Transition to DSTU 7564:2014 "Kupyna": How to Prepare Corporate EDMS by 1 September 2026
A new qualified public key certificate has been successfully created at the trust service provider, but the corporate electronic document management system suddenly rejects the document because it cannot build a chain of trust. This situation occurs when the application software does not recognise the hashing algorithm identifier or uses outdated local certificate stores. A timely technical audit of cryptographic modules allows these compatibility issues to be identified before the transition deadline.
The Difference Between Hashing and Electronic Signature in the New Regulations
To correctly design changes in information systems, it is necessary to clearly separate the functions of cryptographic standards. DSTU 7564:2014 "Kupyna" defines the requirements specifically for the hash function. This standard replaces the outdated interstate standard GOST 34.311-95 in new operations of the electronic trust services infrastructure. The hash function is responsible for creating a unique digital fingerprint of a document, which is subsequently signed using a private key.
At the same time, the algorithm of the electronic signature itself remains unchanged — this is DSTU 4145-2002. Mixing these concepts or considering "Kupyna" as a new signature algorithm is a technical error. The modernisation concerns the mathematical apparatus for calculating the checksum before applying the signature. New provider certificates that use DSTU 4145-2002 with the hash function according to DSTU 7564:2014 are already being added by the regulator to the Trust List.
QES Lifecycle and Preserving the Legal Validity of Documents
The transition to the new hashing standard does not imply the simultaneous cancellation of existing keys or previously signed documents. Qualified electronic signatures created before 1 September 2026 remain valid until the expiry of the respective certificates. There is no need to conduct a premature, urgent mass reissue of keys for employees or clients.
Documents that are already signed and stored in the organisation's electronic archives fully retain their legal status. The main task for information systems is to ensure parallel support for both hashing standards. The system must create new signatures according to the DSTU 7564:2014 standard and, at the same time, continue to verify signatures created using previous algorithms, without limiting this verification to the expiry date of old certificates.
Technical Risk Areas in Corporate Infrastructure
The main difficulties of the transition are related to the operational logic of application software, integration gateways, and ERP systems. Some corporate solutions use hard-coded algorithm identifiers or outdated versions of cryptographic libraries that are unable to process the new hash.
Particular attention should be paid to the certificate path validation process and interaction with certificate status services (OCSP requests). If your system's local trust store is not updated, verification of new signatures will fail due to the inability to build a path of trust to the certificate of the provider that has already transitioned to the new standard.
When deploying and modernising document management systems based on the UnityBase low-code platform (specifically Megapolis.DocNet and Scriptum.DMS solutions), IQusion specialists recommend conducting an audit of integrated cryptographic modules. It is necessary to check the versions of QES libraries used on application servers and client workstations for support of the DSTU 7564:2014 algorithm. Also, integrations with the Trust List and CZO certificate chains should be included in the checklist.
Practical Compatibility Testing Using CZO Tools
To prepare information systems, the Central Certification Authority provides developers and IT departments with the necessary tools. Test examples of QES using DSTU 7564:2014, certificate chains, and JSON configurations for signature libraries are available on the official CZO resources. This allows system operation to be simulated in a controlled environment.
Testing should cover not only the basic signing operation but also the verification of various signature presentation formats: CAdES (for binary data), PAdES (for PDF documents), XAdES (for XML structures), and ASiC. Each of these formats has its own peculiarities of packaging cryptographic attributes, which must be correctly processed by your EDMS.
- Cryptographic Library Updates: Verify whether the QES libraries integrated into your systems support the DSTU 7564:2014 ("Kupyna") hashing standard for signature verification and creation operations.
- Trust Stores Configuration: Download and import the current certificate chain of compatible providers (CACertificates.p7b container or JSON configuration) published on CZO resources.
- OCSP and TSP Validation: Verify the correctness of processing requests to Online Certificate Status Protocol (OCSP) and Time Stamp Protocol (TSP) services when using certificates with the new hash.
- Signature Formats Testing: Conduct end-to-end testing of signature creation and verification in CAdES, PAdES, XAdES, and ASiC formats using the new hashing standard.
- Backward Compatibility: Ensure that the system continues to correctly verify previously created signatures based on GOST 34.311-95.
Organising the Migration Process in the IT Department
The first step should be an inventory of all QES usage points in the organisation. This includes not only EDMS user workstations but also automated exchange systems with government agencies, customs, client-banks, and internal service portals. For each point, it is necessary to identify the cryptographic library used and its current version.
The second step is interaction with software vendors. It is necessary to obtain official confirmation of DSTU 7564:2014 support or a schedule for releasing the relevant updates. If the system was developed in-house, developers should be provided with CZO test materials to conduct analysis and refine the code. At the final stage, comprehensive testing of end-to-end business processes is carried out using test certificates of the new type.
Frequently Asked Questions
Is it necessary to urgently reissue all employee QES before 1 September 2026?
No, each active certificate remains valid until the expiry date specified in it. A mass reissue of keys is not required; the transition will take place as the validity periods of current certificates expire.
What is the difference between DSTU 7564:2014 and DSTU 4145-2002?
DSTU 7564:2014 ("Kupyna") is a hash function standard that replaces the old GOST 34.311-95. DSTU 4145-2002 is the algorithm of the electronic signature itself, which remains valid and does not change.
Where can I get materials to test information systems for compatibility?
The Central Certification Authority (CZO) publishes test QES examples, certificate chains, and JSON configurations for integration into cryptographic libraries on its official website.
Sources
- From active documents to the generation of new keys: how and when the transition to the new e-signature standard will take place
- Technical release: planned transition to DSTU 7564:2014 ("Kupyna")
- Test examples of qualified electronic signature
- Current certificate chains
- New certificates of qualified providers added to the Trust List
