The Information Technology Act, 2000
CHAPTER VIII: DUTIES OF SUBSCRIBERS
Section 42: Control Of Private Key
Bare Act
(1) Every subscriber shall exercise reasonable care to retain control of the private key corresponding to the public key listed in his Digital Signature Certificate and take all steps to prevent its disclosure
(2) If the private key corresponding to the public key listed in the Digital Signature Certificate has been compromised, then, the subscriber shall communicate the same without any delay to the Certifying Authority in such manner as may be specified by the regulations.
Explanation - For the removal of doubts, it is hereby declared that the subscriber shall be liable till he has informed the Certifying Authority that the private key has been compromised.
Simplified Act
(1) If you have a digital signature, you need to be careful to keep your private key (a secret code) safe and secret. Make sure you do everything you can to stop other people from finding it out.
(2) If someone else gets your private key, or if it gets out somehow, you must tell the company that gave you your digital signature certificate right away, following their rules.
Note - Just to be clear, you are responsible for any problems caused by your private key until you tell the certificate company that it's no longer secret.
Explanation using examples
Let's consider John, who is a subscriber of a Digital Signature Certificate. He uses this for signing official documents digitally. According to Section 42(1) of The Information Technology Act, 2000, John needs to ensure that he takes reasonable measures to keep the private key of his digital signature secure. This could mean storing it in a secure location or using strong, unique passwords.
One day, John notices some suspicious activity related to his digital signature. He suspects that his private key might have been compromised. As per Section 42(2), John immediately informs his Certifying Authority about the potential compromise of his private key. He does this by sending them an official email, as specified in their regulations.
However, until the moment John informed the Certifying Authority about the compromise, any misuse of his digital signature due to the compromised private key would be his liability. This is clarified in the Explanation of Section 42.
