⊙ MIC Notification No. 2003-51
  The revision to the Guideline on Electronic Signature Certification Practices (MIC Notification No. 2002-46, November 15, 2002) in accordance with the provision of Article 8 of the Electronic Signature Act is notified as follows.
November 27, 2003
Minister of the Ministry of Information and Communication

Revised Guideline on the Electronic 
Signature Certification Practices
The guideline on electronic signature certification practices is revised as follows.

Guideline on Electronic Signature Certification Practices

Chapter 1 General Provisions
Article 1 (Object) The object of this guideline is to lay down details of what certification authorities must observe in performing certification services by means of asymmetric encryption in order to ensure safety and reliability of certification practices in accordance with Article 8 of the Electronic Signature Act (called the "Act" hereinafter).
Article 2 (Definition) Terms used in this guideline are defined as follows.
  1. The "Accredited System" refers to the system installed in the certification authorities for the purpose of certification services that supports management of subscriber's registration information, generation and management of key pairs, generation, issuance and management of certificates, and time stamping.
  2. The "Asymmetric Encryption" refers to the cryptographic method, in which the key used for encrypting information is different from that used for decoding the encrypted information.
  3. The "Public Key" refers to the electronic information used to certify electronic signatures.
  4. The "Private Key" refers to the electronic information used to generate electronic signatures.
  5. The "Key Pair" refers to the private key and the matching public key.
  6. The "Registration Authorities" refer to those who identify subscribers, and receive and register requests for issuance, suspension, restoration and revocation of certificates  in place of certification authorities.

  7. The "Registered Subscriber Information" refers to certificate requests, the documents that requesters submitted to certification authorities for identification, copies of certificates and other electronic records necessary for requesting certificates.
  8. The "Safe Network Operating System" refers to the system necessary for safe operation of the network such as the firewall, the intrusion detection system, and the network management system.
  9. "Renewal" refers to extending the term of validity of the certificate upon expiration and issuing the certificate.
  10. "Reissuance" refers to revoking the certificate when the subscriber lost or damaged the private key, or had it stolen or leaked, generating a new key pair, and issuing a new certificate.
  11. "Changed Issuance" refers to changing the relevant information when the subscriber's information in the certificate such as the certificate owner's distinguished name (called "DN” hereinafter) has been changed and issuing the certificate.
Article 3 (Scope of Application) This guideline applies to the certification practices utilizing the asymmetric encryption-based electronic signature technology.

Chapter 2 Management of Certificates
Article 4 (Transmission of Registered Information) If certification authorities receive the registered information of those who want certificates issued by registration authorities over the network, they must apply to the registered information in question the certified electronic signature of the registration authority and the encryption based on the cryptographic algorithm in accordance with Subclause 3 of Clause 1 of Article 5 of Rules on Accredited Certification Authority's Facilities and Equipments. However, if an electronic signature other than the certified electronic signature is used in accordance with an agreement of the registration authority, the electronic signature algorithm as specified in Subclause 1 of Clause 1 of Article 5 of Rules on Accredited Certification Authority's Facilities and Equipments must be used.
Article 5 (Request for Issuance of Certificate) ① If certification authorities receive requests for new issuance, renewed issuance, reissuance or changed issuance of certificates from those who want certificates issued or subscribers, they must observe the procedure of identification as specified in Clause 6 of Article 15 of the Act, and check the integrity of the requests.
  ② If there is a request for renewed issuance or changed issuance as described in Clause 1, certification authorities may use the certified electronic signature to identify the subscriber and check the integrity of the request.
  ③ If the certified electronic signature is used to identify the requester and check the integrity of the request in accordance with the provision of Clause 2, related information such as a copy of the certificate of residence and a copy of the corporate registration must be utilized to check the accuracy of the changed information in a reliable manner.
Article 6 (Generation of Certificates) ① Certification authorities must check if the private key belongs to the person who wants to have the certificate issued, and if his/her public key is unique.
  ② If certification authorities generate a certificate, they must use the private key matching the public key certified by Korea Information Security Agency (called "KISA" hereinafter) in accordance with the provision of Article 52 of the Act on Promotion of Information and information and communication network Utilization and information Protection, etc. to attach the certified electronic signature to the certificate. 
  ③ If certification authorities issue a certificate to a subscriber, they must notify the repository.
Article 7 (Request for Suspension, Restoration and Revocation of Certificate) ① If certification authorities receive requests for the suspension, restoration or revocation of certificates from subscribers, they must abide by the procedure of identification as specified in Clause 6 of Article 15 of the Act and check the integrity of the requests. However, when there is a request for suspension or revocation, they may use certified electronic signatures to identify requesters and check the integrity of requests.
  ② If the subscriber urgently requests revocation of a certificate due to the loss, destruction, theft or leakage of the certificate, certification authorities can identify the subscriber and handles the request by means of reliable methods such as verifying two or more pre-registered pieces of personal information.
  ③ If the subscriber requests restoration of a certificate, certification authorities must check if the request was made within 6 months of the invalidity date. In addition, certification authorities must revoke the certificate if the request was made 6 months after the subscriber's certificate became invalid.
Article 8 (Generation of Certificate Suspension and Revocation List) ① When suspending, restoring or revocating the subscriber's certificate, certification authorities must generate the certificate suspension and revocation list. In this case, certification authorities must attach a certified electronic signature to the certificate suspension and revocation list by means of the private key that matches the public key certified by KISA, and notify the repository.
  ② If the subscriber's certificate has been suspended, restored, or revoked, certification authorities must immediately take necessary measures to make it possible to verify the fact.
Article 9 (Public Announcement and Validation of Certificates) ①Certification authorities must have a repository available so that users can always check their certificates and the certificate suspension and revocation list.
  ② Certification authorities must provide certificate validity check service so that users can check the validity of their certificates.

