Runtime parameters

From 2 to 1000 TimeSteps.

Determines the acceptable time difference between a Digipass authenticator and the host system for identification functions. This difference is adjusted to the last known shift for each authenticator. The time step is determined by the Digipass internal programming options.

Refer to Concepts of OneSpan Authentication Suite Server SDK for more information on the time management of Authentication Suite Server SDK. This parameter can be set to dynamic or static (since version 3.5.0.3). If dynamic, the size of the window will increase as the time passes between the last and the next use of Digipass. Because of this feature, the dynamic window can be set smaller than a static window. TW_DYNAMIC_WINDOWS (in aal2sdk.h) is a bitmask indicator that can be used to determine whether ITimeWindow is dynamic or static.

From 0 to 3. Level of diagnostic information generated by the validation and generation functions.

0: No diagnostic info.

>0: Diagnostic info about the authenticator application in the standard output.

Not used in case of Authentication Suite Server SDK for HSM.

From 0 to 4.

Verifies or not if the challenge has been corrupted before the validation.

0 : No challenge checking.

 1: Check the challenge in parameter of the validation function. This challenge must be the same as the last one generated by Authentication Suite Server SDK for this authenticator application BLOB. (The last challenge generated by Authentication Suite Server SDK is stored into the authenticator application BLOB and will be compared to the one provided during the validation function call.)

2: Automatically use the last challenge generated by Authentication Suite Server SDK for this authenticator application BLOB during the validation. (Challenge in parameter of validation function will be ignored. The last challenge generated by Authentication Suite Server SDK is stored into the authenticator application BLOB and will be used automatically.) The generated challenge can be used for only one validation.

3: Avoid Challenge/Response replay attack by allowing only one Challenge/Response authentication per Digipass time step. The authenticator application BLOB last challenge is not checked (challenge in parameter of validation function does not have to be the same as the last one generated by Authentication Suite Server SDK).

4: Avoid Challenge/Response replay attack by rejecting the second response if responses from two consecutive authentication requests are equal and in the same Digipass time step. The authenticator application BLOB last challenge is not checked (challenge in parameter of validation function does not have to be the same as the last one generated by Authentication Suite Server SDK).

From 0 to 255.

Number of successive signature errors that will cause server-side locking of the authenticator application BLOB. When the specified number is reached, return code 203 is sent to the caller, e.g. 3 validations have failed for one authenticator application BLOB, and its error count is 3. If SThreshold has been set to 3, further calls to AAL2VerifySignature() will return 203.

0: This feature is disabled.

From 0x00000000 to 0x7FFFFFFF.

Vector used to make data software encryption unique for a host.

From 0 to 3.

Indicates the level of online signature.

0: Signature verified in offline mode. Can be used for time and/or event-based signatures. The DeferredSignatureData parameter of the signature validation function can receive the Digipass time to use for the validation (DeferredSignatureData = 0 forces using the current time).

1 (Recommended in most cases): Signature verified in online mode. Can be used for time and/or event-based signatures. Several signatures are allowed in the same Digipass time step (except identical successive ones).

2: Signature verified in online mode. Can be used for time and/or event based signatures. Only one signature per Digipass time step is allowed.

3: Signature verified in offline mode. Can be used for event-based signatures. The DeferredSignatureData parameter of the signature validation function must receive the event counter to use for the validation.

From 0 to 60.

HSM slot ID used to store HSM storage key and HSM transport key.

HSMSlotId is only used with Authentication Suite Server SDK for HSM (except Authentication Suite Server SDK for nCipher HSM). It is not used with the Authentication Suite Server SDK software version.

From 0 to 0x7FFFFF.

HSM key ID used to decrypt the sensitive authenticator application BLOB data. This can be either of the following:

• the ID of the HSM-level transport key used to encrypt the sensitive DPX data.
• the ID of the HSM storage key used to decrypt the BLOB in case of storage key 1 to storage key 2 migration.

The TransportKeyId is only used with the HSM versions of Authentication Suite Server SDK. It is not used with the Authentication Suite Server SDK software version.

TransportKeyId only used if no DecryptionKeyName is provided in the HSM functions.

Derivation key part 2 used to make data software encryption unique for a host.