09.10.2019

Electronic signature (EDS). Electronic Document Management and Electronic Digital Signature: Application in Business

Electronic signature (ES) is a software-cryptographic tool that provides:

checking the integrity of documents;
document confidentiality;
identification of the person who sent the document

An electronic signature is used by individuals and legal entities as an analogue of a handwritten signature to give an electronic document legal force equal to the legal force of a paper document signed with the handwritten signature of an authorized person and sealed.

Electronic document is any document created using computer technology and stored on information media processed using computer technology, whether it is a letter, contract or financial document, diagram, drawing, drawing or photograph.

Benefits of using EP

The use of EP allows you to:

significantly reduce the time spent on processing the transaction and the exchange of documentation;
to improve and reduce the cost of the procedure for the preparation, delivery, accounting and storage of documents;
ensure the accuracy of the documentation;
minimize the risk of financial losses by increasing the confidentiality of information exchange;
build a corporate document exchange system.

It is impossible to fake an electronic signature - it requires a huge amount of calculations that cannot be implemented at the current level of mathematics and computer technology in an acceptable time, that is, while the information contained in the signed document remains relevant. Additional protection against forgery is ensured by certification of the public key of the signature by the Certification Authority.

Using EP, work according to the scheme "project development in in electronic format- creating a paper copy for signature - sending a paper copy with a signature - examining a paper copy - transferring it electronically to a computer" is a thing of the past.

Three types of electronic signature

Electronic signatures are divided by the 2011 law into three types.

Simple signatures are created using codes, passwords and other tools that allow you to identify the author of the document, but do not allow you to check it for changes since it was signed.
Reinforced unqualified signature created using cryptographic tools and allows you to determine not only the author of the document, but check it for changes. To create such signatures, a certificate from an unaccredited center can be used, or you can do without a certificate at all if the technical means allow you to comply with the requirements of the law.
Enhanced Qualified Signature is a type of reinforced, it has a certificate from an accredited center and was created with the help of funds confirmed by the FSB.

Simple and unqualified signatures replace the signed paper document in cases specified by law or by agreement of the parties. For example, simple signatures can be used by citizens to send messages to authorities. An enhanced signature can also be considered as an analogue of a document with a seal.

Qualified signatures replace paper documents in all cases, except when the law requires only a document on paper. For example, with the help of such signatures, citizens can receive public services electronically, and public authorities can send messages to citizens and interact with each other through information systems. Previously issued EDS certificates and documents signed with their help are equated to qualified signatures.

Foreign electronic signatures are equated in Russia with the types of signatures to which they correspond.

A simple electronic signature, unlike the former digital signature, is not designed to protect a document from forgery. It does not allow to detect possible distortion of the content of the document. Its only function is to confirm the fact of the formation of an electronic signature (and not the document itself!) by a certain person.

The purpose of determining the person who signed the electronic document, as well as detecting the fact of making changes to the document after signing it, is an enhanced electronic signature. It is this signature (in two forms - unqualified and qualified) that is an analogue of the former electronic digital signature.

Since a simple electronic signature requires the use of codes, passwords or other means, it will become clear what can and cannot be considered an electronic signature. Obviously, in the case of an e-mail, the role of an electronic signature cannot be played by the sender's name, manually put after the text, since it does not depend in any way on the password, using which the sender generated and sent the letter. Information indicating the person on whose behalf the document was sent may be the message identifier in combination with the IP address of the sender's computer, indicating that the message was created as a result of accessing the mail system, accompanied by entering a password belonging to a particular user. The sender's email address and the sender's name can be considered a signature only if the information system operator ensures their authenticity, because the postal protocol allows you to specify any name and any return address, and some postal systems do not impose any restrictions here.

EDS funds

EDS means are hardware and (or) software tools that ensure the implementation of at least one of the following functions:

creation of an electronic digital signature in an electronic document using the private key of an electronic digital signature,
confirmation using the public key of the electronic digital signature of the authenticity of the electronic digital signature in the electronic document,
creation of private and public keys of electronic digital signatures.

Cryptographic basis

The electronic signature is based on public key cryptography. With its help, a special user certificate is generated. It contains user data, a public key and an electronic signature of the certificate, which can be verified using the public key of the certification authority. The algorithm guarantees that only a certification authority that has a secret encryption key and trust in which is the basis for the operation of the entire EDS system can generate a signature.

Trust in certification authorities is based on a hierarchical principle: the certificate of a lower-level certification authority is certified by an electronic signature of a certification authority over high level. The highest level of certification centers is federal, which is under the control of state bodies. The entire system of trust built on certificates forms the so-called public key infrastructure (Public Key Infrastructure, PKI). With such an infrastructure, it is required to verify not only the legitimacy of the key of the certification authority that issued the certificate, but also all higher certification authorities. In particular, when forming an electronic transaction, it is necessary to check not only the mathematical correctness of the EDS, but also the validity of the entire chain of certificates involved in the manufacture of the signer's certificate at the time of signing a particular electronic document.

An electronic signature is required to participate in procurement procedures. What types of ES are there, what affects the cost of a signature, and what package of documents needs to be prepared to receive it? Read more.

CAs

Certification Authority (Certificate Authority)(Eng. Certification authority, CA) - an organization that issues certificates for electronic digital signature keys.

Chronicle

2018

In Russia, they are working on an alternative to ES for identification on the Internet

The Ministry of Telecom and Mass Communications proposed to introduce a single key verification certificate for EDS

At the beginning of April 2018, information appeared that the powers of users of electronic digital signatures can be enshrined in a single certificate for verifying the key of an enhanced qualified EDS. The Ministry of Telecom and Mass Communications of Russia published the corresponding draft law on the portal of draft legal acts.

The clarification to the draft law states that, according to the current state of affairs, EDS users - individuals and legal entities, state bodies and officials - cannot access the information systems of various departments, since they require the presence of object identifiers (OID) in a qualified certificate.

At the same time, certificates issued by those accredited by the Ministry of Telecom and Mass Communications of Russia, as the authors of the bill note, cannot be used to verify the electronic signature in the information systems of such individual departments.

