Source: http://kuner.com/historical-materials-on/german-digital-signature.html
Timestamp: 2018-08-14 15:41:19
Document Index: 161436462

Matched Legal Cases: ['§ 4', '§ 5', '§ 14', '§ 3', '§ 16', '§ 66', '§ 15', '§ 16', '§ 16', '§ 14', '§ 7', '§ 13', '§ 4', '§ 16', '§ 383', '§ 4']

German Digital Signature Law (SigG), Working Draft, November 4, 1996 | kuner.com
German Digital Signature Law (SigG), Working Draft, November 4, 1996
« German Digital Signature Ordinance (SigV), Final Draft, December 20, 1996
German Draft Digital Signature Ordinance (SigV), Reporter's Draft, Version of September 19, 1996 »
Commentary: This translation is of the "Working Draft" of November 4, which contains several changes to the previous draft (the "Reporter's Draft" of September 19, 1996); changes from the previous draft are marked in boldface. The Law is expected to be approved by the German cabinet in late 1996 or early 1997 and to be enacted into law by parliament in the spring of 1997. Among the important changes from the previous draft are the following: (1) expanded authority of the government to charge for costs incurred in licensing of certifiers (§ 4(6)); (2) greater use of associated certificates to demonstrate the licensing of professionals (§ 5(2)); and (3) procedures for the fulfillment of technical requirements and recognition of certificates for EU or EEA Member States (§§ 14(5), 15). Changes have also been made to the Draft Digital Signature Ordinance; a revised translation thereof will be made available on this site shortly.
(1) A digital signature within the meaning of this law is a seal on digital data created with a private signature key, which seal allows, by use of the associated public key marked with a signature key certificate of a certifier or of the Authority under § 3, the owner of the signature key and the unforged character of the data to be ascertained.
(3) A signature key certificate within the meaning of this law is a digital attestation marked with a digital signature concerning the attribution of a public signature key to a natural person.
(4) A time stamp within the meaning of this law is a digital attestation of a certifier marked with a digital signature that certain digital data was presented to it at a certain time.
The granting of licenses and the issuance of signature key certificates for certifiers, as well as supervision of compliance with this law and with the Legal Ordinance under § 16, rest with the Authority under § 66 of the Telecommunications Act.
(2) The license shall be denied if there are factual grounds for the assumption that the applicant does not possess the reliability necessary for the operation of a certifier, if the applicant does not demonstrate that it possesses the necessary expert knowledge for the operation of a certifier, or if it can be expected that the further requirements for the operation of a certifier under this law and the Legal Ordinance under § 15 will not be present upon commencing operations.
(3) An applicant possesses the necessary reliability if it can guarantee that it will comply as license holder with the relevant legal requirements for the operation of a certifier. The necessary expert knowledge is present if those persons working in the certifier possess the necessary knowledge, experience, and qualifications. The further requirements for the operation of the certifier are present if the measures for fulfilling the security requirements of this law and the Legal Ordinance under § 16 are promptly notified to the Authority in a security plan, the implementation of which has been examined and verified by an instance recognized by the Authority.
(4) The license may contain subsidiary provisions, insofar as these are necessary to ensure that the certifier fulfills the requirements of this law and the Legal Ordinance under § 16 upon commencing and during operations.
(5) The Authority issues the certificates for signature keys that are used to sign signature key certificates. The provisions for the issuance of signature key certificates by certifiers apply correspondingly for the Authority, which shall maintain access to the signature key certificates which it has issued at all times and for everyone over publicly-accessible telecommunications connections. This also applies to information concerning the addresses and telephone numbers of certifiers, the blocking of signature key certificates which it has issued, the termination of and the prohibition against performing licensed activities, as well as the revocation of licenses.
Issuing Signature Key Certificates and Time Stamps
(1) The certifier shall reliably identify persons who apply for a signature key certificate. It shall confirm the attribution of a public signature key to an identified person by a signature key certificate and shall maintain access to such, as well as to associated certificates (para. 2), at all times and for everyone over publicly-accessible telecommunications connections in a verifiable manner and with the agreement of the signature key owner.
(2) Upon request of an applicant, the certifier shall record information concerning the applicant's power of representation for a third party or its licensing by a third party in the signature key certificate or in a associated certificate, insofar as consent of the third party that such licensing or power of representation be recorded in a certificate is reliably demonstrated.
(3) Upon request of an applicant, the certifier shall record a pseudonym in the signature key certificate in place of the applicant's name.
(4) The certifier shall take measures so that data for signature key certificates cannot be forged or falsified in a way which is not visible. It shall furthermore take steps so that the confidentiality of a private signature key is guaranteed. Private signature keys may not be stored by a certifier.
(5) It shall use reliable personnel for the exercise of certification activities, and shall use technical components in accordance with § 14 for making signature keys accessible and creating signature key certificates. This also applies to technical components which make possible the verification of signature key certificates under para. 1, sentence 2.
