Section 42 IT Act: Control of private key

Information Technology Act, 2000

Section 42 IT Act at a Glance

Section 42 IT Act requires every subscriber to take reasonable care to retain control of the private key and prevent its disclosure. If the key is compromised, the subscriber must report this without delay to the Certifying Authority.

Section 42 IT Act Bare Act Text

42. Control of private key.
(1) Every subscriber shall exercise reasonable care to retain control of the private key corresponding to the public key listed in his Digital Signature Certificate and take all steps to prevent its disclosure ***.
(2) If the private key corresponding to the public key listed in the Digital Signature Certificate has been compromised, then, the subscriber shall communicate the same without any delay to the Certifying Authority in such manner as may be specified by the regulations.
Explanation.—For the removal of doubts, it is hereby declared that the subscriber shall be liable till he has informed the Certifying Authority that the private key has been compromised.

Amendments to this section

The words "to a person not authorised to affix the digital signature of the subscriber" omitted by notification No. S.O.1015(E) (w.e.f. 19-9-2002).

Section 42 IT Act in Simple Words

Section 42 IT Act sets out a subscriber's duty under Chapter VIII of the Information Technology Act, 2000 to safeguard the subscriber's private key and report any compromise. Under Section 42(1) IT Act, every subscriber must exercise reasonable care to retain control of the private key that corresponds to the public key listed in the subscriber's Digital Signature Certificate. Every subscriber must also take all steps to prevent the disclosure of that private key. Certain words at the end of Section 42(1) IT Act, 'to a person not authorised to affix the digital signature of the subscriber', were omitted by notification No. S.O.1015(E) with effect from 19 September 2002.

Under Section 42(2) IT Act, if the private key corresponding to the public key listed in the Digital Signature Certificate has been compromised, the subscriber must communicate that compromise without any delay to the Certifying Authority. That communication must be made in the manner specified by the regulations.

The Explanation to Section 42 IT Act removes doubts about when the subscriber's responsibility ends after a compromise. It declares that the subscriber remains liable until the subscriber has informed the Certifying Authority that the private key has been compromised.

When Section 42 IT Act Applies

The person is a subscriber whose Digital Signature Certificate lists a public key with a corresponding private key.
The subscriber must exercise reasonable care to retain control of that private key and take all steps to prevent its disclosure.
If the private key has been compromised, the subscriber must communicate the compromise without any delay to the Certifying Authority in the manner specified by the regulations.
The subscriber remains liable until the subscriber has informed the Certifying Authority that the private key has been compromised.

Example of Section 42 IT Act

Karthik, a contractor in Lucknow, is a subscriber holding a Digital Signature Certificate that lists a public key corresponding to Karthik's private key. Under Section 42(1) IT Act, Karthik must exercise reasonable care to retain control of that private key and take all steps to prevent its disclosure. One evening, Karthik discovers that the private key stored on an office computer has been copied by an intruder and compromised. Under Section 42(2) IT Act, Karthik must communicate the compromise without any delay to the Certifying Authority in the manner specified by the regulations. Under the Explanation to Section 42 IT Act, Karthik remains liable until Karthik has informed the Certifying Authority that the private key has been compromised.

FAQs on Section 42 IT Act

What is Section 42 IT Act?▼

Section 42 IT Act sets out every subscriber's duty to exercise reasonable care to retain control of the private key corresponding to the public key in the subscriber's Digital Signature Certificate and to take all steps to prevent its disclosure. Section 42 IT Act also requires the subscriber to report any compromise of the private key without any delay to the Certifying Authority, and declares that the subscriber remains liable until the Certifying Authority is informed.

What must a subscriber do under Section 42(2) IT Act when a private key is compromised?▼

Communicate the compromise without any delay to the Certifying Authority. Under Section 42(2) IT Act, the subscriber must make this report in the manner specified by the regulations.

How long does a subscriber remain liable under Section 42 IT Act if the private key is compromised?▼

Until the subscriber informs the Certifying Authority. The Explanation to Section 42 IT Act declares that the subscriber remains liable till the subscriber has informed the Certifying Authority that the private key has been compromised.

Does Section 42(1) IT Act permit a subscriber to disclose the private key to another person?▼

No. Section 42(1) IT Act requires every subscriber to exercise reasonable care to retain control of the private key and take all steps to prevent its disclosure, without stating any exception.

Have questions about Section 42 IT Act?

Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.

Ask NyayGuru →

Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.

Sources: Bare Act Text, Information Technology Act, 2000 ·