Section 9 in AADHAAR (AUTHENTICATION AND OFFLINE VERIFICATION) REGULATIONS, 2021
9. Process of sending authentication requests.—
(1)After collecting the Aadhaar number or any other identifier provided by the requesting entity which ismapped to Aadhaar number and necessary demographic and / or biometric information and/ or OTP fromthe Aadhaar number holder, the client application shall immediately package and encrypt these inputparameters into PID block before any transmission, as per the specifications laid down by the Authority,and shall send it to server of the requesting entity using secure protocols as may be laid down by theAuthority for this purpose.(2)After validation, the server of a requesting entity shall pass the authentication request to the CIDR, throughthe server of the Authentication Service Agency as per the specifications laid down by the Authority. Theauthentication request shall be digitally signed by the requesting entity and/or by the Authentication ServiceAgency, as per the mutual agreement between them.(3)Based on the mode of authentication request, the CIDR shall validate the input parameters against the datastored therein and return a digitally signed Yes or No authentication response, or a digitally signed e-KYCauthentication response with encrypted e-KYC data, as the case may be, along with other technical detailsrelated to the authentication transaction.(4)In all modes of authentication, the Aadhaar number is mandatory and is submitted along with the inputparameters specified in sub-regulation (1) above such that authentication is always reduced to a 1:1 match.(5)A requesting entity shall ensure that encryption of PID Block takes place at the time of capture on theauthentication device as per the processes and specifications laid down by the Authority.
