National electronic certification infrastructure

In Venezuela, progressive efforts have been made in the information security area to consolidate online government and e-commerce in our country. To be noted in that connection is the establishment of a legal framework governing data messages and electronic signatures, and of the Superintendency of Electronic Certification Services.

Decree-Law No. 1.024 of February 10, 2001, on data messages and electronic signatures, establishes the Superintendency of Electronic Certification Services (SUSCERTE) .

When the new People’s Ministry for Telecommunications and Information Technology was established, SUSCERTE was made subordinate to it.

Among the Superintendency’s strategic objectives is to consolidate the institutions of the National Security Information System (SNSI) and the National Electronic Certification System (SNCE).

The National Electronic Certification Infrastructure is a series of servers, software, cryptographic devices, policies and procedures made available to and utilized exclusively by accredited certification service providers to generate, store, and publish electronic certificates and information, and for consultation on the status of the effectiveness and validity of such electronic certificates. The National Electronic Certification Infrastructure model comprises:

1. The Root Certification Authority of the Venezuelan state, operated by the Superintendency of Electronic Certification Services (SUSCERTE);

2. The certification authorities of accredited certification service providers;

3. The registration authorities of accredited certification service providers;

4. Certification authorities and/or registration authorities created for special cases of projects of national interest;

5. Signatories or holders of electronic certificates issued by accredited certification service providers and certification authorities and/or registration authorities created for special cases of projects of national interest;

6. Users of such certificates, that is, signatories.

The Root Certification Authority of the Venezuelan state is the highest-ranking authority of the National Electronic Certification Infrastructure, operated and administered by the Superintendency of Electronic Certification Services, and has responsibility for issuing, renewing, revoking, and suspending electronic certificates of certification authorities of accredited certification service providers; certification authorities for special cases of projects of national interest; and the Root Certification Authority itself.

The Infrastructure’s second tier is composed of the principal certification authorities of accredited certification service providers which, in turn, may issue electronic certificates to certification authorities subordinate to the principal certification authority. The latter constitute the third tier of the hierarchy.

It should be noted that in no case may subordinate authorities issue electronic certificates to other certification authorities.

Figure No. 1 contains a diagram of the National Electronic Certification Infrastructure.

Figure No. 1.    National Electronic Certification Infrastructure

SUSCERTE is authorized to create certification authorities and/or registration authorities for special cases of projects of national interest, and to issue electronic certificates for such certification authorities.  This is done by means of an administrative directive for special cases of projects of national interest.

One notable technical aspect is that the entire system was developed using freeware, which ensures technological sovereignty over its development.  This is also in keeping with Decree 3.390 on the use of freeware in Venezuelan state institutions.  Said decree provides that the national government will primarily utilize in its systems, projects, and computer services freeware developed using open standards.