OIDs are not in single certificates, so there are many companies in the market selling qualified key verification certificates that are designed to work with a single agency and, therefore, do not allow you to work with others.

In fact, this “kills” the meaning in the EDS: the key idea of an electronic signature is the universality of its use, Oleg Galushkin, an information security expert at SEC Consult Services, is convinced. - The unification of the EDS verification procedure is long overdue, but now the question arises of what certification centers will do, and whether they will have to curtail activities for which they paid substantial money for the right to conduct.

Now the Ministry of Telecom and Mass Communications proposes to introduce the concept of "authoritative certificate", which will contain both the user's OID and information about his powers. Thus, the problem of multiple certificates - if the bill is passed - will be removed.

Read the text of the draft law of the Ministry of Communications of Russia "On Amendments to the Federal Law "On Electronic Signature", the Federal Law "On the Protection of the Rights of Legal Entities and Individual Entrepreneurs in the Implementation of state control(Supervision) and Municipal Control" and the Federal Law "On Accreditation in national system accreditation" you can follow the link.

2013: The government simplifies use of simple ES when rendering public services

The head of the Russian government, Dmitry Medvedev, signed Decree No. 33 in early 2013, which describes the procedure for using a “simple electronic signature” in the provision of state and municipal services in addition to the enhanced ES already in use.

Although the term "simple electronic signature" was first used in the law "On Electronic Signature" adopted in 2001, its description first appeared in Decree No. 33. According to the text of the document, its key will be a combination of an identifier and a password, and the insurance number of the personal account of an individual or the head of a legal entity will become an identifier.

Unlike the simple electronic signature introduced by the regulation, the current “enhanced electronic signatures” are created using cryptographic tools and include an accredited certification authority certificate, which gives it the strength of a traditional paper document with a handwritten signature.

A simple ES, on the contrary, does not require a certificate when it is created, thus excluding from the process of its creation the chain of both final certification centers and the root CA of Rostelecom.

At the same time, citizens who have received a simple signature will be relieved of the need to use an electronic key on a flash drive when accessing the Public Services Portal, which is necessary when using an enhanced signature.

Decree No. 33 describes the requirements for a simple ES password, which must consist of at least eight characters, including letters and numbers, and cannot contain "*" or "#" signs. Interestingly, signature users have the right to independently change the key using their personal account on the Unified Public Services Portal.

2012

Waiting for the distribution of a SIM card with an EDS

According to a study published in September 2012 by analytics firm TechNavio, the two-factor authentication market will grow at 20.8% annually in 2011-2015. Two-factor authentication implies that in order to access information, the user needs not only to enter a password, but also to have some device or program that confirms the access right. A classic example is online banking, where to confirm the operation, you must not only enter a password, but also dial a one-time code sent via sms or generated by a special program on a computer.

According to analysts, the next stage in the development of these technologies will be authentication using mobile phones, when a digital signature is "sewn" into the SIM card of the device, with which the user can perform legally significant actions. For example, such a mechanism has already been implemented in Estonia. Another option for the development of technology is the creation of smart cards, which are electronic identity cards.

The spread of technology will be facilitated by the introduction of short-range wireless phones NFC. Thus, mobile phone can be used instead bank card when paying for goods in a store or at the checkpoint to a territory with limited access. However, the development of the market will be hampered by security considerations and the actions of regulators that impose certain requirements on the transfer and protection of confidential data.

Among the leading manufacturers of two-factor authentication solutions, TechNavio researchers name Entrust, Gemalto, RSA Security and VASCO Data Security.

Second-tier developers include ActivIdentity, CryptoCard, Deepnet security, Equifax, PhoneFactor, SecureAuth, SecurEnvoy, and SafeNet Inc.

Permission for government agencies to submit documents to the government electronically using EDS

According to his message, the Government approved the draft amendments made by the Ministry of Telecom and Mass Communications. Thus, documentation between state and executive power, as well as by the government apparatus, will be entered electronically using an electronic digital signature.

Denis Kuskov, CEO of the Telecom Daily analytical agency, in an interview with a TAdviser correspondent said that the creation of an internal secure electronic document management system would greatly facilitate the life of departments and ministries.

"If we talk about the project from the point of view of IT, then the development, implementation, configuration of a system of this scale and complexity, as well as with similar security requirements, can cost more than one hundred million rubles. This includes EDS keys," Kuskov said. "Now the market for such systems is quite competitive, so the state can cut the cost of the project quite seriously."

According to Kuskov, in the absence of any obstacles, the development, implementation and debugging of the EDMS and keys can take about a year.

Kuskov is sure that each department or institution will need a maximum of 20 EDS keys. The Cabinet of Ministers consists of 21 members.

In July 2012, it became known that in autumn the Federation Council intends to check the preparation of regulations relating to the creation of a unified electronic digital signature (EDS). As the media found out, if the senators are not satisfied with the results of the check, they will come up with a legislative initiative to introduce a single EDS. (Earlier, the Government of the Russian Federation extended the law "On Electronic Digital Signature" for another year). Experts are not sure that the idea will be implemented: we are talking about a huge business, covering up which will not be profitable for either certification centers or officials.

For the first time, the issue that the current law on EDS should be supplemented with amendments that allow officials to use one signature for all information systems was raised by senators back in April 2011. The Federation Council eventually approved the proposal of the senators, and the government, in turn, promised, “that this novelty will be implemented in the regulations on the procedure for applying an electronic signature,” Yury Roslyak, a member of the Federation Council Committee on Economic Policy, told reporters. However, for almost a year and a half, the normative acts did not see the light of day.

“Today, the regulations are still in development, so in the fall we will check the form in which all this has been implemented. If this principle is not fulfilled, then we will come up with a legislative initiative on the legislative motivation of the government, including the Ministry of Telecom and Mass Communications, on the use of this technology - Yu. Roslyak adds.

According to the senators, the current law on EDS is extremely inconvenient: each information system requires an individual digital signature, so civil servants and businessmen have to use several EDS at once.

Order of the FSB on the requirements for electronic signatures and CAs

On February 17, 2012, the order of the Federal Security Service of the Russian Federation dated December 27, 2011 No. 796 "On approval of requirements for electronic signature tools and requirements for certification center tools" was published. Earlier, there was an order dated December 27, 2011 No. 795 “On approval of the requirements for the form of a qualified certificate of the electronic signature verification key”.

