Encryption DSC — Thiruverkadu Ambattur Road & Thiruverkadu

Statutory form prescribed for Encryption DSC engagements; carries the information set required for filing or submission to the prescribed authority.

Statutory form prescribed for Encryption DSC engagements; carries the information set required for filing or submission to the prescribed authority.

X.509 is the standard format for digital certificates. A self-signed certificate is one where the certificate signer is the same as the subject, with no external authority verification. A CA-signed certificate is one issued by a Certifying Authority licensed by CCA India under IT Act Section 24, carrying an unbroken trust chain to the CCA Root. Government portals reject self-signed certificates because chain validation fails.

Federal Information Processing Standard 140-2 Level 2, a hardware security certification level requiring tamper-evident physical mechanisms and role-based authentication. USB cryptographic tokens like ePass2003 Auto and HYP2003 used for DSC storage in India typically meet Level 2. Defence procurement on GeM and certain CPP Portal categories explicitly mandate Level 2 compliance which rules out soft tokens or .pfx file storage.

Hard token is a physical USB cryptographic device that generates and stores private keys internally with the key never leaving the device. Soft token is a software-based key store such as a .pfx file or Windows Certificate Store entry. Hard tokens are FIPS 140-2 compliant and meet government portal security requirements; soft tokens are convenient but lack tamper resistance and are rejected by defence-category and high-value bidding portals.

A UEFI firmware feature ensuring that during boot only digitally signed bootloaders and operating system kernels execute, blocking rootkits and bootkit malware from compromising the system before security software loads. Critical for laptops used for DSC operations because compromise at boot level can intercept PIN entry and signing operations. Combined with TPM-backed disk encryption it creates a trusted execution environment.

The sequence of certificates from the end entity certificate up through one or more intermediate CA certificates to a trusted root CA. For a DSC issued by a CCA-licensed CA in India, the chain runs from the user's certificate, through the issuing CA's certificate, to the CCA Root. Portals validate this chain at every transaction; a break or missing intermediate causes signature verification failure.

A digital certificate specifically issued with KeyUsage attribute set to keyEncipherment and dataEncipherment, used for encrypting data such that only the holder of the corresponding private key can decrypt. Distinct from a signing DSC which has KeyUsage digitalSignature and is used for non-repudiation. Under CCA India guidelines and IT Act Section 35, organisations engaging in e-procurement on CPP Portal, GeM, or any portal requiring bid encryption must hold a separate encryption DSC per authorised signatory.

A digital certificate with KeyUsage attribute digitalSignature used for signing electronic documents to establish authenticity, integrity, and non-repudiation. Class 3 signing DSC issued by a CCA-licensed Certifying Authority after in-person verification is the standard accepted by MCA, GSTN, ICEGATE, Income Tax e-Filing, and all e-tendering portals. Cannot be used for encryption operations cryptographically because the underlying RSA key is provisioned for signing operations only.

A single USB cryptographic token loaded with two certificates: one signing-only certificate and one encryption-only certificate for the same signatory. Issued by a licensed CA after one in-person verification covering both certificates. Cost-efficient and reduces logistical overhead of carrying two separate tokens. Mandatory for participating in e-tenders on CPP Portal and GeM where both signing and bid encryption are required at the same submission step.

An encryption certificate issued in the name of an entity rather than an individual, carrying the entity PAN as the Subject primary identifier and the authorised signatory's CommonName as a secondary attribute. Required for GeM seller profile encryption mapping, CPP Portal bidder encryption, and certain RBI Online filings where the encryption is at entity level rather than individual signatory level. Subject field mapping accuracy is critical.

A process where a copy of the encryption private key is held in escrow with a trusted party (typically a CA or internal security custodian) to enable recovery of encrypted data in case the original key holder loses access. Controversial under CCA guidelines which generally prohibit escrow for signing keys to preserve non-repudiation, but permit it for encryption keys to address business continuity. Implementation requires careful access controls.

The bidder's encryption-certificate public key that the e-tendering portal uses to encrypt bid data such that only the bidder's encryption-DSC private key can decrypt at bid opening. The public key is extracted from the encryption certificate uploaded by the bidder during portal registration. Mismatch between the uploaded certificate and the active token at bid opening time causes decryption failure and bid rejection.

The cryptographic equivalent of a sealed tender envelope where the bid document is wrapped with the tender authority's public key at submission and remains undecryptable until the official bid opening event when the tender authority unwraps it using its private key. CPP Portal and GeM implement this through AES symmetric encryption of the bid content with the symmetric key itself wrapped using the recipient's RSA public key.