Vol. 138, No. 19 — May 8, 2004

Secure Electronic Signature Regulations

Statutory Authority

Personal Information Protection and Electronic Documents Act and Canada Evidence Act

Sponsoring Department

Treasury Board Secretariat

REGULATORY IMPACT
ANALYSIS STATEMENT

Description

Part 2 of the Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, provides a framework by which federal statutes and regulations may be adjusted to accommodate electronic alternatives to paper-based means of communication. For some types of electronic documents, such as sworn statements (section 44), statements declaring truth (section 45), witnessed documents (section 46), originals (section 42), and sealed documents (section 39), Part 2 requires a secure electronic signature.

Subsection 31(1) defines secure electronic signature as an electronic signature that results from the application of a technology or a process prescribed by regulations made under subsection 48(1). Subsection 48(1) of PIPEDA describes the characteristics of secure electronic signatures and grants authority to the Governor in Council, upon the recommendation of the Treasury Board, to make regulations prescribing the technologies or processes for the purpose of the definition. Regulations are required in order to complete the definition of secure electronic signature.

Digital signature technology is the only known technology today that can provide the requisite characteristics of a secure electronic signature. Even then, a secure electronic signature is trustworthy only if the digital signature certificate is issued by a reliable Certification Authority. Currently, there are no recognized standards for accrediting those Certification Authorities which are reliable. Accordingly, the regulations provide that only those digital signature certificates are deemed to be sufficiently trustworthy that are issued by Certification Authorities which

(i) the President of the Treasury Board has verified as having the capacity to issue certificates in a secure and reliable manner, and as fulfilling the four characteristics set out in subsection 48(2); and

(ii) the President of the Treasury Board has listed on the Web site of the Treasury Board Secretariat.

Paragraph 31.4(a) of the Canada Evidence Act grants authority to the Governor in Council to make regulations establishing evidentiary presumptions respecting the association of secure electronic signatures with a person. When an electronic document is signed using a digital signature, where the digital signature certificate has been issued by a Certification Authority listed on the Treasury Board Secretariat Web site, then the regulations establish a rebuttable presumption that the electronic document is attributable to the person who is identified in, or can be identified through, the digital signature certificate. This presumption may be rebutted by evidence that the digital signature was not that of the person so identified, or was not applied to the electronic document by that person.

Alternatives

There is no alternative to the use of the regulatory route.

Benefits and costs

These Regulations apply to the operations of the Government of Canada and do not impose any obligations or costs on other parties.

Consultation

Preliminary drafts of the Regulations were the subject of discussion by a number of subject-matter experts within and outside of the Government of Canada. The Regulations are being prepublished to afford interested parties a 30-day period in which to submit comments before they are finalized, prior to being published in the Canada Gazette, Part II.

Compliance and enforcement

Compliance is not an issue, as the use of Part 2 of PIPEDA is at the option of responsible federal authorities. Those authorities would not likely utilize Part 2 until they are ready and able to do so. Written arrangements with listed Certification Authorities will contain appropriate enforcement provisions.

Contacts

Ms. Michelle d'Auray, Chief Information Officer, Treasury Board Secretariat, Ottawa, Ontario K1A 0R5, (613) 957-7070 (telephone), d'Auray.Michelle@tbs-sct.gc.ca (electronic mail); and Mr. Michael de Rosenroll, Director General, Strategic Infrastructure Services, Information Technology Services Branch, Public Works and Government Services Canada, Ottawa, Ontario K1A 0R5, (613) 957-2535 (telephone), deRosenroll.Michael@tbs-sct.gc.ca (electronic mail).

PROPOSED REGULATORY TEXT

Notice is hereby given that the Governor in Council, pursuant to section 48 of the Personal Information Protection and Electronic Documents Act (see footnote a) and paragraph 31.4(a) of the Canada Evidence Act (see footnote b) proposes to make the annexed Secure Electronic Signature Regulations.

Interested persons may make representations with respect to the proposed Regulations within 30 days after the date of publication of this notice. All such representations must cite the Canada Gazette, Part I, and the date of publication of this notice, and be addressed to Michelle d'Auray, Chief Information Officer, Treasury Board Secretariat, 2745 Iris Street, Ottawa, Ontario K1A 0R5.

