Circular Letter No. 3.134

CIRCULAR LETTER N. 003134 ------------------------ Discloses the procedures and technical standards for the use of digital signature in exchange contracts. Having regard to the provisions of Circular 3.234, of 15 April 2004, we inform that the agents authorized or accredited to operate in exchange, which make use of digital signature in exchange contracts, must adopt the following procedures: I - the digital certificates used in the signature of exchange contracts must be issued by Certification Authorities within the scope of the Brazilian Public Key Infrastructure - ICP-Brasil, established by Provisional Measure MP 2.200-2, of 24 August 2001, and may be of type A1, A2, A3 or A4, at the discretion of the contracting party authorized or accredited to operate in exchange, with asymmetric keys of at least 1024 bits; II - the text of the exchange contract must be stored exclusively in ASCII code (text format) and must reflect the content of the contract registered in Sisbacen, including its numbering. 2. The following technical standards must be observed by the contracting party authorized or accredited to operate in exchange: I - the format of the file containing the digitally signed exchange contract must adopt the Public-Key Cryptography Standard No. 7 (PKCS#7), version 1.5, as detailed in the "Request for Comments" (RFC) 2315, of the Internet Engineering Task Force - IETF, with the "ContentType" structure equal to "SignedData" and with the content of the exchange contract present in the "content" field of the "contentInfo" structure; II - for generation of the "digest" (document summary) the SHA-1 "hashing" algorithm (RFC 3174) must be used; III - in the digital signature the RSA asymmetric algorithm must be used, with use of the respective private keys of the parties for encryption of the "digest" of the document, in the PKCS#1 standard (RFC 2313); IV - each signature must be executed considering the "signingTime" attribute in the "authenticatedAttributes" field of the "SignerInfo" structure, reflecting the date-time of its effectuation, and all signatures thus obtained must be at the same level in the PKCS#7 structure, by repetition of the "SignerInfo" field of the "SignedData" structure, as many times as the number of digital signatures affixed. The date-time of effectuation must be controlled by the contracting party; V - the resulting PKCS#7 package, containing the exchange contract, the digital signatures generated and the respective digital certificates used, must be stored in clear, as defined in item I, for the term that the exchange regulations determine, with the storage of the digital certificates of the Certification Authorities participating in the trust chain being optional, as well as of the respective Certificate Revocation Lists (CRLs); VI - for the purpose of presentation to the Central Bank of Brazil, when requested, the contracting party must keep a clear copy of the PKCS#7 package, without enveloping for encryption, as
described in item V above; VII - the contracting party that has the need to encrypt the data for additional security in transmission may, for such, make use of any standard. Brasília, 27 April 2004. Department of Information Technology Fernando de Abreu Faria Head