This function is an extension of AAL2VerifyPasswordICSF, offering the enhanced security feature. This feature prevents potential man-in-the-middle attacks in the architecture integrating software Digipass. A server public key, such as a certificate, can be used in input to diversify the challenge.
This parameter is optional. If it is not used, this function is identical with AAL2VerifyPasswordICSF.
The enhanced authentication feature is supported by Digipass 110 and DIGIPASS for Web.
Parameters
Table: Parameters (AAL2VerifyPasswordEsICSF)
Type
Name
Use
Description
TDigipassBlob *
DPData
I/O
authenticator application BLOB. Upon return from the function call, this BLOB must be rewritten to the application database to reflect the changes.
TKernelParms *
CallParms
I
Structure of runtime parameters to use during this function call.
aat_ascii *
aStorageKeyNameIn
I
String of up to 64+1 characters, left-justified, null-terminated, or right-padded with spaces. This is the label of the ICSF storage key used to encrypt the sensitive Digipass application BLOB data.
aat_ascii *
aInitialVectorIn
I
String of 16 hexadecimal characters, left-justified, null-terminated, or right-padded with spaces. This is the initial vector used to encrypt the sensitive authenticator application BLOB data.1
aat_ascii *
aResponseIn
I
String of up to 17+24 numeric or hexadecimal characters, left justified, null terminated or right padded with spaces. This is the dynamic password generated by the Digipass.
aat_ascii *
aChallengeIn
I
String of up to 17 numeric characters, left justified, null terminated or right padded with spaces. This parameter holds the challenge that may have been proposed to the user to generate the password to verify.
If no challenge was generated, this parameter should be NULL.
aat_ascii *
aServerPublicKey
I
String of up to 1024 hexadecimal characters, null-terminated. This parameter is used as a diversifier to prevent man-in-the-middle attacks. If this parameter is NULL, diversification will not take place.
aat_ascii *
ReturnHostCode
O
String of up to 17 numeric or hexadecimal characters, left-justified, null-terminated or right-padded with spaces. This is the code generated by Authentication Suite Server SDK (recommended buffer size is 18 bytes).
aat_int32 *
ReturnHostCodeLength
O
Pointer to a long integer that will contain the length of the return host code which has been generated.
COBOL calling convention
Entry point: AA2VPEIC
02 W-BLOB PIC X(248).
02 W-KERNELPARMS.
03 W-PARMCOUNT PIC 9(8) USAGE BINARY.
03 W-PARM01 PIC 9(8) USAGE BINARY.
. . .
03 W-PARM19 PIC 9(8) USAGE BINARY.
02 W-HOSTCODE PIC X(17).
02 W-HOSTCODE-LENGTH PIC 9(8) USAGE BINARY.
02 W-RETURN PIC S9(8) USAGE BINARY.
02 W-PASSWORD PIC X(17).
02 W-CHALLENGE PIC X(17).
02 W-STORAGEKEY PIC X(65).
02 W-SERVER-PUBKEY PIC X(1025).
02 W-INITVECTOR PIC X(17).
02 W-API-NAME PIC X(8) VALUE 'AA2VPEIC'.
. . .
CALL W-API-NAME USING
BY REFERENCE W-BLOB
BY REFERENCE W-KERNELPARMS
BY REFERENCE W-STORAGEKEY
BY REFERENCE W-INITVECTOR
BY REFERENCE W-PASSWORD
BY REFERENCE W-CHALLENGE
BY REFERENCE W-SERVER-PUBKEY
BY REFERENCE W-HOSTCODE
BY REFERENCE W-HOSTCODE-LENGTH
RETURNING W-RETURN