Ottawa, April 26, 2004

EILEEN BOYD
Assistant Clerk of the Privy Council

SECURE ELECTRONIC
SIGNATURE REGULATIONS

INTERPRETATION

1. The following definitions apply in these Regulations.

"Act" means the Personal Information Protection and Electronic Documents Act. (Loi)

"asymmetric cryptography" means a cryptographic system that relies on key pairs. (système de chiffrement à clé publique)

"certification authority" means a person or entity that issues digital signature certificates and that has been listed as such on the website of the Treasury Board Secretariat. (autorité de certification)

"digital signature certificate", in respect of a person, means an electronic document that

(a) identifies the certification authority that issued it and is digitally signed by that certification authority;

(b) identifies, or can be used to identify, the person; and

(c) contains the person's public key. (certificat de signature numérique)

"entity" includes any federal department, branch, office, board, agency, commission, corporation or body for the administration of the affairs of which a minister of the Crown is accountable to Parliament. (entité)

"hash function" means an electronic one-way mathematical process that converts data contained in an electronic document into a message digest that is unique to that data in a way that, were that data changed, it would, on conversion, result in a changed message digest. (fonction de hachage)

"key pair" means a pair of keys held by or for a person that includes a private key and a public key that are mathematically related to, but different from, each other. (biclé)

"private key" means a string of data that

(a) is used in asymmetric cryptography to encrypt data contained in an electronic document; and

(b) is unique to the person who is identified in, or can be identified through, a digital signature certificate and corresponds only to the public key in that certificate. (clé privée)

"public key" means a string of data contained in a digital signature certificate that

(a) is used in asymmetric cryptography to decrypt data contained in an electronic document that was encrypted through the application of the private key in the key pair; and

(b) corresponds only to the private key in the key pair. (clé publique)

TECHNOLOGY OR PROCESS

2. For the purposes of the definition "secure electronic signature" in subsection 31(1) of the Act, a secure electronic signature in respect of data contained in an electronic document is a digital signature that results from completion of the following consecutive operations:

(a) application of the hash function to the data to generate a message digest,

(b) application of a private key to encrypt the message digest,

(c) incorporation in, attachment to, or association with the electronic document of the encrypted message digest,

(d) transmission of the electronic document and encrypted message digest together with either

(i) a digital signature certificate, or
(ii) a means of access to a digital signature certificate; and

(e) after receipt of the electronic document, the encrypted message digest and the digital signature certificate or the means of access to the digital signature certificate,

(i) application of the public key contained in the digital signature certificate to decrypt the encrypted message digest and produce the message digest referred to in paragraph (a),
(ii) application of the hash function to the data contained in the electronic document to generate a new message digest,
(iii) verification that, on comparison, the message digests referred to in paragraph (a) and subparagraph (ii) are identical, and
(iv) verification that the digital signature certificate is valid in accordance with section 3.

3. (1) A digital signature certificate is valid if, at the time when the data contained in an electronic document is digitally signed in accordance with section 2, the certificate

(a) is readable or perceivable by any person or entity who is entitled to have access to the digital signature certificate; and

(b) has not expired or been revoked.

(2) In addition to the requirements for validity set out in subsection (1), when the digital signature certificate is supported by other digital signature certificates, in order for the digital signature certificate to be valid, the supporting certificates must also be valid in accordance with that subsection.

4. (1) Before recognizing a person or entity as a certification authority, the President of the Treasury Board must verify that the person or entity has the capacity to issue digital signature certificates in a secure and reliable manner within the context of these Regulations and paragraphs 48(a) to (d) of the Act.

(2) Every person or entity that is recognized as a certification authority by the President of the Treasury Board shall be listed on the website of the Treasury Board Secretariat.

PRESUMPTION

5. When the technology or process set out in section 2 is used in respect of data contained in an electronic document, that data is presumed, in the absence of evidence to the contrary, to have been signed by the person who is identified in, or can be identified through, the digital signature certificate.

COMING INTO FORCE

6. These Regulations come into force on the day on which they are registered.

[19-1-o]

Footnote a

S.C. 2000, c. 5

Footnote b

R.S.C. 1985, c. C-5, as amended

NOTICE:
The format of the electronic version of this issue of the Canada Gazette was modified in order to be compatible with hypertext language (HTML). Its content is very similar except for the footnotes, the symbols and the tables.

	Top of page
Maintained by the Canada Gazette Directorate	Important notices