU Signatures Directive17

was adopted by the European Parliament and the Council in

December 1999 with all 25 EU Member States implementing the general principles of the

Directive by 2006. The main objective of the Directive was to create a Community framework

for the use of electronic signatures and ensuring a basic legal recognition of electronic

signatures. The results have been mixed to date.18

There are three types of signatures recognized under the Directive.

“electronic signature”: a broadly defined concept, applicable to any authentication of

information (e.g. a PIN, a name on an e-mail) as opposed to a person or organization;

“advanced electronic signature”: principally digital signatures (issued be “untrusted or

unknown” CA issuing digital certificates”\); and

“qualified electronic signature”: not explicitly recognized as such in the Directive, this

is advanced electronic signature based on a qualified certificate, created by a secure-

signature-creation device and meeting technical requirements described in the Directive’s

three annexes (issued by “trusted CA issuing digital certificates”).

In terms of the security of certificates, it is the qualified signatures, based on qualified

certificates that offer signatures that are the most “acceptable” in terms of being linked to an

identity. The “qualification” of the certificate goes to the quality of the certificate policy

governing the authentication/registration of the certificate holder and the secure protection of

the certificate (and keys) during the life of the certificate. The term “qualified certificate” is not

used outside of Europe but the concept of minimum standards to which the issuer of the

17

Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures, OJ L 13, 19.1.2000, p.12 . 18

See Report From The Commission To The European Parliament And The Council, Report On The Operation Of Directive 1999/93/Ec On A Community Framework For Electronic Signatures, March 2006. available at: http://ec.europa.eu/information_society/eeurope/i2010/docs/single_info_space/com_electronic_signatures_report_en.pdf

http://www.agimo.gov.au/__data/assets/file/53619/General_Business_Certificate_Policy_Specification.rtf

http://www.agimo.gov.au/__data/assets/file/53619/General_Business_Certificate_Policy_Specification.rtf

http://ec.europa.eu/information_society/eeurope/i2010/docs/single_info_space/com_electronic_signatures_report_en.pdf

http://ec.europa.eu/information_society/eeurope/i2010/docs/single_info_space/com_electronic_signatures_report_en.pdf



19 of 60

certificate must adhere is universally recognized. The “quality” of the certificate is linked to

the “security” of the certificate and the practices of the CA.

It is worth noting here the recent conclusion of the UNCITRAL Working Group on E-

commerce:

“PKI seems to be the authentication method of choice when strong evidence of identity

and high legal certainty of the electronic signature is required. The use of PKI-enabled

smart cards and the integration of digital certificate functions into application software,

have made the use of this method less complicated for users. However, it is generally

acknowledged that PKI is not required for all applications and that the choice of

authentication method should be made on the basis of its suitability for the purposes for

which it would be used.”19

In South Africa, the law provides for the presumption in favour of “advanced electronic

signatures’. It states that “Where the signature of a person is required in law and such law does

not specify the type of signature, that requirement in relation to a data message is met only if

an advanced electronic signature is used.”20

4. “Party Autonomy”, and Recognized Authentication Alternatives

Generally, “party autonomy” is a common feature in most e-commerce legislation.

Austria, Germany and Singapore, for example, specifically provide that use of e-signatures is

voluntary.21

In countries where party autonomy is not explicit, the legislation contains provisions

from which one could discern that use of e-signatures would be voluntary. For instance, in

Thailand, the Act provides that the requirements of the Act “[do] not limit that there is no other

way to prove the reliability of an e signature.”22

In South Africa, provisions of the law relating to

e signatures fall under a part of the law which is mandatory and, therefore, e-signature provisions

cannot be varied by the parties.23

19

UNCITRAL Future Work, at para. 13(c), p. 9. 20

Section 13(1) of the Electronic Communications and Transactions Act, 2002. 21

Section I §1(2) of Federal Electronic Signature Law of Austria; Section §1(2) of German Electronic Signatures Law and Section 5 of Electronic Transactions Act of Singapore; Section

22 Section 26 of Thailand’s Electronic Transactions Act (2001)

23 Part 1 of Chapter III of Electronic Communications and Transactions Act; see also D. Campbell, E Commerce and the Law of Electronic Signatures, p. 567



20 of 60

5. Interoperability

Generally within one PKI domain, a document that is associated with a digital certificate

(e.g. has been digitally signed) is validated by the CA that both the sender and recipient share.

Interoperability is raised as an issue when the sender and recipient and in different domains and

the recipient must rely upon his/her CA to establish trust with the other domain.

This has both technical and non-technical aspects. Technically, PKI applications must

conform to technical standards in order to be able to access accurate directories which indicate

the purpose, quality and status of digital certificate used to sign the document. The non-

technical aspect requires the establishment of a relationship between the domains or Cas. This

means mutual recognition and a technical connection. Technically, this means there are four

options for conveying recognition of a CA: hierarchical CA certificates, cross-certificates,

certificate trust lists and a bridge CA. This paper does not propose to examine in detail these

different approaches but notes them to indicate the interoperability approach taken by different

governments.

When discussing PKI Interoperability, there is a preference towards the bridge CA model

both in Europe (see below) and North America.24

The principle objective of any bridge CA is

to serve as a “stable” third party to co-ordinate and promote PKI interoperability by whatever

means necessary. Individual governments, accreditation agencies and CAs do not have

sufficient motive, skills or resources to deliver and maintain interoperability.

Complicating matters is that there is there is no universal model to adopt or recommend

for CAs within a domain. There is some doubt that any country starting a PKI should start with

a “bridge model”. Experience to date in the US and Canada would seem to suggest that while

a bridge system between CAs eventually is needed, governments start by using a single

certificate authority within government as a shared service provider (as opposed to different

institutions having different CAs and trying to connect them together).

24

Slightly dated but I believe still a valid conclusion. See Stillson K D, Public Key Infrastructure Interoperability: Tools and Concepts, The Telecommunications Review 2002 http://www.noblis.org/Publications/Stillson_07.pdf

http://www.noblis.org/Publications/Stillson_07.pdf



21 of 60

As the term suggests, PKI is about infrastructure – an enabling platform to permit the

development of secure e-government or e-commerce. It is not technology to easily deploy. The

establishment of one or more CAs is a challenging task given the complexity of the technology

and the need to support and/or develop applications that utilize the technology.

It is arguable that the cost of deploying a CA (and associated certificate management)

together with the need for trained personnel and interoperability (in connecting two or more

Cas) should lead to the deferment of a central bridge CA model and reliance on one CA to

issue certificates for a number of institutions using a shared/common service provider model.

There does not appear to be a clear consensus on the best interoperability model below

the bridge CA level. In the Canada and the United States, at the federal level, there are bridge

Cas. When a PKI cross-certifies with a bridge CA, a Relying Party can trust that PKI’s digital

certificates at the Level(s) of Assurance asserted by those certificates. A list of organizations

that have cross-certified with the US Bridge CA may be found in Annex B.

It is important to note that the US Federal Bridge CA accepts the Certificate Policies as

submitted by the CAs – an approach that requires Relying Parties to make their own trust

decisions as to whether or not to accept the digital certificate.

In Europe, officials of institutions participating in networks of the inelegantly titled

Interoperable Delivery of pan-European eGovernment Services to Public Administrations,

Businesses and Citizens (“IDABC”) use digital certificates issued by the IDABC PKI. The EU

tried (or is trying) a different approach in using a bridge CA: establishing the necessary trust

relationships through the distribution of certificate trust lists, digitally signed by the bridge CA.

A report on trust list usage, together with the architecture and a pilot program, were developed

as of 2004.25

25

See Bridge/Gateway Certification Authority Page at: http://europa.eu.int/idabc/en/document/2318

http://europa.eu.int/idabc/en/document/2318



22 of 60

The following summary table provides some international examples of interoperability.26

Root CA / Hierarchy

Cross Certification

(Mesh)

Cross Recognition

Bridge CA Certificate Trust List

Brief Description

An organised chain of Cas, run from the top down.

Cas certify each other as peers

Cas/PKI domains agree to recognise each other’s certificates

A central bridge CA manages interoperability between all other Cas

A list of trusted CAs is distributed

Role Technical mechanism to convey recognition.

Technical mechanism to convey recognition. May also have role in establishing recognition.

Political and contractual process of establishing recognition.

Technical mechanism to convey recognition. May also have role in managing recognition.

Technical mechanism to convey recognition.