Contents of Signature Key Certificates
1. The name of the signature key owner, which much be marked with an additional notation if there is the possibility of confusion, or with an unmistakable pseudonym attributable to the signature key owner which shall be identified as such;
3. the name of the algorithms with which the public key of the signature key owner as well as the public key of the certifier can be used;
6. the name of the certifier;
7. information as to whether use of the signature key is limited to specific types and scopes of applications; and
8. information concerning associated certificates.
(2) Information concerning the power of representation for a third party or licensing by a third party may be recorded in the signature key certificate or associated certificates.
Blocking of Signature Key Certificates
(1) A certifier shall block a signature key certificate or an associated certificate upon request of a signature key owner or his representative if the certificate was issued based on false information under § 7, if the certifier ends its activities and they are not continued by another certifier, or if the Authority orders blocking under § 13, para. 5, sentence 2. The blocking shall indicate the time from which it applies. Retroactive blocking is not permitted.
(3) The Authority shall block certificates issued by it under § 4, para. 5 if a certifier terminates its activities or its license is revoked.
A certifier shall mark digital data upon request with a time stamp. Section 5, para. 5, sentences 1 and 2 apply accordingly.
A certifier shall document the security measures taken to comply with this law and the Legal Ordinance under § 16 as well as the issued signature key certificates in such a way that the data and its unfalsified condition may be verified at any time.
(1) Upon termination of its activities, a certifier shall notify this to the Authority as soon as possible and shall ensure that signature key certificates valid at the time of termination are taken over by another certifier or are blocked.
(1) The certifier may collect personal data only directly from the affected person and only insofar as necessary for the purposes of a signature key certificate. Collecting data from a third party is only permissible if the person affected gives his consent. Data may only be used for purposes other than those described in sentence 1 if this law or another legal provision so permits or the person affected has given his consent.
(2) In the case of a signature key owner using a pseudonym, the certifier shall transmit data concerning his identity in individual cases only upon request of the proper authorities, insofar as this is necessary to prosecute crimes or misdemeanors, to protect against dangers for the public safety or public order, or to fulfill the legal duties of the constitutional protection authorities of the federal government and the federal states, the federal security service, the military security service or the criminal customs authorities. Such information shall be documented.
(2) Certifiers shall allow the Authority to enter their business and operational premises during normal business hours for the purpose of supervision under para. 1, sentence 1, and upon request shall present any relevant books, records, receipts, writings, and other records for inspection, and shall provide information and necessary assistance. The person required to provide the information may refuse to provide it with regard to questions, the answering of which would subject him or one of his family members mentioned in § 383 paras. 1 through 3 of the Civil Procedure Code to the danger of criminal prosecution or to a procedure under the Law on Misdemeanors. The person required to provide the information shall be informed of this right.
(4) In case of revocation of a license or the termination of activities of a certifier, the Authority shall ensure that such activity is taken over by another certifier or that contracts with signature key owners are wound up. This also applies with regard to an application for the opening of bankruptcy or composition proceedings, if the licensed activity is not being continued.
(5) The validity of signature key certificates issued by a certifier shall be unaffected by revocation of a license. The Authority may order blocking of signature key certificates if facts justify the assumption that certificates have been forged or are not sufficiently secure from forgery, or that the technical components used for application of signature keys demonstrate security defects which allow the forgery of digital signatures or the falsification of signed data to go undetected.
(1) During the creation and storage of signature keys and the creation and checking of digital signatures, technical components shall be used which have security features that make forgery of digital signatures and falsification of signed data reliably visible and protect against the unauthorized use of private signature keys.
(4) With regard to technical components under paras. 1 to 3, they shall be sufficiently examined under the state of the art and the fulfillment of the requirements shall be verified by an instance recognized by the Authority.
(5) It can be assumed that the requirements under paras. 1 and 2 regarding technical security are fulfilled with regard to technical components which are placed in circulation or legally manufactured in accordance with the rules or requirements of another Member State of the European Union or of another Contracting State of the Treaty on the European Economic Area, and which guarantee the same level of security. In individual cases and when there is a good reason, the Authority may require a demonstration that the requirements under para. 1 have been fulfilled. Insofar as a confirmation of an instance recognized by the Authority is required to be presented to demonstrate technical security requirements within the meaning of paras. 1 through 3, then confirmations by authorities licensed in other Member States of the European Union or in other Contracting States of the European Economic Area shall be considered, if the technical requirements, examinations, and examination procedures on which the examination reports of such instances are based are equivalent to the those of instances recognized by the German authorities.
Foreign Signature Key Certificates
(1) Digital signatures which may be checked with a public signature key for which a foreign signature key certificate of another Member State of the European Union or of another Contracting State of the Treaty on the European Economic Area exists are deemed to be equivalent to digital signatures under this law.
(2) Para. 1 also applies to other States, insofar as supranational or international agreements concerning the recognition of signature key certificates have been concluded.
1. Further details of the procedure for granting, transfer, and revocation of a license, as well as the procedure for termination of licensed activities;
2 The circumstances giving rise to fees under § 4, para. 6, the amount of fees, and the reimbursement of expenses under the Act on Administrative Costs;
6. Further requirements for the technical components as well as the examination of technical components and confirmation that the requirements have been fulfilled;