About Encryption DSC

Encryption Class 3 DSC for confidential document signing tendering and tax filings. Forms handled: Class 3 Encryption DSC, Aadhaar e-KYC. Legal basis: IT Act 2000 Sections 35-39.

Glossary

Plain-English glossary for this service

Encryption DSC

A digital certificate specifically issued with KeyUsage attribute set to keyEncipherment and dataEncipherment, used for encrypting data such that only the holder of the corresponding private key can decrypt. Distinct from a signing DSC which has KeyUsage digitalSignature and is used for non-repudiation. Under CCA India guidelines and IT Act Section 35, organisations engaging in e-procurement on CPP Portal, GeM, or any portal requiring bid encryption must hold a separate encryption DSC per authorised signatory.

Certificate Chain

The sequence of certificates from the end entity certificate up through one or more intermediate CA certificates to a trusted root CA. For a DSC issued by a CCA-licensed CA in India, the chain runs from the user's certificate, through the issuing CA's certificate, to the CCA Root. Portals validate this chain at every transaction; a break or missing intermediate causes signature verification failure.

Section 3A IT Act

Section 3A of the Information Technology Act 2000 introduced by 2008 amendment, providing legal recognition to electronic signatures using techniques notified by the Central Government in addition to digital signatures under Section 3. Practical relevance: it widens the legal acceptability of e-signatures beyond DSC, while DSCs continue to be the most robust form because they leverage CCA-licensed CA infrastructure for non-repudiation.

Hard Token vs Soft Token

Hard token is a physical USB cryptographic device that generates and stores private keys internally with the key never leaving the device. Soft token is a software-based key store such as a .pfx file or Windows Certificate Store entry. Hard tokens are FIPS 140-2 compliant and meet government portal security requirements; soft tokens are convenient but lack tamper resistance and are rejected by defence-category and high-value bidding portals.

Dual DSC Token

A single USB cryptographic token loaded with two certificates: one signing-only certificate and one encryption-only certificate for the same signatory. Issued by a licensed CA after one in-person verification covering both certificates. Cost-efficient and reduces logistical overhead of carrying two separate tokens. Mandatory for participating in e-tenders on CPP Portal and GeM where both signing and bid encryption are required at the same submission step.

ASBA Payment Encryption

Application Supported by Blocked Amount encryption framework used by Self Certified Syndicate Banks in IPO and FPO applications. Investor's bid details and PAN are encrypted using the registrar's public key to ensure confidentiality of subscription patterns until allotment. Built on the same X.509 PKI infrastructure as DSC, applies to retail and HNI investors equally, governed by SEBI ICDR Regulations.

Sealed Envelope Encryption

The cryptographic equivalent of a sealed tender envelope where the bid document is wrapped with the tender authority's public key at submission and remains undecryptable until the official bid opening event when the tender authority unwraps it using its private key. CPP Portal and GeM implement this through AES symmetric encryption of the bid content with the symmetric key itself wrapped using the recipient's RSA public key.

GeM Bid Encryption

Government e-Marketplace's bid encryption mechanism for bids above prescribed threshold values. Uses the seller's organisational encryption certificate registered on GeM seller profile to wrap the financial bid component. Pre-defined bid window opens and closes at portal-controlled timestamps with bid opening only possible at the scheduled time by authorised buyer-side openers using the buyer's decryption keys.

GSTN ASP Encryption

Encryption between an Application Service Provider intermediary and GSTN's API gateway when bulk filing of GSTR-1, GSTR-3B, or GSTR-9 is routed through an ASP-GSP integration. The ASP's encryption certificate is registered on the taxpayer's GSTN profile and used to wrap the return data payload. ASP switch requires re-mapping of the new ASP's encryption certificate on GSTN before bulk filing can resume.

RBI Online Encryption

Reserve Bank of India's online portal for regulatory return filing by banks, NBFCs, AD Bank category-I entities, and certain payment system operators. Requires encrypted submission of returns using RBI-published encryption certificate. Monthly XBRL returns under various RBI Master Directions and FEMA-related returns flow through this channel. Encryption is in addition to the signing DSC and not a substitute.