Working examples

Global – Identrus

Germany – RegTP

Asia – PAA

Australia – Gatekeeper / Angus

US Federal Bridge

EU – Commercial Bridge

EU – Government Bridge

Agreement required

Tight agreement from the beginning

Only between CAs as needed

Political co-operation

Consensus of CAs to use bridge

Only useful if publisher already has authority

Technical interoperability – design stage

Yes – fully interoperable

Yes – but may require significant modifications

PKIs remain separate at technical level

Bridge can play a role in managing interoperability

Requires another mechanism to establish recognition (eg Cross Recognition)

Technical interoperability

– real time operation



Requires use of other tools (eg Trust Lists) to achieve technical interoperability

Partial technical interoperability only – stronger if used with other tools (eg Trust Lists)


Costs Low – simple, easy system

High – each pair of CAs must go through expensive process to cross-certify

Low-Medium – co-ordinating body must enforce rules and audit participants

Medium – bridge CA has significant workload

Low, but varies with modes of use

Scalability Medium – short Low – full mesh Medium – no Medium-High – High – simple,

26

This table is found in at: http://www.galexia.com/public/research/articles/research_articles-art32.html#Heading96

http://www.galexia.com/public/research/articles/research_articles-art32.html#Heading96

http://www.galexia.com/public/research/articles/research_articles-art32.html#Heading96



23 of 60

and certain certification paths back to trusted root

has n2 pairs,

certification paths may be long

technical barriers, but challenging administrative co-ordination

limiting factor is bridge workload

direct trust

Security risks High – single breach of root brings down network, subordinate CAs must be re-certified

Low – single breach may have no effect on others, or may fragment network

Low – depending on level of technical integration, probably no effect on network

Medium – breach of bridge brings down network, but participants can still operate on their own

Medium – depending on implementation, may be lag between security breach and list update

Most countries provide in their laws for cross-certification and cross border recognition of

certificates, even if subject to certain conditions being met. The laws in Austria and Germany

have guidelines on the recognition of foreign certificates one of which is that such certificates

must meet the requirements for the issuance of certificates under the EU Directive.27

This is

mainly the case with certificates originating from non EU states. Certificates from EU member

states are considered equivalent to domestic (qualified) e signatures. In other countries, foreign

certificates are treated on an ad hoc, case–by-case basis. In South Africa and Singapore, the

power is reserved for the Minister responsible to recognize foreign CAs from particular

countries through regulations published in the Gazette. Surprisingly in Mauritius, the law is

silent on either cross-border or any provisions on interoperability.

B. PKI Implementation Issues

1. Applications

Most digital signature applications are generally integrated with business applications.

Often the digital certificate is not obvious and is otherwise “below the surface” and not visible

to the user. Because of this, the digital certificate is often a “general purpose” certificate,

which is used to identify the user in a relatively wide range of transaction types. The epass in

Canada serves as an example, where the CA issues a certificate to the user but the government

institution does the mapping between the digital certificate and identity.

Five years ago, web-based applications were the most popular PKI applications in the

27

Section 24 of Austria’s Federal Electronic Signature Law; and Section 23 of German’s Law on Framework Conditions for Electronic Signatures



24 of 60

market followed by server certificate authentication. Organizations preferred key pair solutions

(server certificates) compared to hardware type solutions (tokens) mainly due to its ease of

implementation. Now, with two-factor authentication becoming more “mainstream”, the use of

a physical item (e.g. tokens, smart cards, grid card) may increase.

Most digital certificates issued today are used in a relatively limited range of applications.

A lot of the digital certificate applications are e-government related. Generally there is a dearth

of applications available that will use digital certificates.

Software often can select and invoke the appropriate certificate automatically, without

user intervention. This is beneficial in making the user’s experience of digital certificates (and

the associated key management) relatively painless and seamless for the user. However, a

serious question to consider is how well can the technology be implemented into existing

information technology infrastructures. The “plus” side of this is that the use of third party PKI

service providers becomes a more attractive option for organizations and government

institutions.

The applications that can use digital certificates vary but can be broadly placed in a series

of categories

Authentication, through the verified issuance of a digital certificate.

Verification of integrity, through the use of valid digital signature keys contained in a

digital certificate;

Authorization, through the use of a valid digital signature keys contained in a digital

certificate; and

Confidentiality, through the use of a valid encryption keys contained in a digital

certificate.

Authentication may consist of confirming the identity of a natural person or a machine or

the source of a document or code. Verification of integrity may apply to the contents of an

electronic document or to the executable code.



25 of 60

Digital signatures may serve as the electronic equivalent of “wet” or “paper-based”

signatures. In a large number of jurisdictions, the equivalency of such signatures has been

confirmed in law. For example, in Austria, the use of a secure electronic signature meets the

legal requirements for a hand-written signature under the Federal Elextronic Signature Law.28

The German law provides that use of a qualified e-signature meets the legal requirement for a

hand-written signature.29

A requirement in law that a document or information must be in

writing is met, in South Africa, if the document or information is “in the form of a data

message”.30

A similar provision is contained in the Mauritius e signature law.31

Illustrations of how digital certificates are used can be seen in a number of different

countries.

(a) Finland

In Finland, the Population Register Centre and, a mobile telephone provider, TeliaSonera

Finland, are issuing the “State Citizen Certificate” to enable secure mobile communications

and commerce. The Citizen Certificate is included in SIM cards, which permit mobile phone

users to authenticate themselves for both public and private sector services. The Citizen

Certificate card was made available in January 2005.32

Finnish government employees are being issued “Chip ID cards”. The photo ID cards

contain a digital certificate, which permits authentication of network users and their usage

rights; encryption of email and documents; and a digital signature. Uses include access control

systems, teleworking, passage control and physical identification33

More specific applications include:

28

Section 2 §4(1) 29

See D. Campbell E Commerce and the Law of Electronic Signatures, p. 240 30

Section 12 of Electronic Communications and Transactions Act (2002) 31

Sections 5 and 6 of the Electronic Transactions Act (2000) of Mauritius. 32

See News report at: http://e.finland.fi/netcomm/news/showarticle.asp?intNWSAID=30340 33

E-Government in Finland 2007. Available at: http://ec.europa.eu/idabc/servlets/Doc?id=28744

http://e.finland.fi/netcomm/news/showarticle.asp?intNWSAID=30340

http://ec.europa.eu/idabc/servlets/Doc?id=28744



26 of 60

Online change of address34

Electronic Birth Registration35

Online tax filing36

(b) Canada

The federal government created and made available its “epass” in September 2002 to

further its e-government objectives. An epass is a “zero footprint” digital certificate issued and

downloaded to a client’s computer each time a secure Internet transaction is initiated, and

remains downloaded only during that transaction. The certificate, once validated by the

government department responsible for the program, ensures that the client will be

automatically recognized during future transactions with the department.

An epass is used with a program that requires both the Government of Canada and the

user to be authenticated. Users are allowed to have a different epass for each epass-enabled

Service.

The first provider of epass-enabled service was the Canada Revenue Agency (“CRA”).

As of March 2007, fifty-nine of sixty-five programs on-line across twenty-two Canadian

federal government departments are epass-enabled. These include:

CRA’s MyAccount and My BusinessAccount;

Service Canada’s Record of Employment; and

Foreign Affairs Passport Online

Some statistics of interest include:

34

See:

http://www.vaestorekisterikeskus.fi/vrk/home.nsf/maindocuments/a092a36e225eadfec2256c93003bae20?opendocument 35

See http://e.finland.fi/netcomm/news/showarticle.asp?intNWSAID=44510 36

See https://www.cosic.esat.kuleuven.be/modinis-idm/twiki/bin/view.cgi/Main/FinnishProfile

http://www.vaestorekisterikeskus.fi/vrk/home.nsf/maindocuments/a092a36e225eadfec2256c93003bae20?opendocument

http://www.vaestorekisterikeskus.fi/vrk/home.nsf/maindocuments/a092a36e225eadfec2256c93003bae20?opendocument


https://www.cosic.esat.kuleuven.be/modinis-idm/twiki/bin/view.cgi/Main/FinnishProfile



27 of 60

Over 2.4 million epasses were issued as of February 2007.

