--- title: "Implementing the Crypto plugin" slug: "dpo-api-server-plugin-for-crypto-implementation" updated: 2026-10-27T20:13:12Z published: 2026-10-27T20:13:12Z canonical: "docs.onespan.com/dpo-api-server-plugin-for-crypto-implementation" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.onespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Implementing the Crypto plugin DigipassONE Server components provide a programmatic interface in Java for you to develop a plugin that supports the use of an external cryptographic service provider. The following operations are supported through the Crypto plugin: - Encryption and decryption of: - Server data in UAF/FIDO2 protocol messages - Data required for FIDO out-of-band operations - Digital signature generation and validation of JWT data used in the following: - Session token - EMV 3DS blob - Transaction confirmation token ## Creating a Crypto plugin A Crypto plugin must implement the following Java interface: ```java package com.noknok.crypto.sdk; /** * Implement this interface to perform cryptographic operations - sign, * encrypt and decrypt   * * The implementation class name should be provided as Java system property * nnl.crypto.plugin.class.name. * * Each server component (Auth Server, API Server etc.) creates a single * instance of the implementation using the no-argument constructor at * startup. All the methods in this interface may be called from multiple * threads. They should throw exceptions for any failures. */ interface CryptoPlugin {    /**     * Sign the data and return the result.     *     * @param context context for the request     * @param alias identifies the key     * @param algorithm name of algorithm as defined by Java     * @param params optional parameters     **/    public byte[] sign(CryptoContext context, String alias, String algorithm,        AlgorithmParameterSpec params, byte[] data);    /**     * Encrypt the data and return the result.     *     * @param context context for the request     * @param alias identifies the key     * @param algorithm name of algorithm as defined by Java     * @param params optional algorithm parameters     */    public byte[] encrypt(CryptoContext context, String alias,        String algorithm, AlgorithmParameterSpec params, byte[] data);    /**     * Decrypt the data and return the result.     *     * @param context context for the request     * @param alias identifies the key     * @param algorithm name of algorithm as defined by Java     * @param params optional algorithm parameters     */ public byte[] decrypt(CryptoContext context, String alias, String algorithm,     AlgorithmParameterSpec params, byte[] data); } /** * Provides the context for cryptographic operation. */ public static class CryptoContext {    /**     * Returns the name of the context. Possible names are     * "serverDataCipher" and "jwtGenerate".     *     * @return the name     */    public String getName();    /**     * Returns the id of the tenant     *     * @return the tenant ID     */    public String getTenantId();    public CryptoContext(String name, String tenantId) {    this.name = name;        this.tenantId = tenantId;    } } ``` ## Building and deploying the Crypto plugin Use the instructions below to build your Crypto plugin. 1. Make sure you have access to a DigipassONE Server installation for development and testing purposes. 2. Build your CryptoPlugin class with a dependency on nnlcrypto-9.3.0.xxx.jar found under the /admin/lib/thirdparty folder. 3. Package the CryptoPlugin implementation in a jar file. ## Configuring the DigipassONE Server with the Crypto plugin **Step 1**. Copy the CryptoPlugin implementation jar file, along with its third party dependencies, into the DigipassONE Authenticate web applications' lib directories listed below. - tomcat/webapps/nnl/WEB-INF/lib/ - tomcat/webapps/nnlgateway/WEB-INF/lib/ - tomcat/webapps/nnlfedapp/WEB-INF/lib/ - tomcat/webapps/nnlauthsvc/WEB-INF/lib/ - tomcat/webapps/gwtutorial/WEB-INF/lib/ **Step 2**. Provide the name of the class that implements the interface CryptoPlugin as a Java system property nnl.crypto.plugin.class.name. Enter the name of the class inside the /bin/setenv.sh file: ```plaintext CATALINA_OPTS="${CATALINA_OPTS} -Dnnl.crypto.plugin.class.name=com.mycompany.CryptoPlugin" ``` **Step 3**. Using nnl-mgmt.sh, assign the values shown below to nnl.jce.providers and nnl.default.external.encryption.key.jce.provider.name. These are SYSTEM tenant properties. ```plaintext ./nnl-mgmt.sh properties set -name "nnl.jce.providers" -value  "com.noknok.crypto.provider.NokNokCryptoProvider,org.bouncycastle.jce.provider.BouncyCastleProvider" -tenantid SYSTEM ./nnl-mgmt.sh properties set -name "nnl.default.external.encryption.key.jce.provider.name" -value "NokNokCryptoProvider" -tenantid SYSTEM ``` **Step 4**. Using nnl-mgmt.sh as shown below, configure the alias to be the encryption key for your tenant. ```plaintext ./nnl-mgmt.sh key add -tenantid default -autogenerate no ``` **Step 5**. Configure the DigipassONE API Server's JWT Processor plugin. See the tables for the generate and validate fields in [JWT Configuration Object Fields](/dpoa/docs/s3suite94-configuring-jwt-generation-and-validation-1#jwt-configuration-object-fields). 1. Set the [jwks_keystore.provider](/dpoa/docs/s3suite94-configuring-jwt-generation-and-validation-1#generate-fields) field in jwt_config to "NokNokCryptoProvider". 2. Set the [jwks_keystore.type](/dpoa/docs/s3suite94-configuring-jwt-generation-and-validation-1#generate-fields) field in jwt_config to "NokNokKeyStore". 3. Set the [jwks_keystore.keys](/dpoa/docs/s3suite94-configuring-jwt-generation-and-validation-1#generate-fields) in jwt_config.This is a stringified JSON array containing references to keys. Each key reference defines "kid" (the key alias), "kty" (the key type/algorithm) and optionally "x5c" (certificate chain) attributes. Supported values for "kty" are "RSA", "EC" and "oct". The "x5c" attribute is required for "RSA" and "EC" key references. Below are examples of defining key references for each type: ```plaintext [  {    "kid": "",    "kty": "RSA",    "x5c": [      "",      ""    ]  },  {    "kid": "",    "kty": "EC",    "x5c": [      "",      ""    ]  },  {    "kid": "",    "kty": "oct"  } ] ``` **Step 6**. Restart Tomcat and verify that registration and authentication works. See [Installing the Crypto and Secrets Plugin](/dpoa/docs/s3suite94-installing-the-crypto-and-secrets-plugins-1) for details on how to install your Crypto plugin in a DigipassONE Server for production purposes. Formerly known as Digipass S3 Server. Formerly known as Digipass S3 Authentication Software. Enables passkeys, multi-factor authentication (MFA), hardware authenticators, one-time password (OTP). Formerly known as Digipass S3.