ORDER OF THE MINISTER OF DIGITAL DEVELOPMENT, INNOVATIONS AND AEROSPACE INDUSTRY OF THE REPUBLIC OF KAZAKHSTAN

of October 27, 2020 No. 405/Tax Code

About approval of Rules of creation, use and storage of the closed keys of the digital signature in certification center

According to subitem 13-3) of Item 1 of article 5 of the Law of the Republic of Kazakhstan of January 7, 2003 "About the electronic document and the digital signature" I ORDER:

1. Approve the enclosed Rules of creation, use and storage of the closed keys of the digital signature in certification center.

2. To provide to committee of the state services of the Ministry of digital development, innovations and aerospace industry of the Republic of Kazakhstan in the established legislative procedure:

1) state registration of this order in the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this order on Internet resource of the Ministry of digital development, innovations and the aerospace industry of the Republic of Kazakhstan after its official publication;

3) within ten working days after state registration of this order in the Ministry of Justice of the Republic of Kazakhstan submission to Legal department of the Ministry of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of data on execution of the actions provided by subitems 1) and 2) of this Item.

3. To impose control of execution of this order on the supervising vice-minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan.

4. This order becomes effective after ten calendar days after day of its first official publication.

"Is approved" Ministry of Trade and integration of the Republic of Kazakhstan

"Is approved" Committee of homeland security of the Republic of Kazakhstan

Approved by the Order of the Minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of October 27, 2020 No. 405/Tax Code

Rules of creation, use and storage of the closed keys of the digital signature in certification center

Chapter 1. General provisions

1. These rules of creation, use and storage of the closed keys of the digital signature in certification center (further - Rules) are developed according to the Law of the Republic of Kazakhstan "About the electronic document and the digital signature" (further - the Law) and determine procedure for creation, use, and storage of the closed keys of the digital signature in cloud services.

2. In these rules the following concepts are applied:

1) biometric authentication – package of measures, identifying the personality based on physiological and invariable biological signs;

2) блокчейн - the information and communication technology providing information invariance in the distributed platform of the interconnected blocks of data, the set algorithms of confirmation of integrity and means of enciphering this based on chain;

3) multifactorial authentication – method of check of authenticity of the user by means of combination of different parameters, including generation and input of passwords or authentication signs (digital certificates, tokens, smart cards, generators of one-time passwords and means of biometric identification);

4) certification center (further - UTs) - the legal entity certifying compliance of open key of the digital signature to the closed key of the digital signature, and also confirming reliability of the registration certificate;

5) the owner of the registration certificate (further - the owner) – physical person or legal entity addressed to which the registration certificate legally owning the closed key corresponding to the open key specified in the registration certificate is granted;

6) the digital signature (further - the EDS) – set of electronic digital symbols created by means of the digital signature and confirming reliability of the electronic document, its accessory and invariance of content;

7) open key of the EDS - the sequence of electronic digital symbols available to any person and intended for confirmation of authenticity of the digital signature in the electronic document;

8) the closed EDS key - the sequence of electronic digital symbols intended for creation of the digital signature with use of means of the digital signature;

9) means of the digital signature - set of the program and technical means used for creation and check of authenticity of the digital signature;

10) the cloudy EDS – the service of certification center allowing to create, use, store and delete the closed keys of the digital signature in HSM of certification center where access to the closed key is provided by the owner far off by means of at least two factors of authentication, one of which is biometric;

11) hash – transformation of array of input data of any length the bit party of the fixed length;

12) the hardware cryptographic module (Hardware Security Module) (further - HSM) - the hardware cryptographic module intended for enciphering of information and management of the opened and closed EDS keys.

Chapter 2. Procedure for creation of the closed EDS keys in certification center

3. The closed keys of the EDS are created by UTs:

1) on the carrier of key information of the owner which is transferred to the owner;

2) in the cloudy EDS.

4. The closed keys of the EDS of the cloudy EDS are generated strictly in HSM. The closed key is not taken from HSM in open form.

