Encryption DSC · Maduravoyal-Vanagaram Road commercial corridor with mid density retail Pocket

Statutory form prescribed for Encryption DSC engagements; carries the information set required for filing or submission to the prescribed authority.

Statutory form prescribed for Encryption DSC engagements; carries the information set required for filing or submission to the prescribed authority.

Hard token is a physical USB cryptographic device that generates and stores private keys internally with the key never leaving the device. Soft token is a software-based key store such as a .pfx file or Windows Certificate Store entry. Hard tokens are FIPS 140-2 compliant and meet government portal security requirements; soft tokens are convenient but lack tamper resistance and are rejected by defence-category and high-value bidding portals.

A UEFI firmware feature ensuring that during boot only digitally signed bootloaders and operating system kernels execute, blocking rootkits and bootkit malware from compromising the system before security software loads. Critical for laptops used for DSC operations because compromise at boot level can intercept PIN entry and signing operations. Combined with TPM-backed disk encryption it creates a trusted execution environment.

The sequence of certificates from the end entity certificate up through one or more intermediate CA certificates to a trusted root CA. For a DSC issued by a CCA-licensed CA in India, the chain runs from the user's certificate, through the issuing CA's certificate, to the CCA Root. Portals validate this chain at every transaction; a break or missing intermediate causes signature verification failure.

A digital certificate specifically issued with KeyUsage attribute set to keyEncipherment and dataEncipherment, used for encrypting data such that only the holder of the corresponding private key can decrypt. Distinct from a signing DSC which has KeyUsage digitalSignature and is used for non-repudiation. Under CCA India guidelines and IT Act Section 35, organisations engaging in e-procurement on CPP Portal, GeM, or any portal requiring bid encryption must hold a separate encryption DSC per authorised signatory.

A digital certificate with KeyUsage attribute digitalSignature used for signing electronic documents to establish authenticity, integrity, and non-repudiation. Class 3 signing DSC issued by a CCA-licensed Certifying Authority after in-person verification is the standard accepted by MCA, GSTN, ICEGATE, Income Tax e-Filing, and all e-tendering portals. Cannot be used for encryption operations cryptographically because the underlying RSA key is provisioned for signing operations only.

A single USB cryptographic token loaded with two certificates: one signing-only certificate and one encryption-only certificate for the same signatory. Issued by a licensed CA after one in-person verification covering both certificates. Cost-efficient and reduces logistical overhead of carrying two separate tokens. Mandatory for participating in e-tenders on CPP Portal and GeM where both signing and bid encryption are required at the same submission step.

An encryption certificate issued in the name of an entity rather than an individual, carrying the entity PAN as the Subject primary identifier and the authorised signatory's CommonName as a secondary attribute. Required for GeM seller profile encryption mapping, CPP Portal bidder encryption, and certain RBI Online filings where the encryption is at entity level rather than individual signatory level. Subject field mapping accuracy is critical.

A process where a copy of the encryption private key is held in escrow with a trusted party (typically a CA or internal security custodian) to enable recovery of encrypted data in case the original key holder loses access. Controversial under CCA guidelines which generally prohibit escrow for signing keys to preserve non-repudiation, but permit it for encryption keys to address business continuity. Implementation requires careful access controls.

The bidder's encryption-certificate public key that the e-tendering portal uses to encrypt bid data such that only the bidder's encryption-DSC private key can decrypt at bid opening. The public key is extracted from the encryption certificate uploaded by the bidder during portal registration. Mismatch between the uploaded certificate and the active token at bid opening time causes decryption failure and bid rejection.

The cryptographic equivalent of a sealed tender envelope where the bid document is wrapped with the tender authority's public key at submission and remains undecryptable until the official bid opening event when the tender authority unwraps it using its private key. CPP Portal and GeM implement this through AES symmetric encryption of the bid content with the symmetric key itself wrapped using the recipient's RSA public key.

Central Public Procurement Portal operated under Department of Expenditure for e-tendering by central government departments, public sector undertakings, and autonomous bodies. Uses bid encryption requiring bidder's organisational encryption DSC, signing DSC for digital signature on bid documents, and time-locked encryption ensuring bids cannot be opened before the scheduled opening time even by portal administrators.

Government e-Marketplace's bid encryption mechanism for bids above prescribed threshold values. Uses the seller's organisational encryption certificate registered on GeM seller profile to wrap the financial bid component. Pre-defined bid window opens and closes at portal-controlled timestamps with bid opening only possible at the scheduled time by authorised buyer-side openers using the buyer's decryption keys.