In accordance with the new rules, the signature tool, when signing a document, must show the electronic document to the person who signs it, wait for confirmation from this person, and after signing, show him that the signature has been created. When verifying a signature, the tool should show the electronic document, as well as information about making changes to the signed document, and indicate the person who signed it.

The format of a qualified certificate differs significantly from the format of EDS certificates that are issued at this time (in accordance with federal law No. FZ-1). For example, a qualified certificate must include the name of the electronic signature tools and certification authority tools used to generate the signature key and verification key (private and public keys, respectively), as well as to create the certificate itself.

Compared to EDS certificates, the way in which the powers of the certificate holder are represented has changed. At the request of the owner, the EDS certificate could include any information supported by the relevant documents, and non-standard details (for example, the registration number of the insured) could be included in the qualified certificate only if the requirements for their purpose and location in the certificate are specified in the documents provided for confirmation of the compliance of the means of the certification center with the requirements of the FSB.

2011

For all the time in Russia, 5-7 million ES key certificates have been issued

For the entire period of the law of 2002 on ES in Russia, 5-7 million certificates of electronic signature keys were issued, experts estimate the Ministry of Telecom and Mass Communications. They will be valid until July 1, 2012, after which they will have to be replaced with new ones.

In 2011, a market for services for issuing electronic signature carriers to citizens begins to form in Russia. They cost no more than 500 rubles, but it was difficult to estimate the demand at that time: it had not yet been decided which signature was suitable for which documents.

The signature of the highest level, protected from forgery, is the so-called enhanced qualified signature. The means by which documents are certified with such a signature are issued by special certification centers that have been certified by the FSB. According to the Ministry of Communications, the Unified State Register of Signature Key Certificates contains 284 such centers.

Means for issuing simpler signatures - reinforced unqualified and simple - can be purchased on the market, you do not have to contact a certification center for this.

In 2011, certification centers, whose tariffs were studied by a Vedomosti correspondent, charge 2,000-10,000 rubles for issuing an electronic signature. (depending on the number of related services - for example, for 10,000 rubles, you can also participate in a seminar on using such a signature). But the price should be radically reduced, Elena Lashkina, press secretary of the Minister of Communications, promised, in fact, it will come down to the cost of the carrier. For a carrier of a reinforced electronic signature certified by the FSB, you will need to pay 500-600 rubles, and in the future - 300 rubles. For an unqualified reinforced EP, you can buy any USB flash drive (from 100 rubles).

President Medvedev signed the law "On Electronic Signature"

The need for a new law was due to the fact that the provisions of the current law on electronic signature (FZ-1) did not comply modern principles regulation of electronic signatures that operate in European countries.

There are three types of electronic signature - a simple electronic signature, an unqualified electronic signature and a qualified electronic signature.

A qualified electronic signature is an electronic signature that:

obtained as a result of cryptographic transformation of information using the signature key;
allows you to identify the person who signed the document;
allows you to detect the fact of making changes to the document after signing it;
created using electronic signature tools.

In addition, the key for verifying such a signature is specified in a qualified certificate, and to create and verify an electronic signature, tools are used that have received confirmation of compliance with the requirements established in accordance with federal law.

Before using the EDS, the center had to transfer copies of the certificate in paper and electronic form to the authorized body. Certification centers themselves were subject to compulsory licensing and had to be built into a single hierarchical structure. Although the law came into force at the beginning of 2002, the authorized state body (then it was federal agency on information technologies) appeared only in 2004, and the root certification center, without which the work of all the others is impossible, in 2005. Licensing of certification centers did not work at all due to contradictions with the later adopted law “On licensing certain types of activities”.

As a result, as noted in the explanatory note to the law "On EDS", in Russia EDS is used practically only by legal entities, and the number of certificates issued is no more than 0.2% of the total population. In the law adopted now, certification centers are not required to be licensed - they can be accredited, and then only on a voluntary basis. Accreditation will be carried out by the authorized body appointed by the government, which will also organize the work of the root center.

To be accredited, a Russian or foreign legal entity must have net assets worth at least RUB 1 million. and financial guarantees to pay compensation to affected customers in the amount of RUB 1.5 million, have at least two IT specialists with higher vocational education and go through the FSB confirmation procedure. The centers are obliged to provide free access to any person to the registers of valid and revoked certificates, the mandatory transfer of the register of certificates to the root center will occur only in the event of termination of the center's accreditation. A certification authority can also organize a system of centers around itself, in relation to which it will be the root.

The plan for the preparation of legal acts in order to implement the federal laws "On Electronic Signature" and "On Amending Certain Legislative Acts of the Russian Federation in Connection with the Adoption of the Federal Law "On Electronic Signature" was approved by the Decree of the Government of the Russian Federation dated July 12, 2011 No. 1214- R. The plan establishes the terms for the development of legal acts of the Government of the Russian Federation and legal acts of federal executive bodies related to the use of an electronic signature. The Ministry of Communications of Russia is one of the responsible executors of the development of legal acts, most of which will be developed jointly with the Federal Security Service of Russia, the Ministry of Economic Development of Russia, as well as interested federal executive authorities.

According to the plan, before July 30, 2011, a federal executive body authorized in the field of electronic signature use will be appointed, before August 31 - the requirements for the form of a qualified certificate of the electronic signature verification key, the procedure for accreditation of certification centers. By October 31, government resolutions on the types of electronic signatures that government agencies use when organizing electronic interaction among themselves, on the types of electronic signatures that are used when applying for public services, and on the procedure for using a simple electronic signature in the provision of state and municipal services. Until November 30, the procedure for using an electronic signature when applying for state and municipal services must be approved. The last planned document will be signed in March 2012.

