Back
Delhi High Court Orders Decision on Advocate's Plea Against Differential FIPS Token Deadline
Introduction
The has directed the to decide a challenging the deadline imposed on private individuals and professionals to migrate from FIPS 140-2 digital signature tokens. The court, while not delving into the merits of the case, questioned the rationale behind allowing government organizations an additional three years for the same migration.
The Core Dispute
The petition was filed by , a practising lawyer who relies on a FIPS-validated USB cryptographic token for e-filings and various statutory, judicial, regulatory, and financial transactions. In , the second respondent—likely the —issued an advisory prescribing a mandatory cut-off of for private and commercial entities to obtain or renew Digital Signature Certificates on FIPS 140-2 tokens. Government organizations, however, were permitted to continue using such tokens until , subject to a .
Saraswat argued that the advisory itself acknowledged that no known security vulnerability arises from continued use of FIPS 140-2 modules. Despite this, private users were being forced to migrate three years earlier than government entities without any or . He also alleged that the differential treatment was imposed without consultation, regulatory impact assessment, or cost-benefit analysis. His detailed dated went unanswered for over eight weeks, prompting him to approach the court.
Single Judge's Direction
On , a single bench of Justice Dr. Swarana Kanta Sharma observed that the had not been decided. Noting the issues raised, the court directed the respondents to decide the within four weeks, granting liberty to the petitioner to file a fresh if aggrieved thereafter. The court did not examine the merits of the at that stage.
Division Bench Questions Rationale
Saraswat subsequently filed an appeal before a division bench comprising Chief Justice DK Upadhyaya and Justice Tejas Karia, alleging that the government had not complied with the single judge’s direction. During the hearing, the division bench sharply questioned the rationale for differentiating between private and government users.
“Every user of a digital signature should be at the same pedestal. The hardships to government employees using it should be the same. What is the rationale? What is the of these two categories?” the court remarked.
Without interfering with the single judge’s order, the division bench directed the respondents to consider and decide the by . The case has been disposed of, but the central issue of whether the differential deadline violates remains open for future adjudication.
Key Observations from the Bench
- The impugned advisory itself records that no known security vulnerability exists from continued use of FIPS 140-2 modules.
- Private users are compelled to migrate three years earlier than government organisations without or .
- The division bench remarked that every user of a digital signature should be on the same pedestal, questioning the justification for differential treatment.
Conclusion
While the court has not yet ruled on the constitutional validity of the advisory, the direction to decide the —coupled with the division bench’s pointed observations—signals judicial unease with the disparate treatment. The outcome of the and any subsequent challenge will determine whether the deadline for private users stands, or whether they will be granted the same extended glide-path as government organisations. The case remains a significant test of in the digital infrastructure domain.
