20. Secure digital signature

When any portion of an electronic record is signed with a digital signature, the digital signature shall be treated as a secure electronic signature with respect to such portion of the record, if —

(a)

the digital signature was created during the operational period of a valid certificate and is verified by reference to the public key listed in such certificate; and

(b)

the certificate is considered trustworthy, in that it is an accurate binding of a public key to a person’s identity because —

(i)

the certificate was issued by a licensed certification authority operating in compliance with the regulations made under section 42 ;

(ii)

the certificate was issued by a certification authority outside Singapore recognised for this purpose by the Controller pursuant to regulations made under section 43;

(iii)

the certificate was issued by a department or ministry of the Government, an organ of State or a statutory corporation approved by the Minister to act as a certification authority on such conditions as he may by regulations impose or specify; or

(iv)

the parties have expressly agreed between themselves (sender and recipient) to use digital signatures as a security procedure, and the digital signature was properly verified by reference to the sender’s public key.

Terms defined in s 2

certificate
Defined · s 2
“certificate” means a record issued for the purpose of supporting digital signatures which purports to confirm the identity or other significant characteristics of the person who holds a particular key pair;
Open s 2
certification authority
Defined · s 2
“certification authority” means a person who or an organisation that issues a certificate;
Open s 2
Controller
Defined · s 2
“Controller” means the Controller of Certification Authorities appointed under section 41(1) and includes a Deputy or an Assistant Controller of Certification Authorities appointed under section 41(2);
Open s 2
digital signature
Defined · s 2
“digital signature” means an electronic signature consisting of a transformation of an electronic record using an asymmetric cryptosystem and a hash function such that a person having the initial untransformed electronic record and the signer’s public key can accurately determine —(a)whether the transformation was created using the private key that corresponds to the signer’s public key; and(b)whether the initial electronic record has been altered since the transformation was made;
Open s 2
electronic record
Defined · s 2
“electronic record” means a record generated, communicated, received or stored by electronic, magnetic, optical or other means in an information system or for transmission from one information system to another;
Open s 2
electronic signature
Defined · s 2
“electronic signature” means any letters, characters, numbers or other symbols in digital form attached to or logically associated with an electronic record, and executed or adopted with the intention of authenticating or approving the electronic record;
Open s 2
licensed certification authority
Defined · s 2
“licensed certification authority” means a certification authority licensed by the Controller pursuant to any regulations made under section 42;
Open s 2
public key
Defined · s 2
“public key” means the key of a key pair used to verify a digital signature;
Open s 2
record
Defined · s 2
“record” means information that is inscribed, stored or otherwise fixed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form;
Open s 2
security procedure
Defined · s 2
“security procedure” means a procedure for the purpose of —(a)verifying that an electronic record is that of a specific person; or(b)detecting error or alteration in the communication, content or storage of an electronic record since a specific point in time,which may require the use of algorithms or codes, identifying words or numbers, encryption, answerback or acknowledgment procedures, or similar security devices;
Open s 2
valid certificate
Defined · s 2
“valid certificate” means a certificate that a certification authority has issued and which the subscriber listed in it has accepted;
Open s 2

Report

Read on from s 21