Approval of mandatory requirements for the Trust List
{With changes made pursuant to the Resolution of the Cabinet of Ministers
Nš 1068 dated 11.12.2019}
Pursuant to the second part of Article 35 of the Law of Ukraine “On Electronic Trust Services”, the Cabinet of Ministers of Ukraine resolves:
1. To approve the mandatory requirements for the Trust List attached.
2. This resolution shall enter into force simultaneously with the Law of Ukraine “On Electronic Trust Services”
MANDATORY REQUIREMENTS
for the Trust List
1. These mandatory requirements are aimed at ensuring the functioning of the Trust List, the updating of its content, its technical support and support for the exchange of information between its components in order to ensure trust between the parties in the field of electronic trust services.
2. The terms used in these mandatory requirements have the following meanings:
The administrator of the Trust List and the operator of the Trust List scheme is the state enterprise “DIIA”, which comes under the management of the Ministry of Finance.
{Paragraph 2, Point 2, as amended pursuant to the Resolution of the Cabinet of Ministers Nš 1068 of 11/12/2019}
Trust List Operator – a central certification authority that ensures implementation, operation and up-to-date support of the Trust List, which is posted on its own official website.
Electronic seal of the central certification authority – a qualified electronic seal created using a qualified public key certificate of the central certification authority, specially designed to certify information on the Trust List.
Qualified electronic trust services – electronic trust services provided by a qualified provider of electronic trust services pursuant to the Law of Ukraine “On Electronic Trust Services”
The Trust List Scheme – a structure and format of XML metalanguage markup document fields.
Other terms are used in the meaning given in the Law of Ukraine “On Electronic Trust Services”.
3. The technical implementation of the Trust List involves the creation and publication on the official website of the Central Certification Authority of two files for the following purpose:
1) A Trust List file that contains information regarding qualified providers of electronic trust services (hereinafter “qualified provider”) and their qualified electronic trust services, the provision of which involves the use of electronic signature algorithms defined by DSTU ETSI TS 119 312:2015 “Electronic signatures and infrastructure (ESI). Cryptographic kits “(ETSI TS 119 312:2014, IDT).
2) A Trust List file that contains information about qualified providers and their qualified electronic trust services, the provision of which involves the use of electronic signature algorithms defined by DSTU 4145-2002 “Information Technologies. Cryptographic information protection. Digital signature based on elliptical curves. Creation and verification”.
The structure and procedure for publishing the Trust List files are determined by DSTU ETSI TS 119 612:2016 “Electronic signatures and infrastructures. Trust lists” (ETSI TS 119 612:2016, IDT).
In order to ensure the interoperability and technological neutrality of national technical solutions, the operator of the Trust List scheme shall compile and publish the national features of the compiling of the Trust List for the file specified in Sub-Point 2 of this Point on its website.
4. The format of the Trust List is defined by the XML markup metalanguage with the use of semantic notations that allow automated processing. The Trust List can be interpreted in other formats, provided that the information in them is identical to the information in the Trust List in XML format.
5. Information is entered into the Trust List in Ukrainian using Cyrillic and in British English using Latin script. Proper names in the Ukrainian language are transliterated into Latin script in accordance with the requirements of the resolution of the Cabinet of Ministers of Ukraine of 27 January 2010. Nš 55 “On Streamlining the Transliteration of the Ukrainian Alphabet into Latin Script” (Official Gazette of Ukraine, 2010, Nš 5, Art. 202).
6. The inclusion of a provider of electronic trust services in the Trust List is carried out on a voluntary basis.
7. The structure of the Trust List contains the following information:
1) A mark (tag) of the Trust List, which allows electronic search engines to identify the Trust List.
2) Regarding the Trust List and the Trust List scheme:
the version of the Trust List scheme
the serial number of the Trust List
Information about the operator of the Trust List scheme: name, location, URL of the official website and e-mail address
information on the regulations according to which the Trust List is maintained
the date of publication of the Trust List
the date of the next publication of the Trust List
3) Regarding qualified providers:
location, contact information, name and semantic name of an individual entrepreneur or legal entity of a qualified provider in the format:
- for legal entities: NTRUA - “record number in the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Associations”
- for individual entrepreneurs: PNOUA - "unique entry number in the Unified State Demographic Register” or TINUA – "registration number of the taxpayer's account card”; or PASUA – "passport number of a Ukrainian citizen in the form of a booklet" (for individual entrepreneurs who due to their religious beliefs have declined to accept a registration number of a taxpayer's account card and have notified the relevant supervisory authority and have the appropriate mark in their passport)
- for individual entrepreneurs and non-resident legal entities, the information held is determined according to the rules defined by DSTU ETSI TS 119 612:2016 “Electronic signatures and infrastructures Trust lists” (ETSI TS 119 612:2016, IDT)
qualified electronic trust services provided by a qualified provider, including the name of the services, a set of identifiers that ensure their uniqueness, definition of type, status, etc., as well as the date and time of the last change of status
history of changes in the status of qualified electronic trust services of a qualified provider (if any)
4) on the electronic seal of the central certification authority
8. The qualified public key electronic seal certificate of the central certification authority is certified using the central certification authority‘s self-signed public key certificate.
The qualified public key electronic seal certificate of the central certification authority is valid for two years.
9. The Trust List shall be published in a secure mode with the obligatory addition of the central certification authority‘s electronic seal in a form suitable for automated processing, ensuring the preservation and protection of the data contained therein.
The information contained in the Trust List is open, up-to-date and updated at least once every three months or in the event of changes, and round-the-clock access is provided through public telecommunications networks.
10. Qualified providers are responsible for the accuracy of the information provided to the Central Certification Authority for inclusion in the Trust List.