Empowering Secure Digital Experiences for Malaysia

PKI & Digital Signature for KPKT eSPA

A secure, compliant and efficient digital signing framework under the Digital Signature Act 1997, enabling KPKT’s eSPA ecosystem with trusted digital certificates issued by Pos Digicert.

Digital certificates, eKYC, and signing flows are integrated to support developers, buyers, witnesses, landowners and officers within eSPA/HIMS.

Public Key Infrastructure (PKI)

PKI provides the technical and trust foundation that enables secure digital signatures for eSPA. It ensures that every signature is bound to a verified identity and that documents are protected against manipulation.

PKI Components

  • Customer / User – Individuals such as buyers, witnesses, landowners and officers.
  • Registration Authority (RA) – Validates identity and registration information.
  • Certification Authority (CA) – Pos Digicert issues and manages digital certificates.
  • Signatures Repository – Stores certificates and related information.
  • Relying Parties / Systems – eSPA, HIMS and other systems that rely on digital signatures.
Identity Verification Digital Integrity Non-repudiation Secure Transactions

Electronic Know Your Customer (eKYC)

eKYC is used to verify the identity of applicants before a digital certificate is issued. It ensures that certificates are only granted to legitimate individuals.

What is iDsaya?

  • A mobile app designed to deliver a secure digital identity.
  • Enables passwordless authentication and digital signing.
  • Manages digital certificate PIN and TOTP used during the signing process.

What is eKYC?

  • “Electronic Know Your Customer”.
  • Uses biometric authentication and facial recognition to verify user identity and documents quickly and securely.
  • Includes ID document verification and live facial recognition to prevent identity fraud.

Process Flows

The following diagrams summarise the flows extracted from the PKI & Digital Signature documentation for KPKT eSPA, covering eKYC, individual registration, developer quota management and the digital signing journey.

eKYC Process Applicant Journey
1
Download eKYC App
Applicant downloads the eKYC app (iDsaya) on their mobile phone.
2
Register Account
User creates an account in the app.
3
Capture MyKad/Passport
Take a picture of the front of MyKad or Passport.
4
Live Facial Recognition
Front-facing facial scan to verify liveness and match ID.
5
ID Verification
System verifies identity and document authenticity.
6
Result Notification
If rejected, applicant receives notification to redo eKYC; if approved, proceeds to certificate activation.
Individual Registration & Certificate Activation System & Individual
1
Role Registration
Developer/HIMS registers roles such as Buyer, Witness, Landowner, Officer in the system.
2
eKYC Email
System sends eKYC email invitation to the individual.
3
Complete eKYC
Individual completes the eKYC process via iDsaya.
4
Set PIN
User sets a Digital Certificate PIN within the app.
5
Activate Certificate
Certificate is activated for either 1-month or 1-year validity.
6
Signing Email
System sends an email for digital signing that will require the PIN & TOTP via iDsaya.
7
Sign Agreement
Individual signs the purchase agreement in HIMS using the activated certificate.
Developer Digital Certificate Quota & Purchasing Process Developer & Pos Digicert
1
Register Kod Pemaju
Developer registers their “Kod Pemaju” in HIMS.
2
Request Quota
Developer requests digital certificate quota (units & duration).
3
Quotation
Pos Digicert Retail Team provides quotation to developer.
4
PO / Proof of Payment
Developer submits Purchase Order or proof of payment.
5
Invoice & DO
Finance issues invoice and Delivery Order to developer.
6
Update Quota
Pos Digicert Retail Team updates quota in HIMS and notifies developer & finance (with screenshot).
7
Check Quota Balance
Developer logs into HIMS to check quota balance.
Digital Signing Flow in HIMS / eSPA Digital Signature Application
1
Signing Email
System sends email to the individual to sign the purchase agreement.
2
Authentication
User uses Digital Certificate PIN and TOTP via iDsaya to authenticate.
3
Digital Signature
System applies a digital signature based on the issued digital certificate.
4
Document Protection
Signed document becomes tamper-evident and protected under DSA 1997.
5
Audit Trail
All signing actions are recorded for verification and audit purposes.

Benefits & Challenges of Digital Certificates

Benefits

High Security

  • Ensures the authenticity of the signer’s identity.
  • Digital certificates provide strong cryptographic protection.

Identity Verification & Audit Record

  • eKYC links the digital certificate to a verified individual.
  • Every signing action is recorded for audit and compliance.

Effective & Efficient

  • Speeds up the signing of agreements and approvals.
  • Supports electronic data collection and reduces manual paperwork.
  • Helps reduce operational costs for all stakeholders.

Challenges

  • Implementation Cost – Initial setup, integration and certificate costs.
  • User Acceptance – Requires adoption and change from manual to digital processes.
  • Awareness – Continuous education needed on digital signatures and their legal effect.
Security & Data Integrity Security & Compliance Process Efficiency

Despite these challenges, digital certificates significantly enhance trust, security and efficiency in document handling within eSPA.

Digital Transformation at KPKT

The implementation of PKI and digital certificates within eSPA forms part of KPKT’s broader digital transformation, moving from manual and paper-based processes to secure, end-to-end digital workflows.

  • Replaces physical signatures with legally recognised digital signatures.
  • Streamlines housing-related approvals and agreements.
  • Improves transparency and traceability in transactions.

Powered by Pos Digicert

Pos Digicert underpins this transformation as the trusted Certification Authority:

  • Issues and manages digital certificates for eSPA/HIMS users.
  • Provides secure infrastructure for digital signing and certificate lifecycle management.
  • Supports compliance with Malaysian cryptographic and digital identity regulations.

Contact Pos Digicert

For enquiries on digital certificates, eKYC integration, or digital signing for KPKT eSPA, please contact Pos Digicert.