ICEGATE Customs Encryption

Indian Customs Electronic Commerce Gateway encryption for response messages back to importers and exporters such as assessed Bill of Entry, query messages, and Out of Charge orders. Requires registration of the user's encryption certificate separately from the signing certificate on the IEC holder profile. Without encryption certificate registration, ICEGATE response messages cannot be delivered causing container hold and demurrage.

Organisational Encryption DSC

An encryption certificate issued in the name of an entity rather than an individual, carrying the entity PAN as the Subject primary identifier and the authorised signatory's CommonName as a secondary attribute. Required for GeM seller profile encryption mapping, CPP Portal bidder encryption, and certain RBI Online filings where the encryption is at entity level rather than individual signatory level. Subject field mapping accuracy is critical.

Statutory Basis

Operative provisions cited on this page

Every claim on this page can be traced back to a section or rule below.

IT Act 2000 Sections 35-39Anchor

Statutory basis — IT Act 2000 Sections 35-39

IT Act 2000 Sections 35-39 is the operative provision for encryption dsc in this engagement. Encryption Class 3 DSC for confidential document signing tendering and tax filings The taxpayer should ensure the procedural conditions under this section are met before any filing or submission. Failure to comply attracts the consequences separately prescribed under the penalty and interest provisions of the same Act.

Forms Library

Forms used in this engagement

Class 3 Encryption DSCForm Class 3 Encryption DSC

Statutory form prescribed for Encryption DSC engagements; carries the information set required for filing or submission to the prescribed authority.

As prescribed under the relevant section / rule Prescribed authority

Aadhaar e-KYCForm Aadhaar e-KYC

Statutory form prescribed for Encryption DSC engagements; carries the information set required for filing or submission to the prescribed authority.

As prescribed under the relevant section / rule Prescribed authority

Statutory Deadlines

Compliance deadlines that matter

Miss any of these and the next consequence kicks in automatically.

