The QES transition to the Kupyna standard is a good occasion to look at how Ukrainian cryptography works as a whole. In plain language, here is what a hash function is and why signatures need one, what Kupyna, Kalyna and DSTU 4145 each do — and why having national standards matters not only for security, but for digital sovereignty too.
What a Hash Function Is and Why a Signature Needs One
A hash function is a mathematical algorithm that turns any data — a hundred-page contract or a photo from your phone — into a short string of fixed length: the file's "fingerprint". A good cryptographic hash function has three key properties:
- The same file always produces the same fingerprint. The computation is fully reproducible.
- The slightest change produces a completely different fingerprint. Replace a single comma in a contract, and the hash changes beyond recognition.
- The file cannot be reconstructed from its fingerprint, and it is infeasible to deliberately craft two different documents with the same hash.
What does this have to do with signatures? When you apply a QES, what gets cryptographically signed is not the document itself but its hash. This is fast (the fingerprint is short) and reliable: change even one byte of the document after signing, and the hash will no longer match — verification will flag it instantly. That is how a qualified electronic signature protects both authorship and document integrity.
Kupyna: The National Hashing Standard
Kupyna is Ukraine's national cryptographic hashing standard DSTU 7564:2014 "Information technologies. Cryptographic protection of information. Hash function". It is now the function that computes the document "fingerprint" your key signs: the Cabinet of Ministers has approved Kupyna as the mandatory basis for creating QES. Since 10 February 2026 new signatures are already formed under the new standard, and from 1 September 2026 the transition becomes complete. We covered what this means in practice in a separate article on the transition.
Kupyna offers a high level of resistance to both current and emerging cyber threats — in other words, it is designed not only for today's attacks but for those that may appear in the future.
Kalyna: The Block Cipher
If hashing is about integrity, encryption is about confidentiality. Kalyna is the national block cipher standard DSTU 7624:2014. A block cipher works like this: data is split into fixed-size blocks, and each block is transformed with a secret key in such a way that recovering the original text without the key is impossible.
In plain terms: a hash function is the tamper seal that shows whether an envelope has been opened, while a cipher is the envelope itself, keeping outsiders from reading the contents. In modern document management systems the two mechanisms work together — we explored how encryption protects your files in our article on electronic document security.
DSTU 4145-2002: Signatures on Elliptic Curves
The third element is the digital signature algorithm itself, DSTU 4145-2002. It is built on the mathematics of elliptic curves: you hold a key pair — a private key you sign with, and a public key anyone can use to verify your signature. Deriving the private key from the public one is practically impossible: it would require solving a mathematical problem that would take even the most powerful computers astronomically long.
Now let's put it all together. When you sign a document:
- Kupyna computes the document's hash — its unique fingerprint.
- The DSTU 4145-2002 algorithm signs that hash with your private key.
- The recipient uses your public key to verify the signature and compare the hash — if everything matches, the document is genuine and unaltered.
Note that the Kupyna transition changes only the first step — the hash function. The DSTU 4145-2002 signature algorithm stays the same. In eObig, all of these computations happen locally in your browser — the private key and password never leave your device, and the platform's cryptographic core holds a positive assessment from the State Service of Special Communications (SSSCIP). Read more in our article on browser-based signing security.
Why Ukraine Needs Its Own Standards
Historically, hashing relied on standards of the GOST family — a Soviet legacy shared across the post-Soviet space. The move to Kupyna means finally abandoning it in favour of Ukraine's own cryptographic standards.
This delivers two things. First, security: the national standards were designed with current and future threats in mind. Second, digital sovereignty: Ukraine itself defines, develops and controls the cryptography that protects its documents — with no dependence on the standards of the aggressor state. For businesses the transition is as smooth as it gets: existing keys remain valid until they expire, and our checklist for business will help you prepare.
Key Takeaways
- A hash function creates a unique "fingerprint" of a document; that fingerprint is what your key actually signs.
- Kupyna (DSTU 7564:2014) is the national hashing standard, now the mandatory basis for creating QES.
- Kalyna (DSTU 7624:2014) is the national block cipher, responsible for data confidentiality.
- DSTU 4145-2002 is the digital signature algorithm based on elliptic curves; it does not change in the Kupyna transition.
- Abandoning GOST means both stronger resistance to cyber threats and digital sovereignty for Ukraine.
Want to see this cryptography at work — right in your browser, with no plugins? Start for free at portal.eobig.com or book a demo: we will sign your first document together.