Over 50,000 businesses use the online Record of Employment service

Over 6 million logons by business clients in 2006.37

(c) United States

According to a December 2003 study prepared by the Office of Management and Budget

in the United States38

20 of the 24 agencies reported that they were undertaking a total of 89

PKI initiatives. These initiatives represented a significant investment, estimated at about $1

billion. The report identified a number of challenges for the implementation of PKI-enabled

applications within the American government.39

(d) European Union

In Europe, given the existence of the EU Signatures Directive and issuers of qualified

certificates, a number of e-government applications are used in conjunction with “electronic ID

cards”. In providing on-line access to government services, these cards have three main

functionalities: identification, authentication and signing. In Belgium, for example,

approximately 1.3 million electronic ID cards have already been activated.40

Overall, the “market” for digital certificates and the associated signatures has been slow

to develop. Part of the problem is technical (the complexity of PKI systems; the lack of

interoperability between different domains); part is simply the demand for trusted third parties

(the Cas) authenticating an identity for general purposes. Application “owners” have little

reason to develop multi-application uses for digital certificates

Most uses of digital certificates occur in “closed” PKI systems where all the parties are

37

See “Secure Channel and e-business Standards”. Presentation by Bob Sunday, Office of Chief Information Officer, Government of Canada, available at: www.isacc.ca/isacc/_doc/Book21-2007/ISACC-07-37304.ppt 38

While this OMB report is somewhat dated, an extensive literature search provided this as the only document discussing US e-government initiatives that use PKI. 39

See Highlights document available at: http://www.pubklaw.com/ecomm/d04157high.pdf. The full report is available at: http://www.gao.gov/new.items/d04157.pdf 40

See “Electronic Identity Being Consciously Promoted in Europe and Around the World” available at: http://e.finland.fi/netcomm/news/showarticle.asp?intNWSAID=43382

http://www.isacc.ca/isacc/_doc/Book21-2007/ISACC-07-37304.ppt

http://www.pubklaw.com/ecomm/d04157high.pdf

http://www.gao.gov/new.items/d04157.pdf




28 of 60

somehow known to each other (e.g. the issuer is the institution with whom the certificate

holder is or will become a client). From a privacy perspective, this is not a bad thing but it

means that digital certificates are often used for only one application. In Canada, the federal

government’s epass service is based on the CA not knowing the identity of the certificate

holder.

(e) Asia

In Asia, the Asia PKI Forum is an organization established to promote PKI

interoperability in the Asia/Oceania Region. Membership consists of the Macao Post and PKI

Forums from Korea, China, Japan, Chinese Taipei, Singapore, Hong Kong and Thailand.

The Forum divides itself into a series of working groups to address technical and policy

issues.

Legal Infrastructure Working Group issues an annual report concerning cross-border e-

commerce;

Business Case/Applications Working Group addresses issues concerning the

development of an international e-business infrastructure through Asia PKI Forum;

Interoperability Working Group addresses PKI interoperability issues;

World Wide Collaboration Working Group facilitates information sharing and

collaboration concerning PKI as well as ICT security between the Forum and other

organizations

In 2005, the Business Case/Applications Working Group issued an “Asia PKI

Application Case Book”, which highlights the various business models in Asia using PKI

technology. At that time, and without significant changes since then, the technology is mainly

used for online authentication in e-government and e-banking contexts. The report is available

at: http://www.asia-pkiforum.org/web/Column.asp?ColumnId=21 under the heading

“Resources”.41

An illustration of the pace of application deployment can be seen in this quote from the

report on Japan:

41

Given the difficulty in locating the document, a copy will be provided to you under separate cover.

http://www.asia-pkiforum.org/web/Column.asp?ColumnId=21



29 of 60

“However, while the PKI utilization in the B2G field is moving forward, PKI

utilization for e-commerce in the fields of B2B and B2C is not making as much

progressing as initially expected. Though it is true that about 20 private

businesses have adopted the designated certification services that are

described by the Electronic Signature Law and have issued Public Key

Certificates, the majority of these certificates are not used for e-commerce

between private companies. Rather, they are mainly used in the B2G field

for electronic government services on the local and national level.”

In Korea, the outlook is expressed more positively:

“Internet Banking

All banks deployed licensed certificate authentication system. If a customer has to

transfer his money online, the customer must sign digital signature using his

licensed certificate. Some banks enhance the level of control by blocking to see

the transaction of an account if they haven’t a certificate.

Online Stock trading

All securities deployed licensed certificate authentication system. If a

customer has to trade his stock or transfer money online, the customer has to

log-in by submitting digital signature using his licensed certificate. A customer

can submit digital signature for transaction each time.

E-Government

The government services web sites for civil petition, many types of certificate

issuance, notification of internal work process, etc. With licensed certificate,

people submit their digital signatures when it is needed and access related

information, get certificates by printing, and request civil petition.

E-Commerce

When they use credit card on the Internet shopping mall site, they have to

submit digital signature if the total price of the product exceed 300,000

Korean Won. It is now applied to major two credit card companies, but

supposed to apply to every credit card company from October 2005. It is expected to

block illegal usage of credit cards.”

Specific examples of applications can be seen in:

Korea: Education: Confidentiality and Integrity for School/Student Information

Korea: Education: Parental Approval Via Digital Signature



30 of 60

Korea : E-Commerce : Digital Content Authentication

Japan: Healthcare: Medical And Healthcare Network

Japan: E-Commerce: Electronic Account Receivables For Small-Medium Enterprises”

Chinese Taipei: E-Government: PKI Applications In E-Government

(f) Africa

Tunisia has established a very modern approach to the use of digital certificates,

ocusing on e-government, e-commerce and e-banking applications to date. Applications

include e-filing for taxes42

; online payment accounts43

; server certificates for merchant web

sites44

and on-line banking45

. In South Africa, the law provides for the acceptance of filing and

issuing of documents by public institutions. However, the law further sets out various

conditions (specific to the use of e signatures in public bodies) within which this can be done to

ensure security and confidentiality.46

The emphasis in deploying any PKI or establishing a CA is to ensure that the emphasis is

on the business application and not on the PKI technology itself. A digital certificate is a means

to an end – secure online transactions/communication. This means that the identification of the

certificate holder has to be reasonable in the context of the application for which its use is

sought. This in turn argues for a reasonable “mapping” of application to level of assurance in

the certificate. A high assurance certificate is not needed for a low risk transaction in a closed

PKI environment. As a result, one area to consider is how to facilitate enrolment of certificate

holders.

2. Distribution of Certificates

A digital certificate is simply an electronic file, digitally signed by a CA that contains

certain elements or “values” such as the certificate name and usage, certificate holder

information, the public key itself, an expiration date, and the name of the CA that generated the

42

See http://www.certification.tn/index.php?id=149 43




See section 28 of South Africa’s Electronic Communications and Transactioons Act, 2002.







31 of 60

certificate.

It is perhaps obvious, but the security provided by digital certificates is only as good as

the security provided for the storage and use of the private keys. Digital certificates can be

stored on the user’s computer, in software modules, or on hardware devices like smart cards or

other hardware. The choices then are essentially distributing digital certificates in either

software or hardware form.

Certificates stored on a computer hard drive are the least expensive means of storing a

certificate but also the least secure. Essentially, a browser generates the private and public

keys. The certificates and private keys are then stored in PIN-protected, encrypted files on hard

drives. The browser performs functions such as encryption/decryption and digitally signing

electronic documents using those certificates and private keys.

Smart cards/tokens/devices contain a microprocessor and memory and provide the most

secure solution because keys are generated on the card or device with the certificates and

private keys are stored in an encrypted file on the card, token, or device. The

encryption/decryption and digital signing functions are performed on the card or device. As a

result, the private keys are never exposed outside the device.

These devices come in different forms including:

Smart cards with card reader that generally connect to computers through a

Universal Serial Bus (USB) port or through a PCMCIA card slot;

USB token that plug directly into a Universal Serial Bus (USB);

Fingerprint devices; and

Embedded-in-the-computer security chips.

The eventual choice in the distribution of digital certificates is a function of security as

well as the application for which the certificate is required for encryption or signature

purposes. Digital certificates and their associated keys are generally used by web browsers and



32 of 60

e-mail clients for user authentication and/or digital signatures. This means they will need to be

stored so that they can be easily retrieved by the user for these functions. If the application (or

perhaps more accurately the information being accessed or used by the application) is more

sensitive then additional security requirements may dictate the use of “devices” to hold the

certificate (e.g. smart card or token). It is important to emphasize that the security is not really

for the certificate but the keys associated with them.

