"(b) 'Asymmetrically encrypted electronic record' means a record created, stored, generated, received, or communicated by electronic means.

(c) Other definitions relating to electronic records and communications are in §931 of this title.".

"or any electronic record".

"; or

(8) While acting as a certification authority, issues a certificate with the intention that the certificate will be relied upon by a third party to verify a digital signature issued to a subscriber of the certification authority, and fails to make available to the subscriber or to a third party relying on the certificate (i) the certification authority's certification practice statement, if one is applicable, and (ii) a statement that identifies the certification authority as a certification authority and that contains the public key corresponding to the private key issued to the subscriber by the certification authority.".

"; or

(4) Uses a signature device without authorization and with the intent to deceive or mislead another person into believing that the person rightfully owns or is authorized to use the device.".

"(18) 'Asymmetric cryptosystem' means a computer-based system capable of generating and using a key pair consisting of a private key for creating a digital signature and a public key to verify the digital signature.

(19) 'Certificate' means a record that at a minimum: (i) identifies the certification authority issuing it; (ii) names or otherwise identifies its subscriber, or a device or electronic agent under the control of the subscriber; (iii) contains a public key that corresponds to a private key under the control of the subscriber; (iv) specifies its operational period; and (v) is digitally signed by the certification authority issuing it.

(20) 'Certification authority' means a person who authorizes and causes the issuance of a certificate.

(21) 'Certification practice statement' means a statement published by a certification authority that specifies the policies or practices that the certification authority employs in issuing, managing, suspending, and revoking certificates and in providing access to them.

(22) 'Digital signature' means a type of electronic signature created by transforming an electronic record using a message digest function and by encrypting the resulting transformation with an asymmetric cryptosystem using the signer’s private key such that any person having the initial untransformed electronic record, the encrypted transformation, and the signer’s corresponding public key can accurately determine whether the transformation was created using the private key that corresponds to the signer’s public key and whether the initial electronic record has been altered since the transformation was made. A digital signature is a security procedure.

(23) 'Electronic' includes electrical, digital, magnetic, optical, electromagnetic, or any other form of technology that entails capabilities similar to these technologies.

(24) 'Electronic record' means a record created, stored, generated, received, or communicated by electronic means for use in an information system or for transmission from one information system to another. Electronic record includes computer-generated data records created for internal record keeping purposes.

(25) 'Electronic signature' means a signature in electronic form, attached to or logically associated with an electronic record.

(26) 'Key pair' means, in an asymmetric cryptosystem, two mathematically related keys, referred to as a private key and a public key. The private key can encrypt a message which only the public key can decrypt, and, even knowing the public key, it is computationally infeasible to discover the private key.

(27) 'Private key' means the key of a key pair used to create a digital signature.

(28) 'Public key' means the key of a key pair used to verify a digital signature.

(29) 'Message digest function' means an algorithm that maps or translates the sequence of bits comprising an electronic record into another, generally smaller, set of bits (the message digest), without requiring the use of any secret information such as a key, such that an electronic record yields the same message digest every time the algorithm is executed using the electronic record as input and it is computationally infeasible that any two electronic records can be found or deliberately generated that would produce the same message digest using the algorithm unless the two records are precisely identical.

(30) 'Record' means information that is inscribed, stored, or otherwise fixed on a tangible medium or that is stored in an electronic or other medium and is retrievable in readable form. 'Record' includes traditional paper documents such as letters and contracts, as well as e-mail messages, formatted electronic data interchange (EDI) messages, photographs printed on paper or stored as computer records, and sound recordings stored on tape or as computer files.

(31) 'Security procedure' means a methodology or procedure, established by law or regulation, or established by agreement, or knowingly adopted by each party, used for the purpose of (i) verifying that an electronic signature or record is that of a specific person or (ii) detecting changes or errors in the communication, content, or storage of an electronic record since a specific point in time. A security procedure may require the use of algorithms or codes, identifying words or numbers, encryption, answer back or acknowledgment procedures, or similar security devices that are reasonable under the circumstances.

(32) 'Signature device' means unique information, such as codes, algorithms, letters, numbers, private keys, or personal identification numbers (PINs), or a uniquely configured physical device, that is required, alone or in conjunction with other information or devices, to create an electronic signature attributable to a specific person.

(33) 'Signed' or 'signature' includes any symbol executed or adopted, or any security procedure employed or adopted, using electronic means or otherwise, by or on behalf of a person with intent to authenticate a record.

(34) 'Valid certificate' means a certificate that a certification authority has issued, and that has been accepted by the subscriber listed in the certificate.

(33) 'Verify a digital signature' means to use the public key listed in a valid certificate, along with the appropriate message digest function and asymmetric cryptosystem, to evaluate a digitally signed electronic record, such that the result of the process concludes that the digital signature was created using the private key corresponding to the public key listed in the certificate and that the electronic record has not been altered since its digital signature was created.".