Basic concepts

• Security

  Security is one of the key concepts to which the Administration, in the field of Information and Communication Technologies (ICT), should pay the utmost attention.

  The Administration has to extend the legal guarantees it offers citizens and businesses to electronic procedures.

  Documents that are generated electronically have three concepts associated with them that need to be safeguarded and which are: confidentiality, integrity and authenticity.

  • Confidentiality refers to the ability to keep an electronic document inaccessible to everyone, except a certain list of persons.
  • Integrity ensures that the received document matches the issued document without any possibility of change.
  • Authenticity refers to the ability to determine whether a particular list of persons has established their recognition and/or commitment to the content of the electronic document. The problem of authenticity in a traditional document is solved by autograph signature. By means of their autograph signature, an individual, or several, express their willingness to recognize the content of a document, and where appropriate, to fulfill the commitments that the document establishes to the individual.

  These problems, confidentiality, integrity and authenticity (the defined processes of signing and encryption) are resolved by the technology called cryptography. Cryptography is a branch of mathematics that, when applied to digital messages, provides the ideal tools to solve the aforementioned problems. The problem of confidentiality is commonly related to the so called encryption techniques and to problems of integrity and authenticity with the so called digital signature techniques, although both are actually reduced to cryptographic encryption and decryption procedures.

• What is asymmetric cryptography?

  Asymmetric cryptography is the cryptographic method that uses a complementary key pair, public and private, to encrypt documents or messages. What is encoded with a private key needs its corresponding public key to be decoded. And vice versa, what is encoded with a public key can only be decoded with its private key. The private key must be known only by its owner, while the corresponding public key can be made public.

  The fact that the private key is only known to its owner allows us to achieve two important things:

  • Any document generated from this key must necessarily have been generated by the owner of the key (electronic signature).
  • A document to which the public key applies can only be opened by the owner of the corresponding private key (electronic encryption).
• What is an electronic certificate?

  An electronic certificate is a document issued and signed by a certification authority that identifies a person (natural or legal) with a key pair. A certificate contains the following information:

  • Identification of the certificate holder (Name of the holder, NIF, e-mail,etc.).
  • Certificate badges: serial number, entity that issued it, date of issue, validity period of the certificate,etc.
  • A key pair: public and private.
  • The electronic signature of the certificate with the private key of the certification authority (CA) that issued it.

  All this information can be divided into two parts:

  • Private part of the certificate: private key.
  • Public part of the certificate: other data of the certificate, including the electronic signature of the certification authority that issued it.

  The private part is never ceded by its owner. This is the basis of security. With the key pair you can perform encryption functions with the peculiarity that what is encrypted with the private key can only be decrypted with the public key and vice versa.

• What is an electronic signature?

  An electronic signature is a fingerprint of a document encrypted with a key. The fingerprint is obtained by applying a mathematical algorithm to a message. This algorithm has two fundamental characteristics:

  • There is no possibility to retrieve the message from the generated fingerprint.
  • If you change the message, the fingerprint you get is different.

  These two features ensure the integrity of the message. If the content of the message is changed, the one verifying the signature will know it.

  The fingerprint is encrypted with the private key of the certificate of the person signing. By applying the verification mechanisms, the recipient will know who signed and that person cannot repudiate the authorship of the message.

• How is an electronic signature generated?
  1. You get a fingerprint of the digital document you want to sign. This fingerprint ensures that two different documents generate different fingerprints and two identical documents always generate the same fingerprint.
  2. Encryption (using mathematical algorithms) of the fingerprint with the private key of the certificate is performed. This ensures authenticity as the certificate owner is the only one who has been able to perform this encryption.
  3. All documentation is encapsulated in a signed document that includes:
     1. Original document.
     2. Fingerprint encrypted with the private key.
     3. Public part of the certificate.
• How is an electronic signature verified?
  1. The fingerprint, encrypted with the private key, is decrypted using the public key of the certificate.
  2. The fingerprint of the original document is obtained.
  3. The two fingerprints are compared. If they match, the signature is correct (there is integrity, the document has not been modified).
  4. The issuing certification authority is consulted for the validity of the certificate and, if it is valid, the signature in addition to being correct is valid (the authenticity of the signature origin is guaranteed).