Apart from anecdotal examples already included in this report, little hard

comparative data were discovered about either the numbers of certificates issues or the volume

of electronic transactions using such certificates. 47

Information regarding the operations of

certification authorities or certification service providers, including details of the number of

certificates issued (by whom when and how distributed), the transaction volume and the costs

for issuing certificates is limited on public websites of the countries surveyed. As a result, we

have not been able to establish any comparative pattern of the costs or distribution mechanism

or transaction volume among these countries. In Austria, for example, a number of accredited

Certificate Service Providers (“CSP”) (2) supervise the activities, in turn, of a number of other

CSPs (6) who have issued thousands of Qualified Certificates (“QC”). In Germany, some 23

accredited CSPs have some tens of thousands of digital certificates. And in Malaysia, for

example, some 22 million smart cards using a PKI system have been issued, for use in more

than a dozen applications.

3. Cost of Issuing Certificates

The development of a system to provide digital certificates can be easily characterized as

an “infrastructure” cost. Calculating any return on investment (“ROI”) for digital certificates

alone is difficult.48

Any ROI often has to be linked to the application(s) that the digital

certificate is intended to support and how the certificate assists in the shift for the current

business process to an electronic process or a more secure electronic process. Information on

47

The figures provided here are drawn from data available at the public websites in these countries. 48

For an interesting discussion on the subject of “calculating” PKI ROI, see, e.g., “Guidelines on how to determine Return on Investment in PKI”, available at: http://www.oasis-pki.org/whitepaper/roi.pdf published by eh OASIS PKI Group (OASIS Paper).

http://www.oasis-pki.org/whitepaper/roi.pdf



33 of 60

the pricing of certificates is often not readily available.49

Usually, in terms of cost, the fixed

and variable cost of producing certificate no. 1 is the total cost of establishing the Certification

Authority issuing the certificate. The marginal cost of producing certificate no. 2 is zero (this

leaves aside any licensing fees associated with certificate production).

It is somewhat axiomatic to suggest that the higher the trust to be placed in a digital

certificate, the higher the cost of the certificate. The cost of managing a certificate is the global

cost of producing the certificate, registering the holder of the certificate and then maintaining

the certificate throughout its lifecycle, which may include “helpdesk” support.

The OASIS Paper describes the various costs according to a “digital certificate supply

chain” (see figure 3), and breaks down costs according to each element in the chain.

Figure 3

49

An illustration of pricing, the cost of obtaining identity and encryption certificates under the ACES program in the

United States from one service provider, and examples of pricing for certificates issued by the Washington State

Certification Authority are provided in Annex 3.

Certificates

RA CA

Key

Media

Application

Registration

End user

Adapted from OASIS PKI White Paper



34 of 60

Box 150

It is important to note that how one approaches the subject of verification of identity

50

See, OASIS Paper,

Four types of cost can be identified and need to be estimated to determine the Total Cost of Ownership

for a PKI system:

A. Fixed Establishment Costs

B. Variable Establishment Costs

C. Fixed Annual Costs

D. Variable Annual Costs

Application related - All costs associated with PKI enablement of the Application, including

planning and designing, ‘shopping around’ for a CA solution, acquiring any necessary PKI toolkits

and ‘glueware’, and integrating PKI components with the application. In supply chain parlance, the

Application is the eventual ‘consumer’ of certificates, and sits at the end of the supply chain.

End user related - All costs associated with supporting end users, including help desk, education, and

the marketing efforts frequently undertaken to promote the benefits of PKI. Note that some costs are

borne directly by the user; for example, the user may need to spend time and money presenting in

person to a Registration Authority (RA).

Certificates - The cost of certificates themselves. Outsourced CA service providers and CA software

vendors usually charge a fee per certificate, which can be paid by application scheme operators on

behalf of the users (and possibly passed on) or paid directly by the users themselves.

RA - Costs associated with front-end registration. Internal enterprise RAs operated for example by an

organization’s HR or customer service department might utilise regular office staff and

accommodation, with little or no incremental cost. A bureau style third party RA on the other hand,

providing general purpose identity certificates may have significant set-up, infrastructure and staffing

costs. Third party RAs may have to make provision (or purchase insurance) to cover potential liability

for errors and omissions.

CA - Costs associated with the backend Certification Authority operation. Investment in security,

cryptographic systems, infrastructure, personnel, facilities and compliance related activities will be

required in line with the risk profile of the PKI’s business application, and the scale of the user

population. Enterprise CAs supporting internal applications might be implemented using commodity

software products and operated within the organization’s IT shop. On the other hand, a commercial

third party CA could require purpose built facilities, site redundancy, and major independent audits, as

well as provision or insurance to cover potential liabilities incurred by the CA operation.

Key media - Costs of the media in which end user private keys are conveyed. Can be close to zero for

simple soft certificates, or can entail license fees for roaming soft certificate solutions. Additional

hardware expenses might be associated with certain media like smartcards where readers may be

required.



35 of 60

will influence cost/pricing of certificates. As an example, the issuance of certificates through

the epass program in Canada is done electronically; the verification of identity is done online

through the use of shared secrets between the institution and the client seeking to register a

digital certificate with that institution. This is a lower cost exercise than if the client had to

present him/herself to an individual and provide tangible proof of identity.

Pricing and “cost” determinations have many variables associated with them and there

is no simple answer without detailed analyses of each of the variables in each situation.

Additionally, because of the distributed nature of the cost of using PKI across platforms and

for different purposes, even CA operators may not accurately know the overall cost of the PKI.

In another example, the U.K. Government initiated a biometric-based national ID card

program.51

The program was criticized both on the basis of too-low cost estimates and

questionable technological assumptions of using biometrics. Regarding cost, an independent

evaluation estimated that costs would be more than double Government estimates. On

technical grounds, the use of biometrics was criticized as being unproven technology, and the

reliance on a single database was criticized as too risky for the protection of personal data. An

ancillary lesson learned from the U.K. experience is the importance of clearly identifying the

purpose for which an electronic authentication system is to be used.

51

See, Eric Guizzo, “Britain’s Identity Crisis: Proposed biometric ID cards won’t prevent fraud or terrorism”, IEEE

Spectrum, January 2006.



36 of 60

VI. Recommendations for strengthening Egypt’s e-signature and PKI enabling environment

The following findings and recommendations are intended to build on the foundation for

PKI provided in Law and the Decree. In that sense they are aimed at enhancing the trust and

confidence of users in the system in order to encourage use. They are also aimed at helping to

identify where in the “certificate supply chain” costs may be incurred, and to isolate and reduce

downstream costs (actual and hidden costs).

A. As Root CA, ITIDA should develop certificate standards policies

applicable to Egypt, and can use its existing relationships with is MoU

partners in this regard.

One key element in the non-legal part of the enabling environment for PKI, especially in

cases of Root CAs, is the existence and publication of a Certification Practice Statement and

Policy that will govern the issuing and use of digital certificates. These practice statements and

policies will cover the legal basis for the activity, the institutions involved in PKI and their

respective obligations and responsibilities, operational requirements, as well as security

controls, for example.

B. Measures to limit the liability of ITIDA as Root CA

Since ITIDA will be acting as Root CA in Egypt, in the absence of other constitutional,

administrative or statutory protections, ITIDA should consider the manner in which liability

will be apportioned between ITIDA, as Root CA, and users for erroneous certificates, forged

signatures, certificates issued on false pretences, or errors in certificate repository or CRL, for

example.

C. Clarify which electronic transactions will be subject to PKI

Currently, under the Law and the Decree, it is envisaged that there will be a hierarchy of

electronic transactions. The Decree, for example, provides for electronic signatures (which are

the equivalent of “strong” signatures, the underlying transaction of which will presumably be

subject to PKI) and electronic documents and writing (which are the equivalent of “weak”

signatures). Both are given legal effect under the Law and Decree. However, by clarifying



37 of 60

which kinds of electronic transaction activities ITIDA expects will be subject to PKI, ITIDA

can also better understand the cost and benefit structure of implementation of PKI in Egypt. In

this regard it is understood that a key element of this will be the awareness raising campaign,

which is the subject of the next phase of the World Bank RTA with ITIDA. This campaign

should also foster trust and confidence and enhance greater use of the systems made available

under the PKI regime.

D. Training for lawyers and judges on e-signatures issues

Another part of the awareness–raising campaign, and an essential part of enabling

environment will be training of lawyers and judges in the different policy, legal as well as

technical aspects of PKI.

E. Introducing alternative dispute resolution processes for e-signature matters

Related to the foregoing issues of trust, confidence and awareness, and because of the

unique issues involved in the use and application of PKI in certain electronic transactions, it

will be beneficial to ensure the speed and certainty with which disputes related to PKI are

resolved.