Under this HSM:

1) corresponds not below the third level of safety according to the requirements established by ST of RK 1073-2007 "Means of cryptographic information security. General technical requirements";

2) it is designed with the physical defense of perimeter (protection against opening of the case) using sensors for determination of the fact of opening of the case and the subsequent removal of the key information necessary for HSM.

3) meets standards of efficiency of protection and techniques of assessment of security of information and technical means according to requirements of the current legislation of the Republic of Kazakhstan.

5. The archiving of key information with HSM is possible only in encrypted form and only with separation of key of enciphering according to the scheme M from N (at least 3 of 5). Enciphering keys according to the scheme M from N are stored on the protected tokens. For the state UTs N of tokens it is constantly stored in authorized body in the field of informatization, in bodies of homeland security and at UTs. The protected tokens are used only in case of recovery of archive on reserve HSM.

6. Before creation of the closed key of the EDS and release of the registration certificate EDS the owner agrees to collection and processing of personal data.

The owner undergoes authentication:

1) far off, with use of multifactorial authentication, one of methods biometric authentication is;

2) in the center of registration of UTs with use of biometric authentication, if necessary having undergone the procedure of collection of biometric data, UTs provides storage of biometric data.

The owner agrees to storage of the closed EDS key in the cloudy EDS of UTs.

7. After creation, the closed key of the EDS remains in HSM in encrypted form with use of the state standard specification 28147-89 standard. As confidential values participate the password set by the owner who is not stored in UTs. UTs, for verification of the password from the closed owner's key, stores password hash in HSM.

Chapter 3. Procedure for use of the closed keys of the EDS which are stored in certification center

8. When using of the closed keys of the EDS which are stored in UTs, the owner undergoes multifactorial authentication, one of methods is biometric authentication.

9. Signing of electronic documents is performed in memory of HSM by transfer of the signed file or its hash in HSM.

10. In case of authentication of the owner in UTs, transfer of the password from the owner (the browser, mobile application) in HSM is made in encrypted form, at the same time enciphering of the password is made on the party of the owner, in the personal computer or the smartphone.

11. Recovery of the password from the closed EDS key in the cloudy EDS is not performed.

12. UTs provides to the owner of the closed key of the cloudy EDS information access about all signed electronic documents through personal account of UTs. The storage duration of information on all signed electronic documents constitutes at least one year after expiration of the registration certificate of the owner.

13. In case of identification of the fact of compromise of the closed keys of the digital signature of owners of registration certificates, UTs without delay publishes information on this fact and the taken measures for minimization of the caused damage on the Internet resource.

14. UTs provides recording of the next events:

1) forming of the closed key of the EDS of the cloudy EDS;

2) use of the closed key of the EDS of the cloudy EDS;

3) removal (deleting) of the closed key of the EDS of the cloudy EDS.

The storage duration of protocols of work constitutes one year from expiry date of the registration certificate.

When recording actions the following information registers:

1) owner's identifier;

2) date, time;

3) event.

15. Protocols of events the hash will daily be transformed to hash, and data are stored in chain of events блокчейн. Applied for this purpose блокчейн it is available in the Internet.

Chapter 4. Procedure for storage of the closed EDS keys in certification center

16. UTs provides protection of the closed EDS keys in UTs.

17. The storage duration of the closed EDS keys in the cloudy EDS is described in rules of application of registration certificates UTs of the approved UTs in compliance of subitem 2-1) of Item 1 of article 21 of the Law.

18. According to Item 92 of Single requirements in the field of information and communication technologies and the ensuring information security approved by the order of the Government of the Republic of Kazakhstan of December 20, 2016 No. 832 (further - ET), hardware-software providing the cloudy EDS is placed in the territory of the Republic of Kazakhstan.

19. Protection of the closed keys is provided with complex of organizational, program and technical actions according to requirements described in ET.

20. UTs provides lack of possibility of signing of electronic documents with use of the closed keys of the EDS of the cloudy EDS without multifactorial authentication.

21. Fulfillment of requirements of these rules is necessary condition in case of accreditation of UTs according to Rules of carrying out accreditation of the certification centers approved by the order of the Minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of June 1, 2020 No. 224/Tax Code (it is registered in the Register of state registration of regulatory legal acts for No. 20815).

 

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info