Chapter 3 Management of Key Pairs
Article 10 (Generation of Key Pairs) ① Certification authorities must generate key pairs in accordance with the electronic signature algorithm as specified in Subclause 1 of Clause 1 of Article 5 of Rules on Accredited Certification Authority's Facilities and Equipments.
  ② If certification authorities generate their own key pairs, 3 or more authorized employees must do so jointly.
  ③ If certification authorities generate the key pairs of those who want their certificates issued, 2 or more authorized employees must join in doing so.
Article 11 (Protection of Private Keys) ① The security module that satisfies the key pair protection technical specifications in 6.4 of the [Appendix] electronic signature certification system technical specifications as specified in Rules on Accredited Certification Authority's Facilities and Equipments must be used to protect private keys.
  ② If certification authorities generate the key pair of the person who wants a certificate issued, they must encode the key pair in accordance with the cryptographic algorithm as specified in Subclause 3 of Clause 1 of Article 5 of Rules on Accredited Certification Authority's Facilities and Equipments, and save it in a storage device. To ensure the integrity of the private key, they must save additional information including the message authentication code (MAC) together and transmit it directly to the  subscriber. In this case, certification authorities must immediately delete the private key and related information remaining in the memory of the key pair generation and management facilities or a temporary file.
Article 12 (Backup of Private Keys) ① Certification authorities must back up private keys to prevent destruction of private keys from  affecting the continuity of certification services.
  ② If certification authorities back up their own private keys, they must ensure their safety as defined in Clause 1 of Article 11.
  ③ Certification authorities must make two copies of the backup private key separately from the original private key, and safely keep one copy in the facilities where certification services are performed, and the other in a remote storage location at least 10km away.
Article 13 (Revocation of Private Keys) Certification authorities must safely destroy the backup copy and the original private key in the presence of the supervisor and the security manager.
Article 14 (Loss, Destruction, Theft or Leakage of Private Keys) If certification authorities' private key has been lost, damaged, stolen or leaked, they must take an appropriate measure like putting up a notice on their homepage so that all users are aware of the fact.

Chapter 4 Other Certification Services
Article 15 (Provision of Time Stamping) If a subscriber or a user requests time stamping for an electronic document, certification authorities may provide the time stamper service.
Article 16 (Time Reception and Correction) Certification authorities must operate a time reception device to provide correct time information for time stamping, and continuously use the time correction function of the time stamper system. In addition, if error occurs to the time correction function, they must immediately stop the time stamper service.
Article 17 (Storage of Time Stamping Records) Certification authorities must safekeep records related to time stamping such as time stamping tokens.
Article 18 (Storage of Electronic Documents) ① When there is a request for time stamping, certification authorities may safekeep electronic documents or electronic signatures subject to time stamping.
  ② If certification authorities safekeep electronic documents subject to time stamping in accordance with provision of Clause 1, they must use the cryptographic algorithm as specified in Subclause 3 of Clause 1 of Article 5 of Rules on Accredited Certification Authority's Facilities and Equipments to prevent unauthorized users from reading them.
Article 19 (Backup of Time Stamping Records) If certification authorities safekeep time stamping records in accordance with the provisions of Articles 17 and 18, they must back up those records, and safely keep them in a remote storage location at least 10km away from the facilities where certification services are performed.
Article 20 (Other Supplementary Services) Certification authorities may use the certified electronic signature in addition to time stamping to perform other services. 