F. International Considerations

The United Nations General Assembly recently approved the opening for signature of the

UNCITRAL Convention on Electronic Contracting (Convention).52

The Convention applies to

cross border e-commerce activity, and therefore falls outside the focus of this report, insofar as

the scope for the report deals with use of e-signatures within Egypt. However, the Convention

raises a least one interesting issue with respect to the Law in Egypt. The Convention contains

a “party autonomy” provision that permits the parties to a transaction (or a series of

transactions) to determine their own protocols – as between the parties – that will apply in

terms of authentication. The Law only provides that foreign certificates (i.e., PKI-based e-

signatures) can be recognized in Egypt. However, as noted in 4.A, above, the Law does not

have a party autonomy provision. Therefore, in terms of cross-border authentication, foreign

52

United Nations Convention on the Use of Electronic Communications in International Contracts, adopted by the General Assembly on 23 November 2005, available at:

http://www.uncitral.org/uncitral/en/uncitral_texts/electronic_commerce/2005Convention.html




38 of 60

parties not relying on PKI-based authentication cannot be assured that their electronic contract

will be automatically granted legal validity. It does not necessarily mean that the contract

would be voided, but the burden of proof would shift to the party claiming validity of the e-

signature. Finally, if Egypt were to ratify this Convention, it may need to do so on the basis of

an exception to the Convention’s party autonomy provisions.



39 of 60

VII. Glossary

B-2-C

“Business to Consumer” – refers to a commercial electronic

transaction between a natural person and an economic

enterprise

Bridge CA

C-2-G

“Citizen to Government” – refers to a non-commercial or

official electronic transaction between a natural person and a

governmental organization

Certificate

CRL

G-2-G

“Government to Government” – refers to an electronic

transaction between two governmental organizations

Private Key

(1) The key of a signature key pair used to create a digital

signature.

(2) The key of an encryption key pair that is used to decrypt

confidential information. In both cases, this key must be kept

secret.

Public Key

The key of a signature key pair used to validate a digital

signature.

The key of an encryption key pair that is used to encrypt

confidential information. In both cases, this key is made

publicly available normally in the form of a digital certificate.

Public Key

Infrastructure (PKI)

A set of policies, processes, server platforms, software and

workstations used for the purpose of administering certificates

and public-private key pairs, including the ability to issue,

maintain, and revoke public key certificates.

Root CA

In a hierarchical PKI, the CA whose public key serves as the

most

trusted datum (i.e., the beginning of trust paths) for a security



40 of 60

domain.

X.509

In cryptography, X.509 is an ITU-T standard for PKI. X.509

specifies, amongst other things, standard formats for public key

certificates and a certification path validation algorithm. 53

53

See: http://en.wikipedia.org/wiki/X.509

http://en.wikipedia.org/wiki/X.509



41 of 60

VIII. Annexes

Annex 1 – Country Benchmarking Matrix

Annex 2 – Brazil – Examples of Digital Certificates

Annex 3 – Examples of Cost Structures



42 of 60

IX. Bibliography

Campbell, Dennis, (2005), “E-Commerce and the Law of Digital Signatures”

Certification Practice Statement, Version 1.1, 2001, Korean Information Security Agency,

Dekker, Cliffe, “E Commerce in South Africa”, available at:

http://www.cliffedekker.com/literature/invest/ecommerce.htm

Diodati, Mark and Blum, Dan, “Reference Architecture Technical Position, Public Key

Infrastructure”, The Burton Group 2007, available at:

http//www.burtongroup.com/guests/content/dss/testdrive/techpositions.asp

Dumortier, Jose et al, “The Legal and Market Aspects of Electronic Signatures” (the “EU

Report”).

Fischer, Georges, “E –Commerce Law in Brazil”, available at: http://www.connect-

world.com/Articles/old_articles/10E-Commerce.html

Guizzo, Eric, January 2006 “Britain’s Identity Crisis:Proposed biometric ID cards won’t prevent

fraud or terrorism”, IEEE Spectrum, , available at: http://www.oasis-

pki.org/whitepaper/roi.pdf

Koanantakool, Thaweesak, “Electronic Commerce Development in Thailand’ available at:

http://www.nectec.or.th/users/htk/e-commerce/intro.html

Lodder, Arno and Kaspersen, Henrik, ed (2002), “E-Directives: Guide to European Union Law

on E-Commerce”

Lweis, Jamie and Blum, Dan, 1999, “Public Key Infrastructure: Architecture and Concepts”, The

Burton Group,

Mazeo, Mirella, “Digital Signatures and European Laws” also available at:

http://www.securityfocus.com/infocus/1756

OECD Recommendation on OECD Guidance for Electronic Authentication, available at:

www.oecd.org/sti/security-privacy

PKI Assessment Guidelines, American Bar Association, Information Security Committee,

Section of Science and Technology Law, 2003

Possible future work on electronic commerce Comprehensive reference document on elements

required to establish a favorable legal framework for electronic commerce: sample chapter on

international use of electronic authentication and signature methods, UNICTRAL,

ACN.9/630/Add.3, available at:


(UNCITRAL Future Work).

Smith, Brian W. and Kiefer, Kimberly B., April 1999, 116 “"Recent Developments in Electronic

Authentication: the Evolution Role of the Certification Authority”, Banking Law Journal 341

http://www.cliffedekker.com/literature/invest/ecommerce.htm

http://www.connect-world.com/Articles/old_articles/10E-Commerce.html

http://www.connect-world.com/Articles/old_articles/10E-Commerce.html



http://www.nectec.or.th/users/htk/e-commerce/intro.html

http://www.securityfocus.com/infocus/1756

http://www.oecd.org/sti/security-privacy




43 of 60

United Nations Convention on the Use of Electronic Communications in International Contracts,

adopted by the General Assembly on 23 November 2005, available at:

http://www.uncitral.org/uncitral/en/uncitral_texts/electronic_commerce/2005Convention.htm

l

van Cutsem, Jean-Pierre, “E Commerce in the World- Aspects of Comparative Law”

Wilson, Stephen, (2005), “Guidelines on how to determine Return on Investment in PKI”,

OASIS PKI White Paper, Version 1.4.

General References

Baker & Mckenzie: http://www.bakernet.com/ecommerce/germany-t.htm

For E signature in South Korea:

For E signature legislation in Mexico (in Spanish), see:

For E signature/commerce legislation in Mauritius, see:

http://www.lowtax.net/lowtax/html/jmuecom.html

On list on countries with e signature legislation, see: http://rechten.uvt.nl/simone/ds-new.htm

www.gov.mu/portal/goc/ncb/file/eta.pdf



http://www.bakernet.com/ecommerce/germany-t.htm

http://natlaw.com/interam/mx/ec/dc/dcmxec1.htm

http://unpan1.un.org/intradoc/groups/public/documents/APCITY/UNPAN025692.pdf

http://www.asemec.org/document/document_view.asp?no=415&flag=all&fnd=&sfnd_y=&sfnd_m=&efnd_y=&efnd_m=&zId=2&sId=&cNo=3&cType=3&sndMenu=&sortBy=no

http://www.asemec.org/document/document_view.asp?no=415&flag=all&fnd=&sfnd_y=&sfnd_m=&efnd_y=&efnd_m=&zId=2&sId=&cNo=3&cType=3&sndMenu=&sortBy=no

http://www.ecommerce.or.kr/activities/policy_view.asp?bNo=415&Page=1

http://www.lowtax.net/lowtax/html/jmuecom.html

http://rechten.uvt.nl/simone/ds-new.htm

http://www.gov.mu/portal/goc/ncb/file/eta.pdf



44 of 60

ANNEX 1

ENABLING ENVIRONMENT BENCHMARKING MATRIX

AUSTRIA

Legal Basis Austrian Federal Electronic Signature Law (2000);

Applicable to “closed systems, insofar as the parties within the

system have agreed” and in open transactions with courts and

other authorities.

Exceptions: legal transactions under family and inheritance

laws; legal transactions requiring official certification, judicial or

notarial authentication, land or companies’ registration;

guarantee declarations

Institutional Arrangements The Law includes duties for Certification Service Providers to

issue certificates; the Law has provisions on the supervision of

these CSPs by the Telekom Control Kommission (TCK). Prior

authorization is specifically prohibited. CSPs require no special

permit to establish their activities but all CSPs must notify the

TCK which acts as a supervisory and monitoring body,

supervising all CSPs

Security The law provides for “Basic” and “Secure” –AES and which are

based on “Qualified Certiciates” and created with security

requirements

Party Autonomy Up to parties to agree

Interoperability

(cross border recognition)

The Law has guidelines on the acceptance of foreign certificates.

