Every time you file your income tax return online, sign a company incorporation form on the MCA portal, or approve a high-value bank transaction, there’s a good chance a digital signature is working quietly in the background. It’s the invisible seal that tells the receiving system: this record genuinely came from the person who claims to have sent it, and nobody tampered with it along the way. The Information Technology Act, 2000 (IT Act) is what gives this digital seal the same legal weight as your handwritten signature on paper.
For anyone studying e-commerce law, this topic often feels intimidating because it mixes legal language with cryptography. But once you break it down, the logic is fairly simple, and it explains why online contracts, e-filing, and digital payments in India actually hold up in court.
Table of Contents
- What the IT Act 2000 says about digital signatures
- The technology behind the signature: asymmetric cryptography and hashing
- Asymmetric crypto system
- Hash function
- How the digital signature process actually works
- Digital signature vs electronic signature
- Certifying authorities and the trust chain
- Where encryption fits into the picture
- Why this matters for e-commerce
What the IT Act 2000 says about digital signatures
Section 3 of the IT Act is the starting point. It states that any subscriber may authenticate an electronic record by affixing a digital signature, and that this authentication must be carried out using an asymmetric crypto system and a hash function. The official text of the Act defines a hash function as an algorithm that maps a piece of data into a smaller, fixed-size output, in such a way that it is computationally infeasible to reconstruct the original record from that output, or to find two different records that produce the same result.
In plain terms, the law doesn’t just say “you can sign things digitally.” It specifies the exact cryptographic method that qualifies as a legally valid digital signature. This is deliberate. By tying legal recognition to a specific, verifiable technology, the Act ensures that a digital signature can actually be tested and proven in a dispute, rather than relying on trust alone.
The technology behind the signature: asymmetric cryptography and hashing
To understand why the law insists on these two components, it helps to understand what each one does.
Asymmetric crypto system
Also called public-key cryptography, this system generates a mathematically linked pair of keys for every user: a private key, which only the owner knows and controls, and a public key, which can be shared freely with anyone. Whatever is encrypted with one key can only be decrypted with the other half of the pair. A signatory uses their private key to “lock” a document, and anyone with the corresponding public key can “unlock” it to confirm the signatory’s identity. Because the private key never has to be shared, its secrecy is what keeps the whole system trustworthy.
Hash function
A hash function takes an electronic record of any size and compresses it into a fixed-length string of characters, known as a hash or message digest. Two properties make this useful for signatures. First, the same input always produces the same hash, so the result is predictable and verifiable. Second, even a tiny change, such as altering one word in a contract, produces a completely different hash. This is often called the avalanche effect, and it’s what makes tampering instantly detectable.
How the digital signature process actually works
The process described in the IT Act’s outline combines both technologies into a clear sequence. Here’s how it plays out between a sender and a recipient.
| Step | What the sender does | What the recipient does |
|---|---|---|
| 1 | Runs the original electronic record through a hash function to generate a unique hash value | Receives the message along with the attached digital signature |
| 2 | Encrypts that hash value using their own private key, creating the digital signature | Uses the sender’s public key to decrypt the signature and retrieve the original hash |
| 3 | Attaches the encrypted hash (the signature) to the original message and sends both together | Independently hashes the received message and compares the two hash values |
| 4 | If the two hashes match, the message is authentic and unaltered; if they don’t, it has been tampered with or the signature is invalid |
This two-step verification, confirming both identity (only the sender’s private key could have created a signature that opens with the sender’s public key) and integrity (only an unaltered document produces a matching hash), is what gives digital signatures their legal strength. A detailed reading of Section 3 shows the law is built entirely around this dual guarantee.
Digital signature vs electronic signature
Students often confuse these two terms, and the IT Act actually treats them differently. Section 3 deals specifically with digital signatures based on asymmetric cryptography and hashing. When the Act was amended in 2008, Section 3A was inserted to introduce a broader, technology-neutral category called the electronic signature, which recognises any authentication technique listed in the Second Schedule of the Act, including Aadhaar-based e-KYC signing. So every digital signature is a type of electronic signature, but not every electronic signature qualifies as a digital signature under the strict cryptographic definition in Section 3.
Certifying authorities and the trust chain
A key pair alone doesn’t prove who owns it. Someone independent has to vouch for the link between a public key and the real person or organisation behind it. This is where Certifying Authorities (CAs) come in. CAs issue Digital Signature Certificates (DSCs) that bind a subscriber’s identity to their public key.
Overseeing this entire ecosystem is the Controller of Certifying Authorities (CCA), appointed by the Central Government under Section 17 of the IT Act. According to the Digital India initiative, the CCA licenses and regulates CAs to make sure none of them violate the provisions of the Act, and it operates the Root Certifying Authority of India, which digitally signs the public keys of every licensed CA in the country. This creates a verifiable chain of trust: the government vouches for the CA, and the CA vouches for the individual subscriber. The CCA’s own framework page also notes that it maintains a public repository of all digital certificates issued in India, which anyone can use to verify a signer’s credentials.
Where encryption fits into the picture
Encryption and digital signatures often get bundled together, but they solve slightly different problems. A digital signature proves who sent a message and that it wasn’t altered. Encryption, on the other hand, is about confidentiality, making sure that only the intended recipient can read the content at all.
Interestingly, the IT Act does not lay down a detailed, standalone encryption law. Section 84A, added through a later amendment, simply empowers the Central Government to prescribe modes or methods of encryption for the secure use of electronic mediums and to promote e-governance and e-commerce. As of now, no comprehensive rules have been notified under this section. According to the Software Freedom Law Centre, India, a draft National Encryption Policy was published in September 2015 but was withdrawn within two days following public criticism, and India continues to rely instead on sector-specific encryption standards set by regulators such as the Reserve Bank of India for banking and SEBI for securities trading.
In practice, this means encryption strength in Indian e-commerce is largely governed by industry norms and contractual standards, such as SSL/TLS protocols for websites and payment gateways, rather than a single unified statute. Digital signatures, by contrast, remain far more tightly codified because they carry direct legal consequences for contract validity and evidentiary value in court.
Why this matters for e-commerce
Before this legal framework existed, a scanned signature or a typed name at the end of an email carried very little weight in a dispute. Section 3’s cryptographic approach changed that by giving electronic authentication a scientifically verifiable basis. This is what allows online tenders, e-contracts, GST filings, and company e-filings to be treated as legally binding, and it’s a major reason India’s digital economy has been able to scale the way it has. It also shifts responsibility onto users: since the security of the entire system hinges on keeping the private key confidential, courts generally presume that a document signed with a subscriber’s private key was indeed signed by them, unless proven otherwise.
What do you think? If the security of a digital signature depends entirely on the subscriber protecting their private key, how much of the legal certainty the IT Act promises actually rests on individual user behaviour rather than the technology itself? And as digital transactions grow more complex, should India move towards a more comprehensive encryption law instead of relying on sector-specific standards?
Leave a Reply