Is cryptography legal in India? If yes, then what type of encryption is not allowed?
Is cryptography legal in India?
Yes, it is legal.
If yes, then what type of encryption is not allowed?
Short answer is that there is no specific standard. I found this website that explains various facts. I would recommend to go through it.
The [Department of Telecommunications (DoT)] is responsible for deciding what bits are allowed to route through the India's computer network. This department decides all the regulations regarding the IT services. There are different licenses issued for running different type of services. Depending upon what service you want to run you have to obtain license from the DoT. Here you can read all type of licenses offered by DoT. The Information Technology Act 200 also doesn't talk about encryption standard to be used or allowed. How ever in various other resources there are some standards defined. For an example:
The government’s Department of Telecommunications (DoT) in the ‘Guidelines for the grant of Licence for Operating Internet Service’ (ISP Guidelines) and in the ‘Licence Agreement for the Provision of Internet Service’ (ISP Licence Agreement) that is entered into between the DoT and the Internet Service Provider (ISP) for the provision of internet services in India has laid down that the individuals and corporates while using the ISP services are permitted:
“to use up to 40-bit key length in the symmetric key algorithms or its equivalent in other algorithms without having to obtain permission from the DoT, but for use of any encryption equipment higher than this limit, the same can be done only with the prior approval of the DoT”.
Similarly standards are defined for other sectors too.
This post discusses that modifications are required to establish better IT security standards in India.
As of today, India does not have any clear and well established laws and policies regarding encryption or encryption techniques to secure electronic communication. The extant laws only prescribe for use of such encryption standards or algorithms which are well established and in conformity with the international standards.
As per Rule 5.2(6) of the Information Technology (Certifying Authorities) Rules, 2000 (“Rules”), electronic communication systems used for transmission of sensitive information can be equipped or installed with suitable encryptor or encryption software. Similarly, Rule 5.3(1) of these Rules provides that any highly sensitive information or data should be in an encrypted format to avoid compromise by unauthorized persons. The Government has the power to determine the manner of encrypting sensitive electronic records requiring confidentiality. Amendment to the Information Technology Act, 2000 in the year 2008 provides that the Government can prescribe the modes or methods for encryption for secure use of the electronic medium and for promotion of e-governance and e-commerce.
You can read more about it in the below link :