2

On an official Indian Government webpage I find several classes of digital signatures explained:

http://cca.gov.in/cca/?q=node/45

Are these just an India-specific quirk or is there an internationally recognized classification?

Also, are the certifying authorities that someone will recognize generic or does one have to verify for each intended use / locale which CA's the counter-party will accept for a digital signature?

i.e. Can I buy a personal digital signature from a reputed CA like Symantec & be fairly certain that most applications that need digitally signed documents will accept it? Or does one have to deal with each application individually?

6
  • 1
    After a quick Google search, the classes appear to be a India thing.
    – schroeder
    Nov 23, 2016 at 7:43
  • @schroeder Thanks. That's what it seems like to me as well. So, then must I stick to an India-CA instead of one of the better, larger, older Certifying Authority like Symantec? Nov 23, 2016 at 11:52
  • Depends on whether you must comply with one of these classes, and whether there is an accepted/formal way for a certificate to be recognized as belonging to a given class in india. For example, various certifying authorities implement different levels, too, like "silver", "gold" and "platinum" certificates, and they usually vary mostly in how thoroughly the claims you make are verified. So if some authorities "gold" certificate makes the same guarantees as an indian "class 3" certificate, they might be legally interchangable. Nov 23, 2016 at 12:35
  • @Pascal Thanks. I assumed that the verification of the authenticity of any given document via a digital signature was performed through code. So was just wondering whether in the protocols there's any way to code a "class" field. Otherwise when thunderbird or adobe acrobat verify digital signatures via their chain of trust they wouldn't be able to verify the "class". Nov 23, 2016 at 12:39
  • And if the verification whether a certain digitally signed document belongs to a "Class 3" must be done manually then that defeats a lot of the technically secure aspects of the chain of trust, right? e.g. In Indian Government protocol it says that for an individual tax payer filing electronic returns a mere "Class 2" cert, will suffice (cheaper) but for, say, corporate returns they want a more expensive "Class 3" cert. Nov 23, 2016 at 12:42

2 Answers 2

1

Warning: half-knowledge ahead.

If you look at any given certificate, you see that it contains various fields that could in theory be checked by an application. For example, an application might reject a certificate that used weak cryptography (Google chrome does this). Certificates can also be given a specific purpose (such as: only use this for client authentication). So it's possible that an application that expected some kind of specific certificate might reject a "non-classified"-one.

Also, in theory, an application could be picky about which cert authorities it trusted (e.g. just the ones in india...). Usually such lists are distributed as a part of the operating system or the operating system's SSL libraries, and browsers come (I think) with their own additional lists of trusted cert authorities.

Now, since most applications don't roll their own crypto and don't keep their own list of trusted cert authorities, and instead use software libraries to check signatures, I'd guess that you should be okay with using a non-indian cert. Think about what would happen to interoperability if every other application used different rules on which certificates to accept.

An exception would be if you were dealing with specific software written by the indian government, which might have strict restrictions on which certificates to accept.

But really I don't think there's any way to tell for sure. This answer is mostly guesswork.

4
  • Thanks! From, a more general info sec viewpoint does it make sense for entities like the Indian Govt. to break interoperability by trusting only subsets of authorities or validating on other fields in the cert? It sounds silly to me. Its like only using DNS servers only located on the Indian mainland. Nov 23, 2016 at 13:01
  • So might one be able to spoof a cert field? e.g. Pass a Class 2 cert as a Class 3 cert Or is the certificate security infrastructure robust to that? i.e. Is the tampering of a non-protocol field detected by the vetting protocols? Nov 23, 2016 at 13:02
  • Yes, it might make sense for governments to restrict accepted certificates. Some issuers don't invest much effort into verifying the claims their clients make. If the application in question depended on dealing with a well-verified client, it would be prudent to only accept certificates from issuers the application knew to be very diligent in verifying user claims. Nov 23, 2016 at 19:03
  • As for spoofing, I don't know because I don't know the exact format of certificates. It depends on whether some parts of a certificate aren't included in it's digital signature. I'd doubt it, though. This would strike me as too much of an attack surface. Nov 23, 2016 at 19:10
1

Another half-answer.

My first thought is that this has a striking similarity to the DV / OV / EV levels of certificate used in SSL:

Class 0 Certificate: This certificate shall be issued only for demonstration/ test purposes.

No equivalent.

Class 1 Certificate: Class 1 certificates shall be issued to individuals/private subscribers. These certificates will confirm that user's name (or alias) and E-mail address form an unambiguous subject within the Certifying Authorities database.

A domain-validated certificate (DV) is an X.509 digital certificate typically used for Transport Layer Security (TLS) where the identity of the applicant has been validated by proving some control over a DNS domain. [wikipedia]

Class 2 Certificate: These certificates will be issued for both business personnel and private individuals use. These certificates will confirm that the information in the application provided by the subscriber does not conflict with the information in well-recognized consumer databases.

Organization Validated SSL Certificate (OV): Organizational certificates are Trusted. Organizations are strictly authenticated by real agents against business registry databases hosted by governments.

Class 3 Certificate: This certificate will be issued to individuals as well as organizations. As these are high assurance certificates, primarily intended for e-commerce applications, they shall be issued to individuals only on their personal (physical) appearance before the Certifying Authorities.

An Extended Validation Certificate (EV) is a certificate used for HTTPS websites and software that proves the legal entity controlling the web site or software package. Obtaining an EV certificate requires verification of the requesting entity's [legal] identity by a certificate authority (CA). [wikipedia]

Note that there are very strict rules (pdf) for the depth of background checking that a CA needs to do before issuing an EV cert.

2
  • Thanks! Great answer. This begs the question: Do browser clients, or email clients etc. modulate their behavior in response to (say) an EV cert? What privileges does an EV cert. get an organization? i.e. Are counter-parties looking for an EV cert in certain transactions. Is this software enforced or manually? Nov 23, 2016 at 19:35
  • Yes, browsers (esp. Chrome & Firefox) treat EV certs differently from non-EV, like showing a green bar and displaying the company's legal name instead of URL. en.wikipedia.org/wiki/Extended_Validation_Certificate. There are also additional public auditing and accountability requirements on EV certs, like Google's Certificate Transparency. Nov 23, 2016 at 19:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .