License conditions for providing public authentication of digital signatures in Vietnam

Operating conditions for providing public authentication of digital signatures in Vietnam

Pursuant to Article 11 of Decree 130/2018/ND-CP, the public certification authorities are entitled to provide service if they meet the following conditions:

- Having the licenses to public authentication of digital signatures granted by the Ministry of Post and Telecommunications.

- Having digital certificates granted by Root Certification Authority.

License conditions for providing public authentication of digital signatures in Vietnam (Internet image) 

License conditions for providing public authentication of digital signatures in Vietnam

Pursuant to Article 13 of Decree 130/2018/ND-CP, the license conditions for providing public authentication of digital signatures in Vietnam include:

(1) Condition for license holder: Being enterprises established under the laws of Vietnam.

(2) Financial condition:

- Depositing at a commercial bank operating in Vietnam of no less than VND 05 (five) billion to solve risks and the compensation that may occur during the course of service by a cause for which the public certification authority is responsible and make payment for expenses receiving and maintaining database of enterprises in the event of revocation of licenses.

- Pay full maintenance fees (in case of replacement of license).

(3) Condition of personnel:

- The certification authority must have staff responsible for: administration and operation of the system and issuance of digital certificates, maintenance of information security of the system;

- The staff prescribed in Point a of this Clause must hold a bachelor's degree or higher, majoring information security or information technology or electrical communication.

(4) Technical condition:

(4.1) Formulation of technical equipment system must ensure the following requirements:

- Storing fully, accurately and updating information of subscribers for the issuance of the digital certificates during the valid duration of digital certificates;

- Storing fully, accurately and updating list of digital certificates which are valid, suspended and invalid and allowing and guiding Internet users to access online 24 hours per day and seven days per week;

- Making sure that the creation of the key pair only allows each key pair to be generated randomly and one time; ensures that the private key is not be detected when having the respective public key;

- Having ability to alert, prevent and detect any illegal access in the network environment;

- Designed in the manner that minimizes reduction of the direct contact with the Internet environment;

- Key distribution system for subscribers must ensure the integrity and security of the key pair.  In the case of key distribution through a computer network environment, the key distribution system must be used the security protocols to ensure the confidentiality of information on the transmission line.

(4.2) Having feasible technical plans meeting requirements for information security and technical regulations and mandatory standards on digital signatures and authentication of digital signatures in force;

(4.3) Having plans to control the entrance and exit of head offices, the right to access the system, right to enter, exit the place where the equipment is located for providing authentication of digital signatures;

(4.4) Having contingency plans to maintain the continuous and safe operation, and deal with incidents when they occur;

(4.5) Having plans to provide information about subscribers online for Root Certification Authority, serving state management of authentication of digital signatures;

(4.6) The entire system of equipment for service provision is located in Vietnam;

(4.7) Construction of offices, places where the machinery and equipment is located in accordance with the requirements of the law on prevention and combat of fire and explosion; having ability of fighting against floods, earthquakes, electromagnetic interference, illegal intrusion of man;

(4.8) Having authentication regulations made according to the form prescribed in authentication regulation of Root Certification Authority.

Mai Thanh Loi

>> CLICK HERE TO READ THIS ARTICLE IN VIETNAMESE