Certificates from EU countries are tantamount to Austrian

certificates. Certificates from third party countries, which can be

validated in Austria, are recognized. Qualified certificates from

third party countries are recognized if conditions similar to EU

Directive are fulfilled, and provided their validity can be

verified.

Interoperability

(cross certification)

Interoperability promoted through open specifications and

voluntary standards

E Government E signature legislation (the 2000 Law) is silent. But e-

transactions in government are governed separately by the “E

Government Act”



45 of 60

BRAZIL

Legal Basis There are no specific laws in Brazil that deal with electronic

commerce. In the absence of specific laws, electronic contracts

are governed by the general principles set out in the 1916

Brazilian Civil Code (CC), the 1850 Brazilian Commercial Code

and the 1990 Brazilian Consumer Code (Consumer Code),

among other relevant statutes54

.Several statutes regulate the use

of e signatures; But an E signature Bill is still pending before

Congress

Institutional Arrangements A Government/Private sector committee regulates all

Certification Service Providers activities. But there are other

lower level entities that regulate the issuance of certificates

Security In some, especially bank operations

Party Autonomy Brazil laws with a bearing on the e signature provide the

possibilities of the parties to elect whether to use e signature

Interoperability Efforts are underway to achieve cross border interoperability;

there is also a committee to promote internal operability. But

note that Brazilian law does not associate the legal validity of a

document with the use of a specific certification or e-signature

system provided that the parties accept an alternative means of

confirming authenticity and integrity. Thus, there are no specific

rules in Brazil that regulate the validity of foreign e-signatures or

certifications.

E Government E signature applications used in Banks (including Central bank)

and government entities (e.g. tax revenue authority)

54

Geoges Fischer article, p.166



46 of 60

CANADA

Legal Basis The Personal Information Protection and Electronic

Documents Act is the Federal law; there are various provincial

laws on e-signatures, but these statutes do not apply to elections

legislation, wills and trusts, powers of attorney, documents

relating to interest in land matters and negotiable instruments

Institutional Arrangements

Security

Party Autonomy The legislation does not require use without a person’s consent;

parties can opt out.

Interoperability


There seems to be no provision in the federal law relating to

recognition of foreign certificates and electronic signatures. The

legislation does contain, however, provisions on place of

sending and receipt of electronic communications

Interoperability


E Government

GERMANY

Legal Basis Law on Framework Conditions for Electronic Signatures;

unless prescribed by law, e signature use is voluntary

Institutional Arrangements Certification Service Providers could be natural persons or legal

entities who issue certificates. No need for approval to operate

certification services but must be accredited by “Competent

Authority” under Germany’s Telecommunications law; the

‘Competent Authority’ issues accredited CSPs with qualified

certificates they need; Competent Authority is responsible for

supervising the Act and CSPs. Germany utilizes a Bridge CA.

Security “Basic” –AES (same requirements as in the Directive) and

Qualified Signatures (AES based QC and created by an SSCD)

Party Autonomy Unless prescribed by law, use of e signatures is voluntary

Interoperability


E signatures for which a foreign certificate has been issued by an

EU member country or a signatory to Treaty on European

Economic Area are the equivalent of qualified e signatures in

Germany if they correspond to EU Directive on e signatures.

There are additional requirements for e signatures from third party

countries.

Interoperability


Several bodies have been established to promote interoperability

E Government Yes

Additional requirements: long term provable signatures are

mandatory for publics entities for a few public administration

applications



47 of 60

MALAYSIA

Legal Basis Digital Signature Act 1997

Institutional Arrangements Minister appoints a Controller Of Certification Authorities for

the purposes of monitoring and overseeing the activities of

certification authorities. It is mandatory for Certification

Authorities to be licensed; Minister has the power to set

qualification requirements for CA; the Act also restricts the use

of the term “certification authority”; contains many regulations

on revocation/refusal of license

Security The Act has several provisions on security of signatures, liability

and control of private key; presumptions in favour of valid

signatures; law is based on public key infrastructure

Party Autonomy Variation by agreement is permissible

Interoperability


Controller may recognize, by order published in the Gazette,

certification authorities licensed or otherwise authorized by

governmental entities outside Malaysia that satisfy the

prescribed requirements

Interoperability


No provisions

E Government

MAURITIUS

Legal Basis Electronics Transactions Act (2000); applies to electronic

records and electronic signatures to a transaction but does not

apply to wills, negotiable instruments, power of attorney or real

property contracts

Institutional Arrangements The Act establishes the public office of Controller of

Certification Authorities responsible for licensing and

monitoring Certification Authorities

Security Secure electronic signatures provided for; there is a presumption

in favour of electronic signatures; trusted CA

Party Autonomy Parties are at liberty to vary provisions of the Act

Interoperability


Interoperability


E Government The Act provides for the use and recognition of e signatures and

records in the public sector

MEXICO



48 of 60

Legal Basis 2003 E signatures Code under the Code of Commerce, a

federal statute, with wide sphere of application. No specific

exceptions as to what documents may not be subject to the law

Institutional Arrangements CSP are heavily regulated in Mexico and there are stringent

requirements to be met to be a CSP. The Secretariat of Economy

is entrusted with enforcing the Code’s provisions. It acts as an

Accrediting Authority; CSPs must obtain prior accreditation

from the Secretariat and must notify it of the beginning of their

certification services activities within 45 days.

Security The Code provides for ‘reliable’ and ‘advanced’ signatures with

different requirements. Presumption is in favour of reliable

signatures. Note that unlike other countries or the Model Law,

the Code establishes requirements that certificates must meet for

them to be valid.

Party Autonomy Although the Code does not make reference to parties’ rights to

contractually modify or exclude the applicability of its

provisions, its generally considered that parties can amend or

derogate from the provisions to the extent not contrary to order

public

Interoperability


Foreign Certificates/signatures recognized on the principle in

recognizing the legal effects of foreign certificates or e

signatures, only their reliability is relevant. A foreign certificate

will have same effect as Mexican certificate if it complies with

the level of reliability of Mexican certificates.

Interoperability


E Government Public transactions are covered under the law



49 of 60

SINGAPORE

Legal Basis Electronic Transactions Act (the “Act”) of Singapore aims to

eliminate barriers to electronic commerce resulting from

uncertainties over writing and signature requirements

Exceptions: Doesn’t apply to laws requiring writing or signatures

in wills, negotiable instruments, indentures/power of attorney,

contract of sale or conveyance of real property

Institutional Arrangements Certification Authority (CA) issues certificates to prospective

subscribers; it is not mandatory but done on request. (Seems there

are benefits for licensed CSP); CA prescribes duties of

Subscribers; Minister appoints Controller of CAs for

certifying/monitoring CAs

Security See provisions under Part VI (person relying on e signature

assumes the risk. The Act provides for different treatment for

“electronic signatures” and for “secure electronic signatures”

which are more secure and are given additional presumptions (e.g.

of integrity, of the authority of person who created it etc).

Party Autonomy Parties are free to vary any provision of the Act

Interoperability


Yes: Minister may, by regulations, provide that Controller of CAs

recognize foreign CAs that satisfy the requirements for e signature

certificates under the Act

Interoperability


E Government Any ministry or department of Government that accepts the filing

of documents/issues permits, licenses or approvals or provides for

method and manner of payment, may do so by electronic

records/form



50 of 60

SOUTH AFRICA

Legal Basis The Electronic Communications and Transactions Act, 2002 (the “Act”); If type of signature not specified, advanced e

signatures recognized; The Act is not mandatory; Applies to any

data message or electronic transaction except where legislation

provides otherwise

Institutional Arrangements The Director-General of Department of Communications acts as

Accreditation Authority; but accreditation is voluntary; AA plays

supervisory or monitoring role

Security Provides for “advanced” e signatures unless the parties require

otherwise

Party Autonomy Provisions of e signatures fall within a part of the Act which is

mandatory and cannot be varied by agreement.

Interoperability


Minister may (by notice in Gazette) recognize accreditation or

authentication products/services from any foreign jurisdiction

Interoperability


E Government E Government services are recognized: any public body that

accepts the filing of documents or requires that documents be

created or issues any permit/license or approval or provides for a

manner of payment may do so through data messages or electronic

means



51 of 60

SOUTH KOREA

Legal Basis Has two laws: The Basic Law on Electronic Commerce and

the Electronic Signature Act (1999)

Institutional Arrangements The Act mandates the Government (Ministry of Information) to

designate an authorized certification authority to ensure the

security and reliability of electronic commerce and to promote

sound transactions. The Act designates KISA (Korean

Information Security Agency) as the body responsible for

supervising e signature certification services.

