E-Signature

As it was described within 5070 Electronic Signature Act; “e-signature” is the electronic data used for authentication which has a logical connection added to any electronic document; “"Electronic Certificate" is the electronic record linking signature with the signature verification data and its credentials; “Secure Electronic Signature" has the same legal effects as a handwritten signature and contains particular conditions specified in the Act; "Qualified Electronic Certificate" is the electronic certificate in order to create secure electronic signature which will provide the conditions prescribed by Act; "Signature Creation Data" which belongs to the owner of the signature, is the information, encryption and cryptographic keys used to create an unprecedented electronic signatures by the owner of the signature; "Signature Verification Data” is the passwords and all data such as cryptographic open keys used to verify the electronic signature.

5070 Electronic Signature Act provides a great opportunity to have legal effects to secure transactions in paper form to be carried out electronically. Thus, you can use the NES(Qualified Electronic Signature) and e-signature to save time, effort and money for your personal or corporate business by moving to electronic media. By purchasing NES, you can use e-signature for;

Since electronic signatures can be used equivalent to handwritten signatures, they are used to electronically qualify all official transactions. Electronic signatures ensure reliable, fast and cost-effective processing compare to handwritten signatures. In this context, electronic signature can be used in all available processes stated on Electronic Signature Act of 5070 including electronic communications, contracts, transactions with public institutions, banking operations, insurance operations, e-government, e-business and e-commerce applications.

Electronic Certificate Service Provider (CSP) is described within the law as “a private legal entities or public institutions providing services related to e-signature, electronic certificates and timestamp“. CSP takes the application to provide electronic certificates, evaluates, produces and delivers electronic certificates to the applicant under safe conditions. In addition, it provides certificate renewal and revocation services, certificate revocation status, data publishing services and time-stamping services.

By 5070 Electronic Signature Act and related regulations, CSP’s are obligated:

In order to be in operation, CSP should; use secure products and systems; conduct a reliable service; demonstrate satisfying requirements about taking all preventive measures for counterfeiting and falsification of certification.

By law, principles and procedures for the implementation of legal and technical aspects of the electronic signature and task of monitoring CSP activities given to BTK (ICTA) in Turkey. The Agency may inspect CSP s when it deems necessary. Once fulfilling the requirements of the law, legal persons or organizations may operate as CSP after BTK (ICTA) audit. For Government Organizations and Institutions a certification center has been established which is affiliated with BTK (ICTA). CSP s which were certified by BTK (ICTA) give certification services to remaining applicants who stays outside scope of government certification.

The validity of an electronic certificate has been restricted for security reasons. At the end of validity period, if the certificate owner wants to extend the usage of the certificate then they have to renew their certificate through methods defined by CSP. In general, Qualified Electronic Certificates are used for one (1), two (2) or three (3) year period of validity.

The Certificate which was created with CSP’s own signature creation data is called Root Certificate. Root Certificate enables the production of certificate for the applicant, also establishes a link between ECSP's corporate identity and signature creation data used to sign certificates. In accordance with the Electronic Signature Law 5070, "Regulation on the Principles and Procedures on the Implementation of Electronic Signature Law", published by BTK (ICTA), CSP should; publish certificate hash value of root certificate and hash algorithm over its web site; publish them over top rated newspapers; and give one copy of it to BTK within seven (7) days of its business activity.

Electronic Certificates contain primarily following information:

Qualified Electronic Certificates contain following information required by law:

Secure electronic signature creation tools (in accordance with 5070 Electronic Signature Law);

The secure electronic signature verification tool;

In case of losing its validity, certificate is revoked within its period of use. Below conditions require cancellation of certificate:

CSP creates a reliable and quickly accessible record when cancelling certificate which will allow third persons to accurately detect it. Instead of revoking, certificate is suspended if the origin of cancellation cannot be verified or cancellation reasons are met by end user or not. During suspension, certificate has a state which cannot be verified by third parties. For personal use, electronic certificates must be renewed in order to continue to be used at the end of its validity period. Certificate renewal is done at the end of its certificate where there is no change in certificate information. During certificate renewal process, pair of signature creation and signature verification data are renewable.

Legal basis related to implementation of electronic signature in Turkey are "5070 Electronic Signature Law", "Regulation on the Principles and Procedures on the Implementation of Electronic Signature Law" and "Communiqué on Processes and Technical Criteria Regarding Electronic Signatures" published by ICT.

By law, the legal consequences of an electronic certificate issued by the CSP located in a foreign country is determined by international agreements. In case of acceptance of an electronic certificates issued by a foreign CSP by Turkish CSP, these electronic certificates are considered qualified electronic certificate. Turkish CSP will also be reliable for any damages arising as a result of the usage of these electronic certificates.

Various client software are available to verify the electronic certificates and introduce them to computer systems. These applications can be custom developed software or some package programs that may also fulfill this function. Many email clients and web browsers already have ability to use electronic certificate.

Certificate Principles explain all related administrative, technical and legal requirements for; receipt of applications; certificate generation and management; certificate renewal and revocation. Also, determines responsibilities of CSP, certificate holder and third party applications. The Certification Practice Statement explains how to comply to the requirements specified in the Certificate Policies by CSP, certificate holder and third parties. CSP maintains the conditions of its Certificate Policies with business activities carried out in accordance with Certification Practice Statement.