Summary of Vietnam’s new basic regulations on digital signatures

No.

Content

New point of Decree No. 130/2018/NÐ-CP of Vietnam’s Government

Note

1

Authentication of digital signatures

Decree No. 130/2018/NÐ-CP continues to inherit the contents of digital signature authentication services specified in Clause 6, Article 3 of Decree No. 26/2007/NĐ-CP, however, the new Decree supplements provision of necessary information to authenticate digital signatures digitally signed in data message by subscribers to authentication of digital signatures, concurrently specifying this content into a separate clause in the Decree.

This content is not regulated in Decree No. 26/2007/NĐ-CP

2

Contents of digital certificates

In addition to contents of digital certificates specified in Decree No. 26/2007/NĐ-CP, the new Decree supplements cryptography algorithm to the contents of digital certificates.

This content is not regulated in Decree No. 26/2007/NĐ-CP

3

Digital certificates of agencies and organizations

Decree No. 130/2018/NÐ-CP supplements requirements for digital certificates of agencies and organizations and competent persons of agencies and organizations. Specifically, digital certificates granted for the state title, the competent persons of agencies, organizations must clearly state the title of these persons and the name of that person's agency or organization.

Decree No. 26/2007/NĐ-CP only requires stating the title without the name of the agency or organization.

4

Digital certificates of agencies and organizations and competent persons of agencies and organizations

Decree No. 130/2018/NÐ-CP stipulates that the digital signature of the person who is granted digital certificate is only used to make transactions according to the competence of agency or organization and the person's proper title.

Decree No. 26/2007/NĐ-CP only stipulates that this digital signature is used to perform transactions according to the person's title.

5

Legal validity of digital signatures

Decree No. 130/2018/NÐ-CP continues to inherit the contents of Decree No. 26/2007/NĐ-CP, however, the new Decree supplements conditions to ensure security for digital signatures, specifically, where the law defines that a document required to be signed, the requirement for a data message is considered as met if the data message is signed with digital signature and such digital signature is adequately secured as prescribed in Article 9 of Decree No. 130/2018/NÐ-CP.

Decree No. 26/2007/NĐ-CP only stipulates that, in cases where a document requires a signature by law, the requirement for a data message is considered fulfilled if the data message is signed with a digital signature.

6

Conditions to ensure security for digital signatures

Decree No. 130/2018/NÐ-CP annuls the provision that the digital signatures are created by using the private key corresponding to public key recorded on digital certificates granted by the organizations providing certification service of digital signatures recognized in Vietnam, supplementing the service of specialized certification authorities of Government. Concurrently, Decree No. 130/2018/NÐ-CP also annuls the provision “Private Key and content of data message are attached only to the signer as such person signs the data message” previously specified in Decree No. 26/2007/NĐ-CP.

7

Format of digital certificate

Decree No. 130/2018/NÐ-CP supplements the format of digital certificate, according to which when issuing digital certificates, public certification authorities or specialized certification authorities of agencies and organizations  which have obtained a certificate of eligibility for special-use digital signature security must comply with regulations on format of digital certificates in accordance with authentication regulation of Root Certification Authority.

This content is not regulated in Decree No. 26/2007/NĐ-CP

8

Conditions for licensing of public authentication of digital signatures

In addition to maintaining the current licensing conditions, Decree No. 130/2018/NÐ-CP supplements the followings:

- Financial condition: In addition to maintaining the current deposit conditions, the new regulation requires businesses to pay full maintenance fees (in case of replacement of license).

- Condition of personnel: The staff of the business must hold a bachelor's degree or higher, majoring in information security or information technology or electrical communication.

- Technical condition: Having plans to provide information about subscribers online for Root Certification Authority, serving state management of authentication of digital signatures.

Concurrently, Decree No. 130/2018/NÐ-CP annuls the provision “The legal representative having knowledge of law on digital signatures and certification service of digital signatures” previously specified in Decree No. 26/2007/NĐ-CP.

This content is not regulated in Decree No. 26/2007/NĐ-CP

9

Dossiers for application for licensing of public authentication of digital signatures

Decree No. 130/2018/NÐ-CP amends the composition of license application dossiers previously specified in Decree No. 26/2007/NĐ-CP. According to new regulations, the license application dossiers include: an application for licensing public authentication of digital signatures; Certificate of deposit made by a commercial bank operating in Vietnam; personnel dossier specified in Clause 3 Article 14 of Decree No. 130/2018/NÐ-CP; the technical plan in compliance with Clause 4 Article 13 of this Decree; authentication regulation made according to the form prescribed in authentication regulation of Root Certification Authority.

Components specified in Decree No. 26/2007/NĐ-CP annulled by Decree No. 130/2018/NÐ-CP include: Certificate of business registration or certificate of investment of enterprise in which is stated clearly business line of providing certification service of electronic signatures; charter of the organization and operation of the enterprise; business plan; etc.

10

Suspension of licenses

Decree No. 130/2018/NÐ-CP supplements case of suspension of licenses, to be specific, a public certification authority shall have its license suspended for a period of up to 6 months if it fails to pay full maintenance fees in 6 months.

This content is not regulated in Decree No. 26/2007/NĐ-CP

11

Suspension of issuance of digital certificates

Decree No. 130/2018/NÐ-CP supplements the regulations on suspension of issuance of digital certificates, to be specific, a public certification authority must suspend the issuance of new digital certificates in the following cases: the license to provide public authentication of digital signatures is suspended; upon detecting the errors in the system providing its services that may affect the interests of subscribers and the recipients. Concurrently, this Decree also stipulates that while the license is suspended, if the public certification authority can correct objectionable conditions, the Ministry of Information and Communications shall permit the public certification authority to keep providing service.

This content is not regulated in Decree No. 26/2007/NĐ-CP

12

Revocation of licenses

In addition to cases of revocation of licenses previously specified in Decree No. 26/2007/NĐ-CP, Decree No. 130/2018/NÐ-CP supplements the case that  a public certification authority shall have its license revoked when it fails to provide for service within 12 months.

This content is not regulated in Decree No. 26/2007/NĐ-CP

…