Security The Act distinguishes between accredited electronic signatures

(based on an accredited certificate and meeting specified security

requirements) and other e signatures.

Party Autonomy

Interoperability


The Act provides that the Ministry of information shall promote

activities aimed at achieving smooth interoperability of e

signatures, domestically and internationally.

Interoperability


The Act provides that the government may enter into agreements

with other foreign governments for mutual recognition of e

signatures. Such agreement shall grant “the same legal status or

effect” to a foreign CA or e signatures or certificate issued by a

foreign CA as the Korean certificate or e signature.

E Government An “E Government Act” was enacted to promote efficiency in

public services

THAILAND

Legal Basis Electronic Transactions Act; applies to all civil and commercial

transactions except those expressly excluded by a Royal Decree

Institutional Arrangements There is an Electronic Transactions Commission (consisting of

Minister and others appointed by Cabinet) with authority to “issue

rules or notifications relating to e signature” in compliance with

the Act; ETC has duty to monitor and supervise e transactions

business;

To maintain “financial and commercial stability “ and

“strengthening the credibility” of e transactions, Royal Decree

may require prior notification/registration of CSPs

Security Ordinary e signatures provided for;

Party Autonomy The requirements in the Act on e signatures “does not limit that

there is no other way to prove the reliability of an e signature”

Interoperability


An e signature created/used in a foreign country shall have same

legal effect as those created in Thailand if the level of reliability

used in creating or using such e signature is not lower than as

prescribed in the Act



52 of 60

Interoperability


Promoted: Certificate of e signature is effective regardless of

geographic location of where certificate is issued or the e signature

is created or used; and regardless of geographic location of place

of business of issuer of certificate or signatory.

E Government The Act applies to transactions (applications, payments,

permissions, registrations etc) of the affairs of the State or State

agency;

Additional Requirement: Royal Decree may require the CSP to the

public to notify or apply for registration or prior to commencement

of business with public sector

UNITED KINGDOM

Legal Basis Electronic Communications Act 2000 ; The Electronic

Signatures Regulations 2002; and also the Electronic

Commerce (EC Directive) Regulations 2002; the e signature

regulations are not limited in their scope of application

Institutional Arrangements Secretary of State oversees/ reviews the carrying on of activities

of certification-service-providers who are established in the

United Kingdom and who issue qualified certificates to the

public

Prior authorization of CSPs is not prohibited. but there is no

notification for CSPs; CSPs subject to supervision; CSPs on

tScheme are monitored for adherence to Code of Conduct. the

law does not mention voluntary accreditation, but there’s an

industry voluntary self regulated scheme (tScheme)

Security Provides for two types of signatures: “Basic” and AES similar to

the EU Directive; also note: Certificate and Qualified Certificate

are provide for with different requirements

Party Autonomy English law places great deal of emphasis on freedom to

contract. Thus parties may agree to contract out of any of the

provisions

Interoperability


None specific provision55

. But note that the definition of

“Qualified Certificate” under the Regulations does not make

reference to the jurisdiction of the certificates incorporation thus

there is nothing to limit the scope of the legislation to

“domestic” e signatures only56

Interoperability


Equal treatment of signature technologies is recognized

E Government Available; there are specific requirements for the use of e

signatures in the public sector. A government ‘gateway’ has

been established to provide a centralized registration for e

government services

55

EU report p. 216 56

Campbell, E Commerce and E signatures, p. 663



53 of 60

ANNEX 2

Brazil Examples of Digital Certificates

Sistema de Pagamentos Brasileiro http://www.bacen.gov.br/?SPB

o Central Bank

e-CPF and e-CNPJ / Certificados Digitais http://www.receita.fazenda.gov.br

o Secretaria da Receita Federal ( all federal tax and some social contributions )

Nota Fiscal Eletrônica http://www.nfe.fazenda.gov.br/portal

o Ministério da Fazenda ( ICMS, it is a VAT like tax divided among Federal

Governrnent and States )

Bank Services

o Bradesco http://www.bradesco.com.br/br/pessoa-fisica/prods

o Bradesco http://www.bradesco.com.br/pj/conteudo/pergunt

o Unibanco http://www.unibanco.com.br/epd/sgr/cer/index/.asp

Labor Courts e- DOC http://www.trt4.gov.br/edoc/certificados/htm

Federal Courts http://www.justicafederal.gov.br/portal/publicacao/

Superior Education / Ministério da Educação

o http://emec.mec.gov.br

o http://prouni-inscricao.mec.gov.br/prouni/digital/asp

o http://prouni-inscricao.mec.gov.br/prouni/passo2.asp

Caixa Economica Federal ( social programs )

o http://icp.caixa.gov.br

Insurance Brokers / Insurance Services

o http://www.acfenacor.com.br/conhecer.htm

o http://www.corretoresdeseguros.com.br/new/tecnologia/certificacao-

digital.php

Notarial Services

o http://www.notariado.org.br/soft.asp

o http://www.anoregpr.org.br/certificacaodigital.htm

Agrobusiness

o http://www.agrolivre.gov.br/modules/tinycontent/index.php?id=3

http://www.bacen.gov.br/?SPB

http://www.receita.fazenda.gov.br/

http://www.nfe.fazenda.gov.br/portal

http://www.bradesco.com.br/br/pessoa-fisica/prods

http://www.bradesco.com.br/pj/conteudo/pergunt

http://www.unibanco.com.br/epd/sgr/cer/index/.asp

http://www.trt4.gov.br/edoc/certificados/htm

http://www.justicafederal.gov.br/portal/publicacao/

http://emec.mec.gov.br/

http://prouni-inscricao.mec.gov.br/prouni/digital/asp

http://prouni-inscricao.mec.gov.br/prouni/passo2.asp

http://icp.caixa.gov.br/

http://www.acfenacor.com.br/conhecer.htm

http://www.corretoresdeseguros.com.br/new/tecnologia/certificacao-digital.php

http://www.corretoresdeseguros.com.br/new/tecnologia/certificacao-digital.php

http://www.notariado.org.br/soft.asp

http://www.anoregpr.org.br/certificacaodigital.htm

http://www.agrolivre.gov.br/modules/tinycontent/index.php?id=3



54 of 60

ANNEX 3

Examples of Costs Structures

A. United States

Note: The full table is available online at: http://aces.orc.com/pricing.html

Commercial Government

Description Clin # Price Clin #

Price

Individual and Business Representative Certificates (Level 3)1 Per Certificate

Digital Signature Certificates 0051a 0002

Under 500 $80.00 $76.00

500 to 1,000 $75.00 $72.00

1,001 to 10,000 $65.00 $63.00

10,001 to 25,000 $45.00 $44.00

over 25,000 $35.00 $34.00

Encryption Certificates (no escrow) 0051b

Under 500 $80.00 $76.00

500 to 1,000 $75.00 $72.00

1,001 to 10,000 $65.00 $63.00

10,001 to 25,000 $45.00 $44.00

over 25,000 $35.00 $34.00

Digital Signature Certificates, ID Proofing by Government 0051c

Under 500 $50.00 $49.00

500 to 1,000 $45.00 $44.00

1,001 to 10,000 $40.00 $39.00

10,001 to 25,000 $35.00 $35.00

over 25,000 $30.00 $29.00

Encryption Signature Certificates, ID Proofing by Government (no escrow)

0051d

Under 500 $50.00 $49.00

500 to 1,000 $45.00 $44.00

1,001 to 10,000 $40.00 $39.00

10,001 to 25,000 $35.00 $35.00

http://aces.orc.com/pricing.html



55 of 60

over 25,000 $30.00 $29.00

Certificates, Enterprise Service Level Agreement2, (no escrow)

