Rescinded - Policy on Electronic Authorization and Authentication

This policy takes effect on July 15, 1996 and replaces the former version dated October 1, 1994.

1. Electronic authorization and authentication (EAA) is the electronic process that affixes proof of authorization to a transaction, contributes to the protection of data integrity and ensures that the authorizer can be identified. Together with appropriate management practices, this will result in accountability controls for the conduct of electronic business.
2. Sound management practice requires departments to establish and maintain adequate controls within their systems to ensure the completeness, accuracy, and authority of all business transactions. These controls are also essential to good management control and accountability.
3. With the advancement of technology, the availability of powerful electronic workstations and networks, and the requirement to make operations as efficient as possible, government administrative systems are moving towards seamless, on-line systems and a paperless environment, which the government encourages.
4. Manual controls are used in paper-based systems. For example, a signature has always been the most desirable form of evidence of authorization or confirmation or work performed. A signature clearly designates who is assuming responsibility for each control function and is suitable at all levels of responsibility.
5. These controls are an essential part of any system and ensure that all transactions are entered and processed accurately, and that information is properly authorized. In general, standards of accuracy and authority required for transaction data apply equally to financial, operational and administrative data.
6. In a paperless environment there must be an electronic alternative available to replace the function of the paper signature. Controls would ensure that the electronic signature is as unique to an individual as his or her own signature and that the integrity of that signature is maintained to ensure both the accountability and protection of the person assuming responsibility.
7. This policy aims to ensure that appropriate controls are in place to maintain the integrity of transactions and their related authorization throughout the process.
8. Another important aspect of paperless systems is that the delegation of authorities process could also be paperless. In such cases the delegation of authorities and their communication would be done electronically. Electronic delegation matrices that delineate the authority of each user would replace delegation charts. A combination of user identification codes, passwords, personal authorization numbers, special keys in personal access devices, verification of physical characteristics, etc., would replace signatures. Validation and authentication processes would replace specimen signature cards.
9. This policy aims to ensure that the integrity of the electronic delegation of authorities and authentication processes are maintained.
10. The Communications Security Establishment (CSE) is responsible for providing departments with endorsements or approvals of cryptography and key management processes for the protection of classified information, as well as for the protection of designated information. The CSE is the Government of Canada authority for approving encryption, digital signature algorithms, key management algorithms and key management systems used in electronic authorization and authentication processes. Departments may also request CSE guidance regarding the requirements for and the strength of non-cryptographic security features required for the implementation of EAA processes.
11. The Security Policy, Chapter 1-1 of the "Security" volume, Treasury Board Manual contains other central agencies' security responsibilities.

For the purposes of this policy:

Business transaction (opération commerciale)

is any event, condition, action or commitment, the result of which is the acquisition, disposition or use of assets or resources; the increase or reduction in a liability; the receipt or payment of funds; or the provision of services of which a client is charged. Business transactions occur commonly in, but are not limited to, such diverse areas as finance, administration, personnel, contracts, and program management. Business transactions may also include formal approvals or authorizations such as correspondence.

Electronic authorization (autorisation électronique)

is the process by which a digital signature is linked to an electronic business transactions to signify that a person with delegated authority has effectively authorized the further processing of that data and cannot credibly deny that s/he has done so.

Electronic authentication (authentification électronique)

is the process by which an electronic authorization is verified to ensure, before further processing, that the authorizer can be positively identified, that the integrity of the authorized data was preserved and that the data are original.

Confidentiality (confidentialité)

refers to information being made available or disclosed only to individuals, entities or processes authorized to see or use that information.

Data integrity (intégrité des données)

is the quality or condition of being accurate and complete and not altered or destroyed in an unauthorized manner.

Digital signature (signature numérique)

is the cryptographic transformation of data, which when added to a message, allows the recipient to verify the signer and whether the initial message has been altered or the signature forged since the transformation was made.

Encryption (chiffrage)

is the process by which plain text data are transformed to conceal their meaning or provide data integrity. Encryption is a reversible process effected by using a cryptographic algorithm and key.

