Home  /  Information Technology Act  /  Section 40

Section 40: Generating key pair

Information Technology Act • Official Statutory Text & Practice Guide

Statutory Regulation
Legal Standard
Competent Court / Tribunal
Act 2000
Section 39 All 90 Sections of Information Technology Act Section 41

Legal Commentary & Landmark Judgments: Section 40

Section 40 governs the generation of key pairs by subscribers, establishing the statutory rule that in generating a digital signature key pair, the subscriber must generate the private key and public key by applying the prescribed security procedure.

  • Subscriber's Exclusive Duty of Key Generation: Imposes the legal obligation directly on the subscriber to generate their private key and corresponding public key using secure software and hardware.
  • Application of Notified Security Procedures: Mandates that key pair generation must comply with cryptographic standards and algorithms notified by the Central Government and Controller.
  • Cryptographic Correspondence Requirement: Requires that the generated public key must mathematically correspond to and verify signatures created by the private key.
Key Landmark Precedents:
  • State (NCT of Delhi) v. Navjot Sandhu (2005) 11 SCC 600: Supreme Court highlighted the critical evidentiary importance of cryptographic key generation and algorithmic integrity in digital forensics.
  • Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) 7 SCC 1: Supreme Court emphasized that statutory electronic procedures ensure digital integrity from the moment of creation through judicial production.
  • Anvar P.V. v. P.K. Basheer (2014) 10 SCC 473: Supreme Court reaffirmed that electronic records and signatures must comply with statutory technical safeguards to be legally unimpeachable.
Courtroom Practice & Strategic Litigation Guidance:

In cyber forensics litigation, establish that key generation occurred on a certified Hardware Security Module (HSM) or secure cryptoprocessor under Section 40, defeating allegations that the private key was intercepted or generated by unauthorized third parties.

Section 39 All 90 Sections of Information Technology Act Section 41