0051e

First 100 Users $150.00 $145.00

User 101 to 500 $110.00 $105.00

User 501 to 1,000 $80.00 $77.00

User 1,001 to 5,000 $60.00 $58.00

User 5,001 to 10,000 $45.00 $44.00

User 10,001 to 25,000 $35.00 $34.00

over 25,000 $25.00 $24.00

Agency Application Certificate N/A 0003 $150.00

Supplemental PKI Services N/A 0004 refer to GS-

35F-164J

Technology Updates N/A 0005 refer to GS-

35F-164J

Ad Hoc Data Collection, Analysis, and Dissemination N/A 0006 refer to GS-

35F-164J

Component and Code Signing certificates (Level 3)1 Per Certificate

Application Digital Signature Certificates 0052a $500.00 0008a $490.00

Application Encryption Certificates 0052b $500.00 0008a $490.00

Domain Controller Certificates 0052c $500.00 0008a $490.00

Code Signing Certificates (includes FIPS 140 - 1/2 Level 2 Hardware Token)

0052d $500.00 0008a $490.00

Hosted Certificate Validation Services Monthly

Certificates OCSP Validation Responder Service (Monthly) 0053a 0009a

Under 1,000 users $6,600.00 $6,600.00

1,001 to 10,000 $13,200.00 $12,000.00

10,001 to 25,000 $26,400.00 $24,000.00

25,001 to 50,000 $52,800.00 $48,000.00

over 50,000 $105,600.00 $96,000.00

Certificate Validation Transaction Based3 0053b 0001

Per Transaction

Validation Volume under 100,000 $1.35 $1.261212

Validation Volume 100,000 to 250,000 $1.15 $1.051010

Validation Volume 251,000 to 500,000 $1.00 $0.892984

Validation Volume 501,000 to 1,000,000 $0.85 $0.758719

Validation Volume 1,000,000 to 5,000,000 $0.75 $0.657019



56 of 60




Validation Volume over 50,000,000 $0.50 $0.443775

Validation Volume over 100,000,000 $0.420489

Relying Party Certificate Validation Enabling Kits4 Per Kit

Server Kit (for Web Servers, Mail Servers, etc) 0054a $5,280.00 0010a $4,800.00

Enterprise Windows Domain Controller Kit 0054b $2,640.00 0010b $2,400.00

Client Kit (IE, Outlook, Outlook Express) Per Kit

10 User Kit 0054c $550.00 0010c $500.00

50 User Kit 0054d $2,090.00 0010d $1,900.00

250 User Kit 0054e $8,140.00 0010e $7,400.00

1000 User Kit 0054f $20,900.00 0010f $19,000.00

Certificate Registration Kit for User Database 0054g $16,500.00 0010g $15,000.00

Training/Registration Services one (1) day training (Maximum class size of 10)

Per Day

LRA Training and Certification of trusted individuals in your organization to streamline registration process

0055a $2,500.00 0011a $2,300.00

Recovery Process associated with an (optional) tailored organizational private key archival and recovery system for encryption private keys

0055b $2,500.00 0011b $2,300.00

PKI Sponsor training and certification of trusted individuals in an organization to request, renew and use component certificates

0055c $2,500.00 0011c $2,300.00

Code Signing Attribute Authority (CSAA) training and certification of trusted individuals granted signature authority for an organization to authorize applications or individuals for a code-signing certificate

0055d $2,500.00 0011d $2,300.00

Key Recovery Official Training and certification of trusted individuals in accordance with the requirements of the U.S. Government Key Recovery Policy (KRP)

0055e $2,500.00 0011e $2,300.00

On-site Registration Authority Daily Rate, per day 0055f $2,500.00 0011f $2,300.00

Technology Support Per Hour

Expert Level Hourly Labor Rate 0056a $305.00 refer to GSA

Schedule

Senior Level Hourly Labor Rate 0056b $205.00 refer to GSA

Schedule

Per Year

Gold Technical Support for all supplies and services5 0056c 20% of total

cost 0012a 20% of total

cost

Platinum Technical Support for all supplies and services6 0056d 30% of total

cost 0012b 30% of total

cost

User Hardware Tokens (FIPS 140-1/2 Level 2)7 Per User



57 of 60

Smartcard (Token, USB Reader, and Software) 0057a $102.50 0013a $100.50

USB Token (Token, Reader, and Software) 0057b $80.50 0013b $78.50



58 of 60

B. State of Washington Pricing (2003)

Source: State of Washington, Master Contract T00-Mst-001 For Certification Authority And Public Key Infrastructure Services, Schedule A – Authorized Product And Price List, July 2003

Initial Certificate Pricing For High and Intermediate Assurance Level Certificates, prices below

include the cost of hardware and software cryptographic modules as required by the Washington State

Certificate Policy. Standard Assurance Level Certificates use an Internet Browser or Roaming software

client to manage and protect Private Keys and Certificates and therefore do not require the purchase of

special hardware or software for Private Key protection.

High and Intermediate Assurance Level Certificates

Prices below include the Annual Subscription Service Fee*, two Certificates (one for signing and one for

encryption), plus one of the following hardware or software cryptographic (key protection) module

combinations. Costs for encryption key recovery services vary, and are listed in “Other Services” below:

High Intermediate Standard

Hardware-Based Key Protection Solutions

Datakey Model 330 Smartcard, Smartcard Reader and

Software $131.00 $121.00 N/A

Rainbow Technologies iKey2032 USB Key Fob, Software $85.00 $75.00 N/A

Rainbow Technologies iKey2032 USB Key Fob, Software

and USB Extension Cable $90.00 $80.00 N/A

Standard Assurance Level Certificates

Browser-Based Certificates

Price includes the Annual Subscription Fee*, and issuance of a single signing Certificate (which

may also be used for authentication and access control). Browser-based Standard Assurance

Level Certificates are stored in a workstation’s browser and requires the use of Microsoft

Internet Explorer (IE) Version 5.xx or higher or Netscape Version 4.7 or higher browser that

support 128-bit encryption (browser is not included in the price). Key recovery services are not

offered for browser-based Standard Assurance Level Certificates.

$10.00



59 of 60

Roaming Certificates

Price includes the Annual Subscription Fee*, and issuance of a single signing Certificate (which may also

be used for authentication and access control). Uses an unlimited-use downloadable “roaming” client to

allow an individual to access their Private Key and digital Certificate from any compatible workstation

connected to the Internet. Uses a familiar user name and password interface and provides the user the

ability to reset their password up to five times per year. Requires Windows 98 or higher and Internet

Explorer 5.xx and higher or Netscape 4.7. Key recovery services are not offered for Standard Assurance

Level Roaming Certificates.

Certificate Renewal Pricing

Prices below assume that, in the case of High and Intermediate Assurance Level Certificates, the

hardware or software cryptomodule, as required by Washington State Certificate Policy, has already been

obtained. Prices below pertain to policy-compliant Subscribers who are renewing their Certificates for

another year, or who need to replace a previously-issued Certificate.

High and Intermediate Assurance Level Certificates

Prices below include the Annual Subscription Fee* and two Certificates (one for signing and one for

encryption). Costs for encryption key recovery services vary, and are listed in “Other Services” below:

High Intermediate Standard

Hardware-Based Key Protection Solutions

Datakey Model 330 Smartcard. Smartcard Reader and

Software $35.00 $25.00 N/A

Rainbow Technologies iKey2000 USB Key Fob, Software $35.00 $25.00 N/A

Standard Assurance Level Certificates

Browser-Based Certificates


may also be used for authentication and access control). Browser-based Standard Assurance

Level Certificates are stored in a workstation’s browser and requires the use of Microsoft

Internet Explorer (IE) Version 5.xx or higher or Netscape Version 4.7 or higher browser that

support 128-bit encryption (browser is not included in the price). Key recovery services are not

offered for browser-based Standard Assurance Level Certificates.

$10.00



60 of 60

Roaming Certificates


may also be used for authentication and access control). Uses an unlimited-use downloadable

“roaming” client to allow an individual to access their Private Key and digital Certificate from

any compatible workstation connected to the Internet. Uses a familiar user name and password

interface and provides the user to reset their password up to five times per year. Requires

Windows 98 or higher and Internet Explorer 5.xx and higher or Netscape 4.7. Key recovery

services are not offered for Standard Assurance Level Roaming Certificates.

$10.00

*Annual Subscription Service Fee Includes: Customer Service Support, Directory Services, Maintenance Fees for All

Components, Online Registration, Subscriber Agreement, Unlimited Repository Access 24x7 for CRL checking, Revocation

Services, Certificate Validity Period of One Year.

Encryption Key Recovery Services for High and Intermediate Assurance Level Certificates are available as provided in

“Other Services”

World Bank Documentdocuments.worldbank.org/curated/en/679201468038084035/pdf/694… · E...

Documents

Transcript of World Bank Documentdocuments.worldbank.org/curated/en/679201468038084035/pdf/694… · E...