In the 2011 law, it became possible to sign documents with an electronic signature, the circulation of which is not regulated by direct action laws, notes Sergey Sapelnikov, deputy head of Rosreestr. Few documents fall under the regulation: extracts from the real estate cadastre and the Unified State Register of Rights, invoices, etc. The new law, in theory, will allow notaries to certify electronically and extracts from a marriage certificate, power of attorney, etc. True, not yet it is clear which of the three formats will be accepted by government agencies and which specific documents can be signed with them. The law does not establish what type of signature a particular department can use, in what format the company's general director should sign, in which one - the chief accountant, and in which one - a citizen, says Sapelnikov. For authorities, the types of electronic signature will be determined by the government, and for business and domestic communication, citizens and legal entities have the right to choose the type of signature themselves, says an employee of the Ministry of Communications.

On March 30, 2011, at a meeting of the Federation Council, it was decided to amend the law on electronic digital signature (EDS) without suspending the law in its current version. Now the document does not spell out the rule that a particular person should have one EDS, as well as his graphic personal signature. Because of this, officials and businessmen are forced to use different signatures in different information systems.

“Each information system in our country requires an official to draw up an individual digital signature for each specific system. We consider this categorically unacceptable: firstly, this is an additional bureaucratic barrier, and secondly, this is a big waste of time and money, ”said Yury Roslyak, one of the initiators of the amendments, a member of the Federation Council Committee on Economic Policy.

According to him, now an official working in the treasury system has seven different digital signatures. “It can reach the point of absurdity when a person can have 10-12 digital signatures in order not to limit his legal capacity,” he added. According to him, a unified digital signature should be issued in the system of certification centers. It should operate in all public information systems that exist in Russia. It is equally obvious that this thesis has nothing to do with identification in closed information systems.

“Now work is underway to agree on the design: in which chapter to include this amendment. I think that within a month we will finish this work and we will start conciliation procedures at least in early June,” Yu. Roslyak explains.

The State Duma approved the draft law "On electronic signature"

In March 2011, the State Duma of the Russian Federation approved in the last reading the draft Federal Law "On Electronic Signature", which is intended to replace the existing since 2002 No. 1-FZ "On Electronic Digital Signature". The law is intended to "regulate relations on the use of electronic signatures in civil law transactions, the provision of state and municipal services, the performance of state and municipal functions, as well as in the performance of other legally significant actions."

In accordance with Art. 5 of the draft law defines three new types of electronic signature: simple, unqualified and qualified (the most secure). Used on this moment EDS key certificates are equated to qualified electronic signature certificates.

The law regulates the issuance and use of signature key certificates, signature authentication, accreditation and provision of services of certification centers that will issue electronic signature key certificates. Until July 1, 2012, such centers will continue to operate as before, but will have to undergo mandatory accreditation by the authorized body. Starting from the summer of 2012, the right to issue qualified signatures is granted exclusively to accredited certification centers.

The situation with EDS in the Russian Federation is such that any user to work with information systems that require the use of an electronic digital signature has to create a separate EDS for almost each of them. To resolve this situation, the Federation Council of the Russian Federation is preparing an amendment to the law "On Electronic Digital Signature", which is designed to make life easier for EDS users. As a result, it should become uniform for all information systems and not limit the capacity of their holders.

Decree of V. Putin on the transition of government agencies to paperless workflow by 2012

In February 2011, Russian Prime Minister Vladimir Putin signed Decree No. 176-r “On approval of the action plan for the transition of federal executive bodies to paperless document management when organizing internal activities". This document approved the action plan for the transition of federal authorities to paperless document management and established that the implementation of measures for the transition to paperless document management is carried out "at the expense of funds provided for in the federal budget."

By June 2011, it is planned to provide "officials of federal executive bodies with electronic digital signatures for use in electronic document management", to create or upgrade the EDMS of ministries and departments. From January 1, 2012, according to the plan, paperless workflow should work in all federal authorities.

2010: Report of the Ministry of Economics to the President of the Russian Federation on the need for an EDS for electronic public services

The electronic digital signature is most actively used in the field of finance - this is facilitated by the growth in the penetration of Internet banking systems, and the initiative of the Federal tax service, whose subdivisions accept reports in electronic form. In addition, Russian President Dmitry Medvedev recently signed Federal Law No. 229-FZ of July 27, 2010, which provides for amendments to the first and second parts of the Tax Code of the Russian Federation. Among them is the possibility of issuing invoices in electronic form by mutual agreement of the parties to the transaction and if the parties have compatible technical means and capabilities for receiving and processing invoices. One of mandatory conditions such process is the signing of invoices using digital signature.

According to market experts, the creation of any financial documentation and reporting is one of the most simple examples industries where the use of EDS can bring profit. Now organizations often have to rent warehouses to store financial statements - the period of storage of documents can be 5 years or even more. Quite significant funds are spent on this. In addition, every ordinary private person at home also has a kind of warehouse in which documents are stored. If all these documents are transferred to electronic form, this will greatly facilitate the life of a person or company and ensure greater safety of documents - after all, paper documents cannot be copied as easily as electronic ones.

In the US, UETA and national law about ES give electronic documents the same weight as traditional paper obligations signed by hand.

These statutes define an ES as "an electronic sound, symbol, or process attached to or logically associated with a contract or other recording, attached to it by a person with the intent to sign this entry". Thus, any business transaction can be carried out electronically.

“In the US, people use digital signatures in all aspects of their daily lives. You can electronically arrange a mortgage or insurance as part of a car loan,” says Stephen Bisbee, president of Baltimore-based eOriginal, which owns the patent for the process of creating, signing, and transmitting documents electronically.

The most progressive enterprises no longer wonder whether to use electronic signature - they are focused on how to best integrate its use into their own business processes.

The next step will be to manage any "digital" business online. "This is a move from simple signatures to complex financial transactions in electronic form," says Bisby, and predicts that the turning point in this area will occur within the next four years.

1994: EDS standard adopted in Russia - GOST R 34.10-94

The digital signature came to Russia in 1994, when the first Russian EDS standard, GOST R 34.10-94, was adopted, which in 2002 was replaced by GOST R 34.10-2001.

1976: Development of the electronic signature in the USA

It can be considered the birthplace of digital signature: in 1976, American cryptographers Whitfield Diffie and Martin Hellman first proposed the concept of "electronic digital signature", although they only assumed that digital signature schemes could exist. But already in 1977, the RSA cryptographic algorithm was developed.

You can read about what an Electronic Signature (abbreviated as ES or EDS) is.

We explain. Here are the three main benefits of an electronic signature:

It's faster

An electronic signature saves time on working with documents.

And the point is not that inserting a flash drive and pressing a button is faster than signing a sheet, but rather that the electronic signature speeds up the further process - the workflow.

If you do not have an electronic signature, then you must first print the sheet, sign it, put it in an envelope, send the envelope, go to the post office (and here time is not saved at all) and only then solemnly return to work. If you have an electronic document management and have an electronic signature, then the whole process is significantly accelerated.

It's safer

Your ES is almost impossible to fake. This means that the signed document will definitely remain unchanged. If you have an electronic signature, it is very easy to prove the authorship of a document - this protects against forgery.

It's necessary

Well, the most obvious, but no less important point - it is simply necessary for some tasks: participation in tenders (for example, in), work on the website of public services, electronic document management. Every year, there are more and more sites where an electronic signature will be required. There is no point in ignoring progress - get an e-signature for your company today if you still don't have one.

Send your good work in the knowledge base is simple. Use the form below

Students, graduate students, young scientists who use the knowledge base in their studies and work will be very grateful to you.

Hosted at http://www.allbest.ru/

Ministry of Education and Science of the Russian Federation

federal state budgetary educational institution higher professional education

AMUR STATE UNIVERSITY

Faculty of Law

Specialty 030501. 65 - Jurisprudence

ABSTRACT

On the topic: Electronic digital signature

Blagoveshchensk 2014

Introduction

One of actual problems currently in the world is the problem of information security

This is due to the fact that information technology has radically changed our lives. Already, the facts show that most of the circulation of information and documents is now carried out in electronic form. The technology of electronic signature is able to further expand the possibilities of electronic document management, secure it, and extend it to all areas. public life, promote the development of e-business opportunities accessible to all. In countries where the concept of an electronic signature is legally enshrined, it is possible to safely and reliably make any transactions without leaving your home or office; defend their rights in law enforcement agencies by corresponding with e-mail; declare your income to the tax authorities.

The concept of electronic digital signature

Electronic digital signature (Further -EDS)-- requisite of the electronic document, which allows to establish the absence of distortion of information in the electronic document from the moment the EDS was formed and to verify that the signature belongs to the owner of the EDS key certificate. The attribute value is obtained as a result of cryptographic transformation of information using the EDS private key.

History of developmentand distributionelectronic digital signature

Abroad:

1976 American mathematicians W. Diffie and M.E. Hellman published a paper called "New Directions in Cryptography", which significantly influenced further development cryptography and, in particular, led to the emergence of such a thing as a "digital signature".

1977 The first cryptographic algorithm, RSA, was developed.

1981 The DSA algorithm was developed in 1981 and has been used as the US standard for digital signature ever since.

1984 Developed a cryptosystem - the El-Gamal Scheme, which underlies the standards of electronic digital signature in the USA and Russia.

1984 S. Goldwasser, S. Micali and R. Rivest were the first to strictly define security requirements for digital signature algorithms. They described models of attacks on EDS algorithms, and also proposed a GMR scheme that meets the described requirements.

1991 The US National Institute of Standards and Technology (NIST) published the digital signature standard DSS (Digital Signature Standard).

1993 The RSA method was published and accepted as a standard. RSA can be used for both encryption/decryption and generation/verification of a digital signature.

1997 The Electronic Digital Signature Act was passed in Germany.

2003 The Verkhovna Rada of Ukraine adopted the laws “On Electronic Documents and Electronic Document Management” and “On Electronic Digital Signature”.

In Russia:

1993 Development of the domestic law on electronic digital signature (EDS).

1994 The first domestic standard in the field of EDS was adopted - GOST R34.10 - 94 “Information technology. Cryptographic protection of information. Procedures for generating and verifying an electronic digital signature based on an asymmetric cryptographic algorithm.

1999 The Ministry of the Russian Federation for Communications and Informatization organized the development of a draft federal law "On Electronic Digital Signature", which creates legal framework formation of a reliable infrastructure, including certification centers.

2001 The Government approved the bill "On Electronic Digital Signature".

2002 Adopted a new standard for EDS: GOST R 34.10-2001 “Cryptographic protection of information. Processes of formation and verification of electronic digital signature.

2002 The Federal Law "On Electronic Digital Signature" was adopted, which created the basis for the use of an electronic document and an electronic digital signature.

On April 6, 2011, Russian President Dmitry Medvedev signed the law "On Electronic Signature" (ES), approved by the State Duma and the Federation Council in March.

Legal framework governing the use of electronic digital signature in Russia.

electronic digital signature legal

Civil Code of the Russian Federation (parts one, two, three and four)

Federal Law of July 27, 2006 No. 149-FZ "b information, information technology and information protection"

Order of the Federal Security Service of the Russian Federation of December 27, 2011 No. 796 “On Approval of the Requirements for Electronic Signature Tools and the Requirements for Certification Center Tools”

Order of the Federal Security Service of the Russian Federation of December 27, 2011 No. 795 "On Approval of the Requirements for the Form of a Qualified Certificate of the Electronic Signature Verification Key"

Types of electronic digital signature

There are 3 types of EDS:

1. Attached electronic digital signature. In the case of creating an attached signature, a new EDS file is created, in which the data of the signed file is placed.

Advantages of the attached signature: ease of further manipulation with the signed data, because all of them, together with signatures, are contained in one file, the file can be copied, sent, etc.

Disadvantage: without the use of CIPF tools (means of cryptographic information protection), it is no longer possible to read and use the contents of the file.

2. Disconnected electronic digital signature. When you create a detached signature, the signature file is created separately from the signed file, and the signed file itself is not modified in any way.

Disadvantage of a detached signature: the need to store the signed information in multiple files.

3. Electronic digital signature within the data (Most common). The use of digital signatures of this type essentially depends on the application that uses them.

Disadvantage: outside the application that created the EDS, without knowing the structure of its data, it is difficult to verify the authenticity of data parts signed by the EDS.

Purpose and advantages of electronic digital signature

The digital signature is designed to authenticate the person who signed the electronic document. In addition, the use of a digital signature allows you to:

Integrity control of the transferred document: in case of any accidental or intentional change of the document, the signature will become invalid, because it is calculated based on the original state of the document and corresponds only to it.

