Authentication of electronic records

Authentication of an electronic record. Section 3 of the Information Technology Act, 2000 provides that “any subscriber may authenticate an electronic record by affixing his digital signature”, and that the authentication shall be effected by the use of an asymmetric crypto system and a “hash function which envelop and transform the initial electronic record into another electronic record”. The statement is therefore correct.

Hash function. It is “an algorithm mapping or translation of one sequence of bits into another, generally smaller, set known as” (s. 3) the “hash result, such that an electronic record yields the same hash result every time the algorithm is executed with” that record as input, and it is computationally infeasible (a) to derive or reconstruct the original record from the hash result, and (b) for two electronic records to produce the same hash result. So it is computationally infeasible to alter the record without changing its hash result; the Act does not say a collision is impossible.

Asymmetric crypto system. It is “a system of a secure key pair consisting of a private key for creating a digital signature and a public key to verify the digital signature” (section 2(1)(f)). The subscriber signs with his private key, which he alone holds.

Verification. Verifying determines whether the record was signed with the private key corresponding to the subscriber's public key and whether it has been retained intact since it was signed.