Illinois Administrative Code › Title 14 - COMMERCE › Part 100 - ELECTRONIC COMMERCE SECURITY ACT › Section 100.10 - Scope and Definitions

Current through Register Vol. 48, No. 28, July 12, 2024
a) The
			 purpose of this Part is to provide maximum flexibility to the implementation of
			 digital signature technology for the private sector under the Illinois
			 Electronic Commerce Security Act [5 ILCS 175 ]. The Act sets forth procedures
			 by which the Secretary of State may certify security procedures for digital
			 signature technology. However, the Act does not require any person to create,
			 store, transmit, accept, or otherwise use or communicate information, records,
			 or signatures by electronic means or in electronic form; or prohibit any person
			 engaging in an electronic transaction from establishing reasonable requirements
			 regarding the medium on which it will accept records or the method and type of
			 symbol or security procedure it will accept as a signature.
b) For the purposes of this Part, and unless
			 the context expressly indicates otherwise, definitions are as follows:
"Act" means the Illinois Electronic Commerce Security Act [5
				ILCS 175 ].
"Applicant" means a person or entity other than a State agency
				seeking certification by the Secretary as a certification authority in the
				State of Illinois.
"Asymmetric cryptosystem" means a computer-based system capable
				of generating and using a key pair consisting of a private key for creating a
				digital signature and a public key to verify the digital signature.
"Certificate" means a record that at a minimum:
identifies the certification authority issuing it;
names or otherwise identifies its subscriber or a device or
				electronic agent under the control of the subscriber;
contains a public key that corresponds to a private key under
				the control of the subscriber;
specifies its operational period; and
is digitally signed by the certification authority issuing
				it.
"Certification authority" or "CA" means a person or entity who
				authorizes and causes the issuance of a certificate.
"Certification practice statement" or "CPS" is a statement
				published by a certification authority that specifies the policies or practices
				that the certification authority employs in issuing, managing, suspending, and
				revoking certificates and providing access to them.
"Certificate policy" or "CP" is a statement published by a
				certification authority that specifies the policies of the certification
				authority.
"Digital signature" means a type of electronic signature
				created by transforming an electronic record using a message digest function
				and encrypting the resulting transformation with an asymmetric cryptosystem
				using the signer's private key such that any person having the initial
				untransformed electronic record, the encrypted transformation, and the signer's
				corresponding public key can accurately determine whether the transformation
				was created using the private key that corresponds to the signer's public key
				and whether the initial electronic record has been altered since the
				transformation was made. A digital signature is a security procedure.
"Electronic" includes electrical, digital, magnetic, optical,
				electromagnetic, or any other form of technology that entails capabilities
				similar to these technologies.
"Electronic record" means a record generated, communicated,
				received, or stored by electronic means for use in an information system or for
				transmission from one information system to another.
"Electronic signature" means a signature in electronic form
				attached to or logically associated with an electronic record.
"Key pair" means, in an asymmetric cryptosystem, 2
				mathematically related keys, referred to as a private key and a public key,
				having the properties that:
one key (the private key) can encrypt a message that only the
				other key (the public key) can decrypt; and
even knowing one key (the public key), it is computationally
				unfeasible to discover the other key (the private key).
"Message digest function" means an algorithm that maps or
				translates the sequence of bits comprising an electronic record into another,
				generally smaller, set of bits (the message digest) without requiring the use
				of any secret information, such as a key, so that an electronic record yields
				the same message digest every time the algorithm is executed using such record
				as input and it is computationally unfeasible that any 2 electronic records can
				be found or deliberately generated that would produce the same message digest
				using the algorithm unless the 2 records are precisely identical.
"Operational period of a certificate" begins on the date and
				time the certificate is issued by a certification authority (or on a later date
				and time certain if stated in the certificate) and ends on the date and time it
				expires as noted in the certificate or is earlier revoked, but does not include
				any period during which a certificate is suspended.
"Person" means an individual, corporation, business trust,
				estate, trust, partnership, limited partnership, limited liability partnership,
				limited liability company, association, joint venture, government, governmental
				subdivision, agency, or instrumentality, or any other legal or commercial
				entity.
"Private key" means the key of a key pair used to create a
				digital signature.
"Public key" means the key of a key pair used to verify a
				digital signature.
"Record" means information that is inscribed, stored, or
				otherwise fixed on a tangible medium or that is stored in an electronic or
				other medium and is retrievable in perceivable form.
"Repository" means a system for storing and retrieving
				certificates or other information relevant to certificates, including
				information relating to the status of a certificate.
"Revoke a certificate" means to permanently end the operational
				period of a certificate from a specified time forward.
"Secretary" means the Secretary of State of Illinois.
"Security procedure" means a methodology or procedure used for
				the purpose of:
verifying that an electronic record is that of a specific
				person; or
detecting error or alteration in the communication, content, or
				storage of an electronic record since a specific point in time.
A security procedure may require the use of algorithms or
				codes, identifying words or numbers, encryption, answer back or acknowledgment
				procedures, or similar security devices.
"Signature device" means unique information, such as codes,
				algorithms, letters, numbers, private keys, or personal identification numbers
				(PINs), or a uniquely configured physical device that is required, alone or in
				conjunction with other information or devices, in order to create an electronic
				signature attributable to a specific person.
"Signed" or "signature" includes any symbol executed or
				adopted, or any security procedure employed or adopted, using electronic means
				or otherwise, by or on behalf of a person with intent to authenticate a
				record.
"State agency" means and includes all officers, boards,
				commissions, courts, and agencies created by the Illinois Constitution, whether
				in the executive, legislative or judicial branch; all officers, departments,
				boards, commissions, agencies, institutions, authorities, universities, bodies
				politic and corporate of the State; and administrative units or corporate
				outgrowths of the State government that are created by or pursuant to statute,
				other than units of local government and their officers, school districts and
				boards of election commissioners; all administrative units and corporate
				outgrowths of the above and as may be created by executive order of the
				Governor.
"Subscriber" means a person who is the subject named or
				otherwise identified in a certificate, who controls a private key that
				corresponds to the public key listed in that certificate, and who is the person
				to whom digitally signed messages verified by reference to such certificate are
				to be attributed.
"Suspend a certificate" means to temporarily suspend the
				operational period of a certificate for a specified time period or from a
				specified time forward.
"Trustworthy manner" means through the use of computer
				hardware, software, and procedures that, in the context in which they are
				used:
can be shown to be reasonably resistant to penetration,
				compromise, and misuse;
provide a reasonable level of reliability and correct
				operation;
are reasonably suited to performing their intended functions or
				serving their intended purposes;
comply with applicable agreements between the parties, if any;
				and
adhere to generally accepted security procedures.
"Valid certificate" means a certificate that a certification
				authority has issued and that the subscriber listed in the certificate has
				accepted.
"Verify a digital signature" means to use the public key listed
				in a valid certificate, along with the appropriate message digest function and
				asymmetric cryptosystem, to evaluate a digitally signed electronic record, such
				that the result of the process concludes that the digital signature was created
				using the private key corresponding to the public key listed in the certificate
				and the electronic record has not been altered since its digital signature was
				created.