Trigger event	Days	Form	Consequence
Validity period of an encryption DSC issued under Class 3 by a CCA-licensed CA	730 days	Fresh DSC issuance application with the CA, in-person verification of authorised signatory, certificate Subject and KeyUsage attributes confirmation, USB token loading	Expired encryption certificate causes Certificate Expired error on CPP Portal, GeM, ICEGATE, and MCA at any encryption-required operation, bid submissions fail at the encryption step, ASP-mediated GSTN bulk filings break, average loss per missed bid window is Rs 8 lakh to Rs 50 lakh depending on order value
Renewal of encryption DSC before expiry to allow handover and portal re-mapping	30 days	Fresh DSC application 30 days prior to expiry of existing certificate, portal re-mapping of new encryption certificate on CPP Portal, GeM, ICEGATE, GSTN, MCA wherever applicable	Last-minute renewal creates 4-7 day operational gap during which no encryption-required transaction can be filed, panic procurement adds Rs 2500 to Rs 4500 expedited fee, mid-tender encryption certificate change can invalidate already-uploaded bidder profiles requiring full re-registration
Loss or theft of USB cryptographic token containing DSC certificates	1 days	Immediate revocation request to issuing CA citing token loss under IT Act Section 38, FIR at jurisdictional police station, audit of activity logs on CPP Portal GeM ICEGATE GSTN MCA for unauthorised transactions during exposure window	Delay beyond 24 hours exposes signatory to repudiation disputes for any unauthorised transactions during the window, certificate misuse for fraudulent bid encryption or document signing remains a live risk until CRL refresh, FEMA and IT Act repudiation defences require timely revocation evidence
PIN reset attempt on USB token after multiple failed attempts before bricking threshold	On due date	Stop further PIN attempts at 10 of 15 user PIN attempts or 2 of 5 admin PIN attempts, contact CA helpdesk for guided unlock or accept token write-off	Token bricks irreversibly losing Rs 9000 to Rs 15000 in un-amortised certificate value, fresh dual-DSC token procurement adds Rs 4500, 4-day operational outage during fresh issuance, loss is purely attributable to panic-driven user error and not recoverable from CA
Authorised signatory authorisation expiry where signatory leaves entity or role changes	7 days	Revocation of signatory's organisational encryption DSC and signing DSC, board resolution for new authorised signatory, fresh DSC application for new signatory, portal authorised-signatory re-mapping on GSTN MCA ICEGATE GeM CPP Portal	Continued certificate use post-authorisation-expiry exposes the entity to legal challenges on signed documents and bids, departing signatory could theoretically submit binding documents until revocation, MCA Form INC-22 and DIR-12 changes also require synchronised DSC updates
GeM or CPP Portal bid submission within pre-defined bid window	On due date	Bid encryption using bidder's organisational encryption DSC, digital signature using signing DSC, upload before window-close timestamp enforced by portal server clock	Bid submitted even one second after window close is automatically rejected by portal, no condonation or extension is available because the encryption framework is time-locked at the portal level, loss of opportunity is total and the only remedy is to bid in the next tender cycle
IPO or QIP confidentiality DSC procurement before SEBI filing of RHP or PPD	21 days	Class 3 DSC for each promoter, director, BRLM, RTA authorised signatory and merchant banker key personnel involved in confidential filing on SEBI Intermediaries Portal	Pre-event DSC procurement gap delays SEBI RHP filing timeline by 7 to 14 days, peak tender season delays at CA can stretch in-person verification to 5 working days per signatory, IPO timing windows in market are sensitive and delay can shift launch by quarter
RBI Online encrypted return submission for AD Bank category-I monthly returns	10 days	Monthly XBRL return encrypted using RBI-published encryption certificate, signed using entity's signing DSC, uploaded on RBI Online portal by 10th of following month	Late submission attracts late filing fee per RBI compounding framework, repeated lapses trigger compliance officer scrutiny and may impact AD Bank category-I licence renewal, encryption certificate mismatch causes outright rejection treated as non-filing
ECS mandate encryption for bulk debit instructions through banking channel	3 days	Mandate data encrypted using sponsor bank's encryption certificate, signed using corporate signing DSC, transmitted via NACH or bank-provided secure channel at least 3 working days before scheduled debit date	Late or unencrypted mandate file is rejected by sponsor bank, scheduled debits do not execute, downstream impact includes SIP failures, loan EMI bouncing causing CIBIL hit, vendor payment delays attracting MSME interest under MSMED Act
Encryption DSC mapping refresh on government portals after fresh issuance or renewal	2 days	Portal-side re-mapping of new encryption certificate on CPP Portal bidder profile, GeM seller profile, ICEGATE DSC registration, GSTN ASP integration settings, MCA director profile	Stale certificate mapping causes Certificate Mismatch errors at any encryption operation, portal cache refresh typically takes 2 to 24 hours after re-mapping, mid-tender or mid-filing changes can require 24-hour wait creating de facto operational outage

Comparison

Signing DSC vs Encryption DSC

Aspect	Signing DSC	Encryption DSC
Definition	Signing DSC pathway under encryption dsc	Encryption DSC pathway under encryption dsc
Trigger basis	Statutory threshold or notified condition	Alternative condition prescribed by the operative section
Applicable section / rule	As prescribed by the operative provision	As prescribed by the alternative provision
Time limit	Per statutory window	Per alternative statutory window
Compliance burden	Lower / standard	Higher / specialised
Documentation set	Standard supporting documents	Extended supporting documents
Penalty exposure on default	Standard penalty under the Act	Enhanced penalty / disqualification consequence
Reversibility	Reversible by amendment / withdrawal	Reversible only by separate statutory procedure
Typical use case	Standard encryption dsc pathway	Specialised encryption dsc pathway
Cost implication	Within standard fee band	May attract specialist fees
Decision driver	Default for most situations	Required where alternative condition holds
Practitioner note	Confirm eligibility before commencement	Document the trigger before engagement begins