Protection against changes (forgery) of the document: the guarantee of detection of a forgery during integrity control makes forgery impractical in most cases.

Evidence of authorship of the document. Since it is possible to create a correct signature only if the private key is known, and it should be known only to the owner, the owner of the key pair can prove his authorship of the signature under the document. Depending on the details of the document definition, fields such as “author”, “changes made”, “timestamp”, etc. can be signed.

A significant reduction in the time spent on processing the transaction and the exchange of documentation;

Improving and reducing the cost of the procedure for preparing, delivering, accounting and storing documents;

Construction of a corporate document exchange system;

Selection of the most favorable price offer for goods and services at electronic auctions, auctions and tenders;

Relations with the population, organizations and power structures on a modern basis, more efficiently, at the lowest cost;

Expanding the geography of business, making remote economic transactions with partners from any regions of Russia.

The principle of operation of an electronic digital signature

1. For each user participating in the exchange of electronic documents, unique secret and public cryptographic keys are generated. A secret (private) key is an element that is used to encrypt documents and form a digital signature. The secret key is the property of the user and is kept secret from other users. The public key is used to verify the digital signature of received document-files. The owner must ensure that everyone with whom he intends to exchange signed documents has his public key. In addition, a duplicate of the public key is sent to the Certification Center, where a library of public EDS keys has been created. The Center's library provides registration and safe storage of open books.

2. The user generates an electronic digital signature for the document. At the same time, on the basis of the secret EDS key and the content of the document, a certain character sequence is generated by cryptographic transformation, which is the digital signature of the given user for a particular document. This character sequence is stored in a separate file. The following is recorded in the signature: the date the signature was formed; information about the person who formed the signature; the name of the signature public key file.

3. The user who has received the signed document and has the sender's EDS public key performs an inverse cryptographic transformation based on the text of the document and the sender's public key, which ensures verification of the sender's electronic digital signature. If the EDS under the document is correct, it means that the document is indeed signed by the sender and no changes have been made to the text of the document.

Conclusion

From the foregoing, we can conclude that an electronic digital signature is an effective solution for everyone who does not want to wait for the arrival of courier mail many hundreds of kilometers away in order to verify the authenticity of the information received or confirm the conclusion of a transaction. Documents can be digitally signed and transferred to their destination within seconds. All participants in the electronic document exchange receive equal opportunity regardless of their distance from each other. It is impossible to forge an EDS - it requires a huge amount of calculations that cannot be implemented at the current level of mathematics and computer technology in an acceptable time, that is, while the information contained in the signed document remains relevant. Additional protection against forgery is provided by certification of the public key of the signature by the Certification Authority. With the use of EDS, work according to the scheme "development of a project in electronic form - creation of a paper copy for signature - forwarding a paper copy with a signature - consideration of a paper copy - transferring it electronically to a computer" is becoming a thing of the past. This means that the use of an electronic digital signature is useful, convenient and safe.

List of sources used

http://www.mtron.ru

http://www.ucnbs.ru/about/

http://www.documoborot.ru

http://www.digitalsign.ru

http://www.ekey.ru/

http://www.garant.ru/

Hosted on Allbest.ru

What is an electronic digital signature: the simple essence of a complex concept!

Each document at the enterprise must be signed by an authorized person. The signature gives it legal force. Modern technologies converted documents to electronic format. Which turned out to be extremely convenient! Firstly, electronic documents have simplified and accelerated the exchange of data in the enterprise (especially with international cooperation). Secondly, the expense associated with their turnover has been reduced. Thirdly, the security of commercial information has been significantly improved. Despite the electronic format, each document must be signed, so the EDS was developed.

What is an electronic digital signature? This is an analogue of traditional painting in digital format, which is used to give legal effect to documents on electronic media. The word "analogue" should be understood as a sequence of cryptographic symbols generated randomly using a special software. It is stored electronically. Usually flash drives are used.

There are two important concepts associated with ES: a certificate and a key. A certificate is a document that certifies that an electronic signature belongs to a specific person. It comes in regular and enhanced. The latter is issued only by some accredited certification centers or directly by the FSB.

The electronic signature key is the same sequence of characters. The keys are used in pairs. The first is the signature, and the second is the verification key that certifies its authenticity. For each new signed document, a new unique key is generated. It is important to understand that the information received on a flash drive in a certification center is not an ES, it is just a means for creating it.

An electronic signature has the same legal weight and effect as under a document in paper version. Of course, if there were no violations during the application of this parameter. If a discrepancy or any deviation from the norm is detected, the document will not become valid. The use of EDS is regulated by the state with the help of two laws FZ-No. 1 and FZ-No. 63. They affect all areas of application of the signature: in civil law relations, in interaction with municipal and state bodies.

How did the idea of using the EPC come about: let's remember the past!

In 1976, two American cryptographers Diffie and Hellman suggested that electronic digital signatures could be created. It was just a theory, but it resonated with the public. As a result, already in 1977, the RSA cryptographic algorithm was released, which made it possible to create the first electronic signatures. Compared to the present, they were very primitive, but it was at this moment that the foundation was laid for the future rapid development of the industry and the ubiquity of electronic document management.

The millennium brought significant changes. In the United States, a law was passed according to which a signature on paper was equal in legal force to an electronic one. Thus, a new rapidly growing segment of the market appeared, the volume of which, according to the forecasts of American analysts, by 2020 will amount to $30 billion.

In Russia, the first EPs began to be used only in 1994. The first law that regulated their application was adopted in 2002. However, it was distinguished by extreme vagueness of wording and ambiguity in the interpretation of terms. The law did not give an unambiguous answer to the question of how to obtain an electronic signature and use it.

In 2010, a large-scale project was developed to create a virtual environment for the provision of public services in electronic format, which in August of the same year was submitted for consideration to the President of the Russian Federation. One of the key areas of the project is the possibility of using EDS. The regions were obliged to create conditions for free access of individuals and legal entities to the possibilities of electronic document management, so that everyone could receive an electronic signature. Since then, the “electronic state” has been actively developing in Russia.

