Frequently Asked Questions: Principles for Electronic Authentication

What is electronic authentication?
How does it work?
Why is authentication so important?
Why are the Authentication Principles important?
How will I know if the service I use is following the Principles?
Do other countries have Principles?
Why has Canada taken a market-based approach?
If authentication is so important, why don't we have rules backed up by legislation?

1. What is electronic authentication?

   Electronic authentication lets you know who you are dealing with on-line and provides assurances that the transaction details or message content has not been altered and that the information has been kept private. There are various types of authentication that offer various levels of assurance.



2. How does it work?

   Authentication uses cryptographic techniques to link (or bind) transactions and messages to the sender. Cryptographic techniques perform this function by using digital keys (a unique combination of ones and zeros) to encrypt and decrypt data.



3. Why is authentication so important?

   Research shows that consumers and business continue to lack confidence in doing business on the Internet because of concerns about security and privacy. The use of authentication helps to build trust and confidence for both sides of transactions by letting you know who you are dealing with online. It works together with various consumer protection measures and privacy legislation to make the Internet a safer and more secure place to shop and do business.



4. Why are the Authentication Principles important?

   The Principles are a "checklist" of things to keep in mind when designing, implementing and developing policies for authentication services. They are the benchmarks that have been agreed to jointly by business, consumer advocates and governments.



5. How will I know if the service I use is following the Principles?

   The Principles will be reflected in codes and guidelines that are developed by industry groups. It will be up to those groups to decide how they will let consumers and businesses know that they adhere to the Principles.



6. Do other countries have Principles?

   There is a wide range of approaches to authentication. Some countries have mandated government requirements on authentication services while others lack any kind of framework. Canada has decided to take a market-based approach that gives the lead to industry. However, the government has a role to play in terms of facilitating co-ordination of the approach across the various industry sectors.



7. Why has Canada taken a market-based approach?

   Under Canada's approach, the marketplace will determine outcomes and businesses and individuals are free to choose among a range of authentication products and services. In an environment of rapid technological advances, Industry Canada believes it is important to take an approach that fosters innovation, investment and a well-functioning, fair and competitive marketplace.



8. If authentication is so important, why don't we have rules backed up by legislation?

   In announcing its Cryptography Policy in 1998, the federal government determined that a flexible, competitive business environment for information technology companies was the best means of ensuring that effective authentication services could be provided to Canadians by Canadian businesses. There was no consideration given to establishing new authentication legislation and regulations. Such a decision would have required the government to play a role in making technological choices affecting the marketplace - a matter that is best left to the private sector.