Key management (gestion des clés)

is a process designed to ensure that the keys and keying material used in the authorization and authentication process are managed in accordance with a security policy. The process includes the generation, distribution, application, certification, storage, archiving and destruction of keys. A key is a sequence of symbols that controls the operation of encryption and decryption.

To ensure adequate control and protection of business transactions in electronic form through proper authorization and authentication.

It is government policy that electronic business transactions must be properly authorized, validated and safeguarded against loss, alteration, duplication, substitution or destruction.

1. This policy applies to all organizations considered to be departments within the meaning of Section 2 of the Financial Administration Act (FAA).
2. This policy applies to all electronic business systems where transactions are authorized electronically.
3. For systems under development, this policy is effective within two years of it's coming into force. Existing systems need not comply with this policy unless a new threat and risk assessment indicates a requirement for electronic authorization and authentication.
4. Existing systems using digital signatures should conform to this policy within the next two years.

1. The integrity of electronic business transactions must be maintained at all times.
2. A digital signature must be used to authorize electronic business transactions.
3. The method used to generate the digital signature must employ both special knowledge (e.g. password) and physical possession of an object (e.g., diskette, token or card etc.).
4. For every system where a digital signature is used, a risk and threat analysis will determine whether a physical object must be used. For existing systems and systems under development, departments are allowed a period of two years starting from the effective date of this policy to complete the risk and threat analysis and meet the requirements of the policy.
5. When physical objects such as diskettes, tokens or cards are used, departments must ensure that every object holder is informed of his or her responsibilities and restrictions regarding the use of the objects and agrees to them. Physical objects are to be used as personal access devices which link an object with only one individual.
6. Electronic authorizations of electronic business transactions must be authenticated.
7. The electronic authentication process must effectively and positively identify the authorizer, in such a way that he or she will not be able to credibly deny having authorized a transaction.
8. A complete audit trail of the electronic business transactions, including electronic authorization and authentication, must be maintained.
9. The integrity and confidentiality of the electronic authorization and authentication system and processes must be maintained at all times.
10. When required, the confidentiality of transactions will be ensured by encrypting part or all of the data or transaction.
11. Departments must perform a threat and risk assessment to evaluate the potential threats to the electronic business system as well as to the electronic authorization and authentication process and to determine the level of control required to minimize the risks, commensurate with costs.
12. Departments must establish policies and procedures that will ensure that an adequate level of control is maintained on all processes involving the electronic authorization and authentication of business data.
13. Departments must establish policies and procedures that will ensure that the distribution and communication of authorities and the delegation process itself, when in an electronic form, are protected by an approved digital signature and key management process. Encryption and key management processes for EAA must be endorsed or approved by CSE.

1. Departments will conduct internal audits of their compliance with this policy and the efficiency of its implementation.
2. The Treasury Board Secretariat will monitor compliance with this policy through internal audit reports.
3. In addition, the Treasury Board Secretariat will conduct, in consultation with departments, operational reviews to assess the effectiveness of the policy.

Departments are responsible for the effective and efficient implementation of this policy. Performance indicators should relate primarily to:

• effectiveness of the process of authorization and authentication for electronic business transactions;
• adequacy of threat and risk assessment reviews to periodically confirm that the level of control is appropriate; and,
• efficiency of documentation (e.g. policies, procedures, training material) and systems to ensure effective authorization and authentication of electronic transactions.

1. Enquiries about this policy should be directed to your departmental Security Officer at headquarters. For interpretation of this policy, departmental headquarters should contact:

   Financial and Contract Management Sector
   Financial and Information Management Branch
   Treasury Board Secretariat
   Ottawa, Ontario
   K1A 0R5
   Telephone: (613) 957-7233
   Facsimile: (613) 952-9613

2. For assessments, advice and guidance on the implementation of electronic authorization and authentication provisions involving encryption, digital signature algorithms, and key management systems, contract:

   ITS Client Services
   Communications Security Establishment
   P.O. Box 9703, Ottawa Postal Terminal
   Ottawa, Ontario
   K1G 3Z4
   Telephone: (613) 991-7532
   Facsimile: (613) 991-7411