Digital CA’s: Not chartered accountants

With e-commerce transactions all set to boom, the next imperative is security. The issues that need to be addressed include authentication, integrity, confidentiality, non-repudiability and auditing. Authentication deals with establishing credibility of the transacting partner. Integrity and confidentiality deals with keeping data transferred between partners intact and private. Non-repudiability deals with establishing whether a party denying a transaction is true or not. Auditing keeps track of transaction that take place.

Technology can to a great extent address integrity with the help of encryption but what about authentication? How can you be sure that the party you are dealing with is to be trusted? The answer is public key infrastructure (PKI). Using PKI, users can transact through the Internet securely. This is done using a public and a private cryptographic key pair that is obtained and shared through a trusted authority. This trusted authority is known as a certifying authority (CA). The CA issues a digital certificate that can identify an individual or an organization and directory services that can store and, when necessary, revoke the certificates.

Most CAs charge on a per-certificate or per-user basis. Since certificates are issued with a built-in expiration date (usually 6, 12 or 24 months), the model for recurring revenue is quite straightforward. This definitely means big business considering the volume of e-commerce in India. According to Gartner, currently the industry size is about US$ 1.1 bn globally.

Year	B2B	B2C	Total
1998 - 99	1,190	120	1,310
1999 - 00	4,000	500	4,500
2000 - 01	32,000	3,000	35,000
2001 - 02	132,000	18,000	150,000
2002 - 03	420,000	80,000	500,000
Source : NASSCOM, Rs m

With the Indian Government recognizing digital certificates as a form of authentication to identity, the race is on to capture the market. The licenses for certifying authorities are being issued by Central Certifying Authority (CCA). CCA is empanelling auditors, who will audit the processes and technology of the CAs. Once the auditors are empanelled the CCA will issue guidelines for the CAs. Those who confirm to the standards proposed by the guidelines will be issued licenses. Considering the responsibility on the CA the licensing the government will be cautious while issuing licenses and this will take its own time.

The companies that are willing to acquire CA licenses include Satyam Infoway, HFCL, HDFC Bank, ICICI Bank and Citibank. (The banks having their payments gateways will definitely have an upper hand). Satyam Infoway has tied up with Verisign, one of the global leaders in the area.

This is one area that the companies can bank on to keep their cash registers ringing. Once the government empanels the race will begin. Till then companies, in the build up to the final race, will consolidate on technology and processes.