Chapter 5 Others
Article 21 (Conformity to Technical Specifications) When performing certification service, certification authorities must conform to the technical specification for the electronic signature certification system as described in the appendix of Rules on Accredited Certification Authority's Facilities and Equipments.
Article 22 (Scope and Intended Use of Certificates) If certification authorities use certificates issued by KISA, they must use them in accordance with their scope and intended use as specified in the certificates.
Article 23 (Conformity to Certification Procedure) ① If changes are made to the procedure and method of certification, certification authorities must reflect them to the working rules and internal rules of certification, and keep and manage the records related to enactments and revisions including what is described below. 
  1. Reasons for revision
  2. All enacted and revised regulations
  ② If certification authorities install, operate and maintain the following systems, two or more employees must do so jointly.
   1. A system that supports the management of subscribers' registration information
   2. A system that supports the generation, issuance and management of certificates
   3. A system that supports time stamping
Article 24 (Matters concerning Facilities and Equipment) ①Certification authorities must use the facilities and equipments inspected when they were authorized to perform certification services.
  ② If certification authorities need to change facilities and equipment for certification services, they must report it to the Minister of Information and Communication, and get the appropriateness of the changes confirmed before allying them to certification services. However, emergency measures are required for incidents, natural disasters, and system errors. They may apply the changes in advance, and must report it within 7 days of the request.
  ③ In reporting changes to facilities and equipment in accordance with provision of Clause 2, changes to facilities and equipment related to what is listed below may not be reported.  
   1. Periodic patches or upgrades to the operating system
   2. Addition or replacement of hardware including the CPU, hard disks, and memory for load distribution and performance improvement of existing equipment.
   3. Addition or replacement of physical equipment such as electric systems and soundproofing devices as long as they do not injure the safety of certification services.
  ③ If certification authorities changed facilities and equipment for certification services, they must record the changes, and keep the records. 
  ④ Certification authorities must conduct configuration management for the following facilities and equipment.
   1. The certification system and subscriber software 
   2. Network architecture and equipment
   3. Safe network operating system and server management system
   4. Systems related to access control 
   5. Other systems in operation
  ⑤ When distributing subscriber software, certification authorities must manage the electronic signatures or hash values to ensure the integrity of the software.
Article 25 (Management of Certification Service Records) ①Certification authorities must keep the following records for 10 years from the expiration of the certificate.
  1. Records concerning certificate requests (issuance/suspension/restoration/revocation) and their processing;
  2. The copies of the documents and certificates that requesters submitted to certification authorities for the purpose of identification;
  3. Certificates
  4. Certificate suspension and revocation list;
  5. Information regarding revocation of certificates;
   A. If certificates are revoked in accordance with provision of Subclause 2 or 4 of Clause 1 of Article 1 of the Act, the records of the reason for revocation that state the name and resident registration number of the person who made the decision to revoke the certificates
  6. If certification authorities generated the key pair of the subscriber, the records concerning the generation of the key pair and the subscriber's receipt of the key pair;
  7. Records concerning the certification authorities' generation and management of the key pair;
  ② Among the various documents described in Clause 1, paper documents may be stored in microfilms, whereas electronic information may be stored in storage devices such as an optical disk.
  ③ If certification authorities receive requests for renewal, changed issuance, suspension and revocation of a certificate over the information and communication network, they may store the request records described in Subclause 1 of Clause 1 as an electronic document to which the subscriber's certified electronic signature is attached.
  ④ Certification authorities must keep a copy of the records described in Clause 1 in the facilities where certification services are performed, and another in a remote storage location at least 10Km away.
Article 26 (Management of Certification Service Records through the representative) ① If registration authorities must keep records related to registration services for inevitable reasons, certification authorities may allow the registration authorities at the request of the latter to keep the records as specified in Subclauses 1 and 2 of Clause 1 of Article 25. However, if there is a request from certification authorities, the registration authorities must submit relevant records.
