Asymmetric Cryptography: How Public Keys Secure the Digital World

The modern legal system increasingly operates in a world where documents are created, signed, transmitted, and stored without ever taking physical form. Contracts are accepted through emails, government documents are digitally signed, banking transactions are authenticated electronically, and evidence that once existed only on paper may now consist of messages, server logs, CCTV footage, cloud records, or data stored on a smartphone.

This digital transformation creates a fundamental legal question: how can the law establish trust in a record that exists only in electronic form?

One of the technological answers is asymmetric cryptography, also known as public-key cryptography. Although it is fundamentally a technical concept, its importance extends directly into law because it provides the infrastructure behind digital signatures, electronic authentication, data integrity, and secure digital transactions.

In India, this relationship between technology and law is particularly visible in the Information Technology Act, 2000, and in the evidentiary framework now contained in the Bharatiya Sakshya Adhiniyam, 2023 (BSA).

Understanding Asymmetric Cryptography

Asymmetric cryptography operates through a pair of mathematically related keys: a public key and a private key. The public key may be made available to others, whereas the private key is intended to remain under the exclusive control of its holder.

The Information Technology Act expressly recognises this technology. Section 3 provides that authentication of an electronic record through a digital signature is carried out using an asymmetric cryptosystem and a hash function. The public key can then be used to verify the electronic record, while the corresponding private and public keys form a functioning key pair.¹

The use of a hash function is significant because it creates a digital representation of the electronic record. If the record is altered after signing, the resulting hash will no longer correspond to the original data. In this way, asymmetric cryptography contributes not only to authentication but also to the integrity of electronic information.

The technology therefore addresses a problem that is familiar to lawyers even outside the digital sphere: how can we establish that a document is genuine and has not been tampered with? Technology alone does not determine whether a digital signature has legal effect. That requires legislation.

Section 5 of the Information Technology Act gives legal recognition to electronic signatures where the law requires information or a document to be authenticated by a signature, subject to the manner prescribed by the Central Government.²

Section 3A further broadens the framework by recognising electronic signatures or authentication techniques that satisfy specified reliability requirements. Among other things, the signature creation or authentication data must be linked to the signatory, remain under the signatory's control at the time of signing, and make subsequent alterations detectable.³ This is where the connection between cryptography and law becomes particularly

interesting. The technology establishes a mechanism for authentication, while the statute determines when that mechanism receives legal recognition.

The Importance of the Private Key

A public key may be openly distributed, but the security of the system ultimately depends upon the protection of the private key.

The Information Technology Act therefore places responsibilities upon the subscriber. Section 42 requires the subscriber to exercise reasonable care to retain control over the private key corresponding to the public key in the Digital Signature Certificate and to report compromise of the private key to the Certifying Authority without delay. The Act also deals with acceptance and control of Digital Signature Certificates under Sections 41 and 42.⁴

This has an obvious legal consequence. A dispute involving a digital signature may not end with the question, "Was the document digitally signed?" A court may also need to consider whether the relevant key was under the subscriber's control, whether it was compromised, and what circumstances surrounded the authentication.

The law therefore has to look beyond the cryptographic result and consider the conduct and circumstances surrounding the use of the technology.

E-Contracts and Section 10A

The significance of electronic authentication is not limited to signatures.

Modern commercial transactions routinely take place through emails, electronic platforms, online portals, and automated systems. Recognising this reality, Section 10A of the Information Technology Act provides that a contract should not be treated as unenforceable merely because proposals, acceptances, or other elements of its formation were expressed electronically.⁵

The Supreme Court considered the legal effect of electronic communications in Trimex International FZE Ltd. v. Vedanta Aluminium Ltd., (2010) 3 SCC 1. The case arose from commercial negotiations conducted through electronic communications, and the Court treated the exchanged communications as relevant to establishing the parties' agreement.⁶

The importance of such decisions lies in the broader principle they illustrate: the absence of a traditional paper document does not by itself prevent a legally enforceable agreement from coming into existence.

For lawyers, however, this also creates another question. If the existence of a contract depends upon emails or electronic records, how are those records to be proved in court?

That brings us to electronic evidence.

Electronic Evidence: From Section 65B to Section 63 of the BSA

For many years, the principal provision governing electronic evidence was Section 65B of the Indian Evidence Act, 1872.

In Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473, the Supreme Court held that secondary electronic evidence had to satisfy the statutory requirements of Section 65B. The Court emphasised the importance of establishing the source and authenticity of electronic records and rejected the idea that such evidence could simply bypass the special statutory procedure.⁷

The position was subsequently considered by a larger Bench in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1. The Supreme Court reaffirmed that the certificate requirement under Section 65B was mandatory for secondary electronic evidence, while also explaining the distinction between an original electronic record and a computer output.⁸

The statutory framework has since changed.

The Bharatiya Sakshya Adhiniyam, 2023, which came into force on 1 July 2024, replaced the Indian Evidence Act. It expressly recognises electronic and digital records as documents. Section 61 provides that an electronic or digital record cannot be denied legal effect merely because it is electronic or digital, subject to Section 63. Section 63 deals with the admissibility of electronic records and prescribes conditions for computer outputs as well as a certificate requirement.⁹

The BSA goes further in certain respects. Section 63(4) requires a certificate accompanying the electronic record, while the Schedule requires, among other things, information concerning the electronic record and its hash value. The statutory framework therefore gives the idea of cryptographic integrity a much more visible place within the evidentiary process.¹⁰

What Does a Hash Value Have to Do With Evidence?

