Section 3 of IT Act: Authentication of electronic records

Section 3(1)

Subject to the provisions of this section any subscriber may authenticate an electronic record by affixing his digital signature.

Section 3(2)

The authentication of the electronic record shall be effected by the use of asymmetric crypto system and hash function which envelop and transform the initial electronic record into another electronic record.

Explanation.— For the purposes of this sub-section, “hash function” means an algorithm mapping or translation of one sequence of bits into another, generally smaller, set known as “hash result” such that an electronic record yields the same hash result every time the algorithm is executed with the same electronic record as its input making it computationally infeasible—

(a) to derive or reconstruct the original electronic record from the hash result produced by the algorithm;

(b) that two electronic records can produce the same hash result using the algorithm.

Section 3(3)

Any person by the use of a public key of the subscriber can verify the electronic record.

Section 3(4)

The private key and the public key are unique to the subscriber and constitute a functioning key pair.

Explained:

Section 3(1): Authentication Through a Digital Signature

Section 3(1) allows a subscriber to authenticate an electronic record by affixing a digital signature, subject to the requirements of the provision.

In simple terms, a digital signature provides a way to verify the identity associated with a signed electronic record and to check whether the record has been altered after signing. It performs a role comparable to a handwritten signature in certain electronic transactions, although its technical operation is different.

For example, when a company director digitally signs an electronic filing, the digital signature can help establish that the document was authenticated using the relevant signing credentials.

However, the legal effect of a signature depends on the applicable law, the nature of the document and compliance with relevant statutory requirements. Section 3 should not be interpreted as automatically validating every electronic document.

Section 3(2): Asymmetric Cryptography and Hash Functions

Section 3(2) explains the technical mechanism through which an electronic record is authenticated. It refers to two important concepts: the asymmetric cryptographic system and the hash function.

An asymmetric cryptographic system uses two mathematically related keys. The private key is used to create the digital signature, while the corresponding public key is used to verify it.

A hash function processes electronic information and produces a comparatively compact result known as a hash value. Even a small change in the original document will ordinarily produce a different hash value when a secure hash algorithm is used.

For instance, if an electronically signed agreement is modified after signing, the verification process can identify that the document no longer corresponds to the original signed content.

This mechanism supports the integrity and authenticity of electronic records and helps reduce the risk of undetected alterations.

Explanation to Section 3(2): Meaning of a Hash Function

The Explanation clarifies the purpose of a hash function by identifying two important characteristics.

First, reconstruction resistance: It should be computationally infeasible to reconstruct the original electronic record from the hash result alone.

Second, collision resistance: It should be computationally infeasible to find two different electronic records that produce the same hash result.

These characteristics are important because electronic documents can be copied, transmitted and stored across multiple systems. A reliable hash function assists in detecting changes to the information being authenticated.

The provision’s wording reflects the technical principles underlying digital signatures. In practice, the strength of the protection depends on the cryptographic algorithm and its secure implementation.

Section 3(3): Verification Using the Public Key

Section 3(3) provides that any person may verify the electronic record using the subscriber’s public key.

This feature allows a recipient to verify a digital signature without needing access to the signer’s private key. The private key must remain confidential, whereas the public key is used for verification.

For example, a recipient of a digitally signed business document may use the relevant public key and verification software to check whether the signature is valid and whether the signed content has been altered.

The public key must be reliably associated with the claimed subscriber. A successful mathematical verification alone does not necessarily establish every fact concerning the signer’s identity, authority or consent.

Section 3(4): Private and Public Keys as a Key Pair

Section 3(4) states that the private key and public key are unique to the subscriber and constitute a functioning key pair.

The two keys perform different but complementary functions. The private key is used to create the digital signature, while the public key enables verification of that signature.

Protecting the private key is essential. If it is compromised or used without authorisation, another person may attempt to create signatures that appear to originate from the subscriber. Accordingly, secure storage, access controls and appropriate certificate-management procedures are important safeguards.

Together, these provisions create the technical foundation for digital authentication under the Act.

Important Judgments

Although the following judgments do not all directly interpret Section 3, they are relevant to understanding the legal treatment of electronic records, electronic communications and their evidentiary value in India.

1. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court examined the admissibility of electronic records and the requirements for proving electronic evidence under the Indian Evidence Act, 1872. The Court emphasised compliance with the statutory requirements governing electronic evidence, particularly Section 65B.

Relevance: This decision helps explain why the existence of a digital document or electronic record does not, by itself, settle questions concerning its admissibility and proof in court. Section 3 addresses authentication through digital signatures, while the evidentiary requirements must be considered separately.

2. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the legal requirements for admitting electronic records under Section 65B of the Indian Evidence Act, 1872. It reaffirmed the importance of the prescribed certificate for electronic evidence where the statutory requirement applies.

Relevance: The judgment is important when electronically stored information is produced in judicial proceedings. It illustrates the distinction between authenticating an electronic record through a digital signature and satisfying the legal requirements for admitting electronic evidence.

3. Trimex International FZE Ltd. v. Vedanta Aluminium Ltd. (2010)

In this case, the Supreme Court considered whether contractual arrangements concluded through electronic communications could be legally binding. The Court recognised that a contract may be concluded through electronic exchanges where the applicable legal requirements are satisfied.

Relevance: The judgment demonstrates the wider legal significance of electronic communications in commercial transactions. However, it should not be treated as a direct ruling on the technical requirements of Section 3 or as establishing that every electronic communication requires a digital signature.

Importance of Section 3 in Modern Digital Transactions

Section 3 provides an important foundation for the secure use of digitally signed electronic records. Its practical significance can be seen in several areas:

• Government filings: Digital signatures can help authenticate documents submitted through authorised electronic filing systems.
• Business transactions: Companies can use digital signatures to authenticate contracts, corporate documents and regulatory submissions where appropriate.
• Tax compliance: Digital signatures are used in specified electronic tax-filing and compliance processes.
• Legal documentation: Digitally signed records can assist in establishing the authenticity and integrity of documents, subject to the applicable evidentiary rules.
• Cybersecurity: Cryptographic verification helps detect unauthorised alterations to signed electronic records.

It is also important to distinguish Section 3 from Section 3A of the Information Technology Act, 2000. Section 3 specifically addresses digital signatures based on asymmetric cryptography and hash functions, whereas Section 3A provides for electronic signatures and authentication techniques meeting the statutory conditions.

Conclusion

Section 3 of the Information Technology Act, 2000, establishes the technical framework for authenticating electronic records through digital signatures. Its four subsections explain the authentication process, the role of hash functions, verification using public keys and the relationship between private and public keys.

The provision supports trust in electronic transactions by making it possible to verify signatures and detect changes to signed information. Nevertheless, authentication, the legal validity of a document and its admissibility as evidence are distinct questions that must be examined under the applicable legal provisions.