  ② If registration authorities keep the records specified in Subclauses 1 and 2 of Clause 2 of Article 25 in accordance with the provision of Clause 1, certification authorities must receive the following information in the form of an electronic document to which the certified electronic signature of the registration authorities is attached, and keep it in accordance with Article 25. However, if an electronic signature other than the certified one is used in accordance with an agreement with registration authorities, the electronic signature algorithm, as specified in Subclause 1 of Clause 1 of Article 5 of Rules on Accredited Certification Authority's Facilities and Equipments, must be used.
  1. Identification Information
   A. Subscriber's name (name or corporate name)
   B. Subscriber's identification number (resident registration number or business license number)
   C. Other necessary information
  2. Basic Information for Issuance of Certificates
   A. Types of requested certificates
   B. Types of requests (new/renewal/reissuance, suspension/restoration or revocation)
   C. Other necessary information
  ③ If certification authorities authorize registration authorities to keep records in accordance with the provision of Clause 1, they must ensure that registration authorities have a cabinet or safe with a lock in a place for keeping records that has an access control system and is separated from the office area.
Article 27 (Management of Audit Records) Certification authorities must check if there is anything wrong with the following audit records.
  1. Records related to certification services
  2. Records generated by the certification system, the access control system, and the network security system
Article 28 (Management of Registration Authorities) If certification authorities authorize registration authorities to perform registration services, they must inspect the following at least once a year. However, they must make sure that all registration authorities are inspected at least once every two years.
  1. Identification of the Certificate Requester
  2. Acceptance and Registration of the Certificate Request
  3. Safe delivery of subscribers' registration information to certification authorities. However, if registration authorities keep records described in Subclauses 1 and 2 of Clause 1 of Article 25 through the representative in accordance with the provision of Clause 1 of Article 26. Certification authorities must inspect the former's record-keeping business.
  4. Management of Registration System
   A. Assignment of DN according to the certificate issuance policy
   B. Printing of the reference numbers and authorization code generated by certification authorities
   C. Security function including restricted access to the registration system
  5. Protection of personal information related to registration
  6. Services that certification authorities authorized in connection with other certification services
Article 29 (Test Run of Certification Practice) ① Certification authorities must conduct a test run prior to the initiation of certification services as determined by KISA, and submit the result of the test run to KISA.
  ② KISA must send its comments on the test result it received in accordance with the provision of Clause 1 to the Minister of the Ministry of Information and Communication and the head of the relevant certification authority.
  ③ If KISA concludes that certification authorities are capable of normal operations on the basis of the test run, it will issue a certificate necessary for performing certification services.
Article 30 (Correct Provision of Information and Public Notification) ① If certification authorities request the following information from KISA, they must state correct information and facts in the request form.
  1. Request for issuance of a certificate
  2. Request for suspension and revocation of a certificate
  3. Request for restoration of a certificate
  ② Certification authorities must immediately notify the following information that may affect the reliability or validity of a certificate so that anyone can see it at all times.
  1. Designation of certification authorities
  2. Suspension, cessation or abolition of certification authorities' certification services
  3. Cancelation of the designation of certification authorities
  4. Transfer, acquisition or merger of certification authorities
  5. Information on the certificate
   A. subscriber's certificate
   B. List of suspension and revocation of subscribers' certificates 
  6. Other information related to certification practice

Supplementary Provisions

① (Effective Date) This guideline will go into effect as of the date of notification.
② (Interim Measures) The regulation concerning the ise of the security module as specified in Clause 1 of Article 11 will go into effect on November 15, 2004 despite the previous regulation.
③ (Interim Measures concerning Remote Storage Facilities) Among the standards concerning remote storage facilities as specified in Clause 3 of Article 12, Article 19 and Clause 4 of Article 25, matters concerning the distance of more than 10km will go into effect as of November 15, 2003.
④ (Interim Measures for Storage of the Subscriber's Registration Documents) With respect to the registration documents of those subscribers that registration authorities identified prior to this notification in their custody, they will be regarded as being kept in accordance with Article 26 of this notification.