In 2011, the President ordered the executive authorities to switch to electronic document management within the structures. By June of that year, all officials were provided with EDS. The program was financed from the federal budget. In 2012, electronic document management began to work in all executive authorities of the Russian Federation without exception.

After these transformations, two questions were acute. First, EP was not universal. For each goal, a new signature had to be obtained. Secondly, some crypto providers were not compatible with others, which put their clients in predicament. Therefore, since 2012, a global process of unification in the field of electronic document management has begun. Thanks to this, we have modern universal signatures and software.

EDS Signature: 5 Benefits and 6 Uses!

Many entrepreneurs do not yet apply in their economic activity EPC. In many ways, the reason for this is elementary ignorance of all its capabilities and advantages. Using an electronic format to sign documents, subjects entrepreneurial activity(IP, LE) receive the following benefits:

Documents are maximally protected from falsification.

Since the computer is very difficult to deceive. In this case, the human factor is completely excluded. After all, you can simply not notice that the signature under the document is different from the original. An electronic signature cannot be forged. This requires very large computing power, which is almost impossible to implement at the current level of development of devices, and a lot of time.

Optimization, acceleration and simplification of workflow.

Complete exclusion of the possibility of data leakage or loss of important papers. Any copy certified with an electronic identifier is guaranteed to be received by the addressee in the sent form: no extraordinary circumstances can cause damage to it.

Reduction of costs due to refusal of paper carriers.

For small firms, keeping paper records was not burdensome, which is not the case for large enterprises. Many of them had to rent separate premises, warehouses for storing documents for 5 years. In addition to the cost of paper, printers, ink, stationery, rent was added! In addition, depending on the field of activity, some companies could reduce costs by reducing the number of employees who were involved in documents: receiving, processing, etc. The need to recycle paper has also disappeared: for certain types of organizations whose activities are related to confidential information, even this line of expenses turned out to be significant. The process of destroying documents under the EDS is a few clicks with a computer mouse.

The format of papers signed by ES fully complies with international requirements.
There is no need to obtain a separate signature to participate in bidding or submit reports to regulatory authorities.

You can get an ES, which will allow you to use it at all necessary sites.

Before proceeding to the consideration of the question of how to obtain an electronic signature, we list all the possible options for its use:

Internal document flow. It implies the transfer of commercial information, orders, instructions, etc. inside the company.
External document flow. It's about on the exchange of documents between two organizations partners in the B2B system or between an enterprise and a B2C client.
Submission of reports to regulatory authorities:

Federal Tax Service,
Pension Fund,
social insurance fund,
customs service,
Rosalkogolregulirovanie,
Rosfinmonitoring and others.

To gain access to the "Client-Bank" system.
To participate in auctions and bidding.
For public services:

Website of the State Service,
RosPatent,
Rosreestr.

How to get an electronic signature: step by step instructions!

Having appreciated all the advantages of using an electronic signature, you have decided to get it. And, of course, faced with a natural question: how to do it? We will answer this question with the help of detailed step-by-step instructions that will help you quickly and easily get an EDS signature!

There are 6 steps in total.

Step 1. Selecting the type of ES.

Step 2. Choosing a certification authority.

Step 3. Filling out the application.

Step 4. Payment of the invoice.

Step 5. Collecting a package of documents.

Step 6. Obtaining an EDS.

Now let's talk about each step in more detail!

Step 1. Choice of view: to each his own!

The first step to obtaining an electronic signature is choosing its type. According to federal laws distinguish the following types of EDS:

Simple. It encodes data about the owner of the signature, so that the recipient of the paper is convinced who the sender is. It does not protect against forgery.
Reinforced:

unqualified - confirms not only the identity of the sender, but also the fact that no changes were made to the document after signing.
qualified - the most secure signature, the legal force of which is 100% equivalent to that of an ordinary signature! It is issued only in those centers that are accredited by the FSB.

Recently, more and more customers want to get an enhanced qualified signature, which is quite reasonable. Like any other "keys" that provide access to private information or financial transactions, fraudsters of the most various categories. Analysts believe that over the next 10 years, the first two species will simply become obsolete. The choice depends on the use of the EDS. To make it easier to make a decision, we have compiled the data in a table, it will help you make a choice and stop at a specific necessary and sufficient form.

Scope of application	Simple	Unskilled	qualified
Internal document flow	+	+	+
External document flow	+	+	+
Arbitration court	+	+	+
Website of the State Services	+	-	+
Supervisory authorities	-	-	+
Electronic auctions	-	-	+

If you are going to get an EDS signature for the convenience of reporting, you will have to apply for a qualified one. If the goal is document flow at the enterprise, then it is enough to get a simple or unqualified signature.

Step 2. Certification Authority: TOP-7 largest and most reliable companies!

A certification authority is an organization whose purpose of functioning is to generate and issue electronic digital signatures. A CA is a legal entity whose charter specifies the relevant type of activity. Their functions include:

issuance of EDS;
providing a public key to everyone;
blocking the electronic signature, in the event that there is a suspicion of its unreliability;
confirmation of the authenticity of the signature;
mediation in case of conflict situations;
provision of all necessary software for clients;
technical support.

At the moment, about a hundred such centers operate on the territory of the Russian Federation. But only seven are industry leaders:

EETP is the market leader in electronic trading in the Russian Federation. The company's activities are highly diversified, which does not prevent it from occupying leading positions in each segment. In addition to organizing and conducting auctions, he is engaged in the sale of property that is not selling well, teaches the features of participation in auctions, forms and sells EDS.
Electronic Express is the official operator of the electronic document management of the Federal Tax Service. It has a full set of licenses (including the FSB license).
Taxnet - develops software for electronic document management. Including is engaged in the creation and implementation of EDS.
Sertum-Pro Kontur - the company deals with certificates of electronic signatures. In addition, it offers many convenient additional services for its customers, which will significantly expand the possibilities of ES.
Taxcom - the company specializes in external and internal document management of companies and reporting to various regulatory authorities. For this, appropriate software is being developed and electronic signatures are being created. It is on the list of official data operators from cash registers.
Tenzor is a giant in the world of document management in telecommunications networks. It provides a full range of services: from the development of complexes for automating the workflow at enterprises to the creation and implementation of electronic signatures.
National certification center - develops and sells various EDS certificates, offers customers software for generating and submitting reports to all government agencies.