A hash value can be understood, in simplified terms, as a digital fingerprint of electronic data. Even a small alteration to the underlying record can result in a different hash.

This becomes particularly relevant when the authenticity of electronic evidence is disputed.

A WhatsApp conversation, CCTV recording, email, or digital document can be copied many times. The legal issue is not simply whether a copy exists, but whether the material presented before the court accurately represents the relevant electronic record.

The Supreme Court's 2026 decision in Pune Bar Association v. Union of India, W.P. (C) No. 599 of 2026, directly considered the certificate requirements under Section 63(4) of the BSA. The Court observed that the requirement to disclose the hash value has a rational connection with ensuring the authenticity and integrity of electronic evidence. It also described expert certification as providing an additional layer of authenticity for secondary electronic evidence. The Court did not, however, conclusively decide the separate question of whether the expert signing Part B of the certificate must necessarily be a person notified under Section 79A of the IT Act, leaving that issue open.¹¹

This decision is particularly significant because it demonstrates how developments in technology, including the growing possibility of manipulation through artificial intelligence and deepfakes, are influencing contemporary evidence law.

Digital Signatures and Presumptions Under the BSA

The BSA also contains provisions specifically dealing with electronic signatures.

Section 66 provides rules concerning proof of an electronic signature, while Section 73 permits the court to seek verification of a digital signature through the relevant Digital Signature Certificate and public key.¹²

The Act also creates specific presumptions concerning electronic agreements and secure electronic records. Section 85 provides that the court shall presume that an electronic agreement bearing the electronic or digital signatures of the parties was concluded through those signatures. Sections 86 and 87 contain further presumptions concerning secure electronic records, secure electronic signatures, and Electronic Signature Certificates.¹³

These provisions illustrate an important point: the legal system is not merely permitting electronic documents to exist. It is constructing rules about when courts may trust them.

The Evidentiary Value of Technology Is Not Absolute

It would nevertheless be misleading to suggest that a digital signature or certificate automatically settles every dispute concerning an electronic record.

Admissibility and evidentiary weight are different questions. A record may satisfy a statutory requirement for admission and still be challenged on grounds relating to authenticity, authorship, reliability, or the circumstances in which it was created and preserved.

This distinction is increasingly important as digital evidence becomes more complex. A screenshot may be easy to create. An email account may be compromised. A private key may be stolen. Audio or video may be manipulated. Artificial intelligence can make altered digital content increasingly difficult to identify through visual inspection alone.

The legal system therefore cannot rely upon technology in isolation. Cryptographic safeguards, statutory requirements, chain of custody, forensic examination, and judicial scrutiny operate together.

The BSA itself recognises the role of specialised expertise. Section 39(2) treats the opinion of an Examiner of Electronic Evidence referred to in Section 79A of the Information Technology Act as relevant where a court has to form an opinion concerning information stored or transmitted digitally.¹⁴

Asymmetric cryptography may appear, at first glance, to belong entirely to the world of computer science. In reality, it has become closely connected with some of the most basic legal concepts governing modern transactions and evidence.

The public key and private key system provides the technological foundation for authentication. The Information Technology Act gives legal recognition to electronic signatures and electronic contracts. The Bharatiya Sakshya

Adhiniyam determines how electronic records are proved and introduces more detailed requirements concerning their authenticity and integrity. Judicial decisions have then shaped how these provisions operate in actual disputes.

The broader lesson is that digital trust is no longer purely a technological problem. It is a legal problem as well.

As courts encounter increasingly sophisticated electronic evidence, the challenge will be to maintain a balance between technological innovation and evidentiary reliability. For lawyers, understanding concepts such as asymmetric cryptography, hashing, digital signatures, and electronic authentication is therefore becoming part of understanding the law itself.

The future of evidence may be digital, but the fundamental legal question remains the same: can we establish, with sufficient reliability, what happened and who can be held responsible for it?

Authorities and References

1. Information Technology Act, 2000, § 3.

2. Information Technology Act, 2000, § 5.

3. Information Technology Act, 2000, § 3A.

4. Information Technology Act, 2000, §§ 41–42.

5. Information Technology Act, 2000, § 10A.

6. Trimex International FZE Ltd. v. Vedanta Aluminium Ltd., (2010) 3 SCC 1.

7. Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473.

8. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1.

9. Bharatiya Sakshya Adhiniyam, 2023, §§ 61–63.

10. Bharatiya Sakshya Adhiniyam, 2023, Schedule to § 63(4).

11. Pune Bar Association v. Union of India, W.P. (C) No. 599 of 2026, order dated 22 May 2026.

12. Bharatiya Sakshya Adhiniyam, 2023, §§ 66, 73.

13. Bharatiya Sakshya Adhiniyam, 2023, §§ 85–87.

14. Bharatiya Sakshya Adhiniyam, 2023, § 39(2); Information Technology Act, 2000, § 79A.