Security, PKI & Electronic Transactions Act 2063

Explanation

Public services handling confidential identity, land, and financial records require rigorous legal recognition and cryptographic protection. ETA 2063 guarantees that an electronic document bearing a certified digital signature carries identical legal weight to a physical document signed in ink. PKI uses asymmetric cryptography and X.509 digital certificates to authenticate users, protect data in transit via TLS, and preserve audit trails that hold civil servants and citizens accountable.

Key points

• Electronic Transactions Act (ETA) 2063 (2006): Nepal's foundational cyber law legalizing electronic records, digital signatures, and cybercrime penalties.
• Controller of Certifying Authorities (CCA): Statutory office established under ETA 2063 to license and supervise commercial Certifying Authorities (CAs).
• Digital Signature: Hash of the document encrypted with the signer's private key; verified using the signer's public key certificate.
• Cyber Security Directives: Mandatory requirements for regular security audits, vulnerability assessment and penetration testing (VAPT), and incident response.

Example

Code examples

/*
PKI Digital Signature Process:
1. Sender hashes Document M -> H(M)
2. Sender encrypts H(M) with Private Key -> Signature S
3. Receiver computes H'(M) from received Document M
4. Receiver decrypts Signature S with Sender's Public Key -> H(M)
5. If H'(M) == H(M): Integrity and Authenticity confirmed!
*/

Exam questions

• [10 Marks] Explain the legal and institutional framework established by Nepal's Electronic Transactions Act (ETA) 2063. Discuss the role of the Controller of Certifying Authorities (CCA).
• [6 Marks] Describe Public Key Infrastructure (PKI). How do digital signatures guarantee non-repudiation and document integrity?