Choose a CA depending on your capabilities and location. It is important to check whether there is a point of issue of ready-made electronic signatures in your city. This is fairly easy to find out by visiting the official websites of the companies.

If for some reason you are not satisfied with the centers from our TOP-7 list, then you can use the services of other companies. Full list accredited CAs can be found on the website www.minsvyaz.ru in the "Important" section.

Step 3. How to get an electronic signature: fill out an application!

The choice is made, now you know exactly what you want, so it's time to apply to the certification center. This can be done in two ways: by visiting the company's office or by filling out an application on its website.

Sending an application remotely will save you from a personal visit. The application contains a minimum of information: full name, contact number and e-mail. Within an hour after sending, an employee of the CA will call you back and clarify the necessary data. In addition, he will answer all the questions that interest you and advise which type of EDS to choose for your case.

Step 4. Paying the bill: money in advance!

You will have to pay for the service before you receive it. That is, immediately after the application is accepted and the details are agreed with the client, an invoice will be issued in his name. The cost of an EDS varies depending on the company you applied to, the region of residence and the type of signature. It includes:

generating a signature key certificate,
software necessary for creating, signing and sending documents,
customer technical support.

The minimum price is about 1500 rubles. The average is 5,000 - 7,000 rubles. The cost of one ES may be lower than 1,500 rubles, only if signatures are ordered for a large number of employees of one enterprise.

Step 5. Documents for obtaining an EDS: we form a package!

When forming a package of documents, it is essential which subject of civil law acts as a customer: an individual, a legal entity or an individual entrepreneur. Therefore, we will consider documents for obtaining an EDS separately for each category.

Individuals must provide:

statement,
passport plus copies
individual taxpayer number,
SNILS.
Receipt of payment.

An authorized representative of the recipient of the electronic signature can submit documents to the CA. To do this, you need to issue a power of attorney.

To obtain an EDS, a legal entity will have to prepare:

Statement.
Two certificates of state registration: with OGRN and TIN.
Extract from the register of legal entities. Important! The extract must be "fresh". Each certification authority has its own requirements for this.
Passport plus a copy of the person who will use the ES.
SNILS of the employee who will use the EDS.
If the signature is issued for the director, then you need to attach an order of appointment.
For employees who are lower in the hierarchical ladder of the company, you will have to issue a power of attorney for the right to use the EPC.
Receipt of payment.

Documents for obtaining an EDS by individual entrepreneurs:

Statement.
Registration certificate with OGRNIP number.
Certificate with TIN.
Extract from the register of entrepreneurs, issued no earlier than 6 months ago, or a copy certified by a notary.
Passport.
SNILS.
Receipt of payment.

An authorized representative of an individual entrepreneur can pick up an electronic digital signature if he has a power of attorney and a passport. When submitting an application in electronic form, documents are sent to the CA by mail, and during a personal visit, they are submitted simultaneously with the application.

Step 6. Getting a digital signature: the finish line!

Documents can be obtained at numerous points of issue, which are located throughout the country. Information about them can be found on the official website of the UC. Usually, the term for obtaining a signature does not exceed two to three days.

Delay is possible only on the part of the customer who did not pay for the services of the certification center in time or did not collect all Required documents. Please note that you need to get an extract from the unified state register of individual entrepreneurs or legal entities on time, since this process takes 5 working days! Some CAs provide the service of urgent issuance of EDS. Then the whole procedure takes about one hour. Now you know how to get an electronic signature.

Important! The EP is valid for one year from the date of its receipt. After this period, it will need to be renewed or a new one obtained.

Do-it-yourself digital signature: the impossible is possible!

In fact, creating an electronic signature on your own is quite realistic. If you have the appropriate education, you can thoroughly understand what an electronic digital signature is and stock up with invincible enthusiasm. True, we should not forget that we will not only have to generate a cryptographic sequence, we also need to develop and write the appropriate software. A natural question arises: why do this? Moreover, the market is replete with ready-made solutions! For large companies it is also not profitable to “mess around” with the independent development of an electronic signature, since you will have to hire a staff of new employees in the IT department. And in the article

Electronic digital signature - reliable protection of the interests of any categories of citizens

The business sector has been influenced by digital technologies and technical progress as well as many other branches of human activity. In addition to archives and reports presented in digital form, in the modern business world one can increasingly hear such a thing as an "electronic digital signature", due to the presence of which one can significantly expand the range of opportunities for business owners and their proxies.

What it is?

Unlike a conventional signature presented in electronic form on a document, an electronic digital analogue is a requisite obtained by cryptographic transformation of information. Activation of such a tool is possible only if a private key is used, which increases the level of reliability and security of the signature. Thanks to present moment it is simply impossible to make unauthorized changes to the props.

EDS can be used in everyday life by both individuals and legal entities. This gives the first opportunity to participate in virtual auctions, conclude a contract with trusted partners without leaving the office, and also solve a lot of other issues. As for the second category of citizens - EDS in this case greatly simplifies the solution of everyday issues. For example, using such details, you can quickly make an appointment through the Network for an appointment with a doctor, send an application for admission to a university, submit a request to the Housing Office, and so on.

Obtaining an electronic signature for legal entities or individual entrepreneurs, as well as for individuals should be carried out in special certified centers. Otherwise, the customer runs the risk of receiving an EDS, which has no legal force or is easily forged.

EDS advantages

The use of EDS has a number of advantages

Reliability. A signature obtained from a certified center cannot be forged under any circumstances. Accordingly, in this case, the client receives a full guarantee of the protection of personal data and interests.

Saving time. Using the tool, you can quickly resolve the required issues on your own or by delegating authority to third parties. The main thing is that the key should be handed over to the citizen along with the signature.

Interest protection guarantee. The owner of the signature cannot refuse it, since the use of a key is provided for its activation.

You can learn more about the features of using an EDS or order props and keys for it by contacting a specialist of a certified center.

beauty

1 0 0

If you find an error, please select a piece of text and press Ctrl+Enter.