Section 3 IT Act: Authentication of electronic records
Information Technology Act, 2000
Section 3 IT Act at a Glance
Section 3 IT Act lets a subscriber authenticate an electronic record by affixing a digital signature using an asymmetric crypto system and a hash function. Any person can verify the electronic record using the subscriber's public key.
Section 3 IT Act Bare Act Text
3. Authentication of electronic records.
(1) Subject to the provisions of this section any subscriber may authenticate an electronic record by affixing his digital signature.
(2) The authentication of the electronic record shall be effected by the use of asymmetric crypto system and hash function which envelop and transform the initial electronic record into another electronic record.
Explanation.—For the purposes of this sub-section, “hash function” means an algorithm mapping or translation of one sequence of bits into another, generally smaller, set known as “hash result” such that an electronic record yields the same hash result every time the algorithm is executed with the same electronic record as its input making it computationally infeasible—
(a) to derive or reconstruct the original electronic record from the hash result produced by the algorithm;
(b) that two electronic records can produce the same hash result using the algorithm.
(3) Any person by the use of a public key of the subscriber can verify the electronic record.
(4) The private key and the public key are unique to the subscriber and constitute a functioning key pair.
Section 3 IT Act in Simple Words
Section 3 IT Act sets out how a subscriber authenticates an electronic record using a digital signature. Under Section 3(1) IT Act, any subscriber may authenticate an electronic record by affixing the subscriber's digital signature, subject to the rules in Section 3 IT Act. Under Section 3(2) IT Act, this authentication must be carried out using both an asymmetric crypto system and a hash function, which envelop and transform the initial electronic record into another electronic record.
The Explanation to Section 3(2) IT Act defines a hash function as an algorithm that maps or translates one sequence of bits into another set (smaller in most cases) called a hash result. Every time the algorithm runs with the same electronic record as input, the electronic record produces the exact same hash result. At the same time, the algorithm makes two things computationally infeasible: under clause (a), deriving or reconstructing the original electronic record from the hash result, and under clause (b), having two electronic records produce the same hash result using that algorithm.
Under Section 3(3) IT Act, any person can verify the electronic record by using the public key of the subscriber. Under Section 3(4) IT Act, the private key and the public key are unique to the subscriber and together form a functioning key pair.
When Section 3 IT Act Applies
- A subscriber chooses to authenticate an electronic record by affixing the subscriber's digital signature under Section 3(1) IT Act.
- Authentication is carried out using an asymmetric crypto system and a hash function that envelop and transform the initial electronic record into another electronic record.
- The hash function yields the same hash result every time for the same input electronic record, and makes reconstructing the original record from the hash result or getting the same hash result from two electronic records computationally infeasible.
- The private key and the public key are unique to the subscriber and form a functioning key pair, enabling any person to verify the electronic record using the subscriber's public key.
Example of Section 3 IT Act
When Section 3 IT Act Does Not Apply
- Authentication under Section 3 IT Act is not completed without using both an asymmetric crypto system and a hash function that envelop and transform the initial electronic record into another electronic record.
- An algorithm does not qualify as a hash function under the Explanation to Section 3(2) IT Act if reconstructing the original electronic record from the hash result, or producing the same hash result from two electronic records, is not computationally infeasible.
- Keys that are not unique to the subscriber or do not form a functioning key pair do not meet Section 3(4) IT Act.
FAQs on Section 3 IT Act
What is Section 3 IT Act?▼
Section 3 IT Act allows a subscriber to authenticate an electronic record by affixing the subscriber's digital signature using an asymmetric crypto system and a hash function. Section 3 IT Act also allows any person to verify that electronic record using the subscriber's unique public key.
Is a subscriber required to authenticate every electronic record under Section 3 IT Act?▼
No. Section 3(1) IT Act says a subscriber may authenticate an electronic record by affixing the subscriber's digital signature, so authentication is optional under Section 3 IT Act. If the subscriber chooses to authenticate under Section 3 IT Act, the method in Section 3(2) IT Act must be followed.
Who can verify an electronic record authenticated under Section 3 IT Act?▼
Any person. Under Section 3(3) IT Act, any person can verify the electronic record by using the subscriber's public key.
What is a hash function under Section 3(2) IT Act?▼
An algorithm that maps or translates a sequence of bits into another set called a hash result, giving the same hash result every time for the same electronic record. Under the Explanation to Section 3(2) IT Act, the algorithm must make reconstructing the original record from the hash result, and getting the same hash result from two electronic records, computationally infeasible.
Can two subscribers share the same private key and public key under Section 3 IT Act?▼
No. Section 3(4) IT Act states that the private key and the public key are unique to the subscriber and constitute a functioning key pair.
Have questions about Section 3 IT Act?
Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.
Ask NyayGuru →Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.
Sources: Bare Act Text, Information Technology Act, 2000 ·