AAL2VerifyMessageSignature

The message signature validation functionality is applicable:

• To hardware or software Digipass authenticators compliant with the multi-device two-step activation (in the context of the multi-device licensing model).
• To hardware Digipass authenticators based on the single-device licensing model and able to perform operations based on the Secure Channel protocol.

For more information, refer to the Authentication Suite Server SDK Product Guide.

Function prototype

aat_int32 AAL2VerifyMessageSignature (
                                    TDigipassBlob*  DPData,
                                    TKernelParms*   CallParms,
                                    aat_int32       MessageExpirationTime,
                                    aat_ascii*      Signature,
                                    aat_ascii*      SignedMessage,
                                    aat_int32       DeferredSignatureData
                                    aat_ascii*      ConfirmationCode,
                                    aat_ascii*      ConfirmationCodeLength);

Description

This function verifies the signature provided by the Digipass device:

• in response to Activation Message 2 (generated with AAL2GenMessageActivation2) during the multi-device activation process
• or in response to the request message (generated with AAL2GenMessageRequest) during a Secure Channel request process (optionally; depending on whether the request requires a signature validation or not).

In case of verifying the signature of an Activation Message 2, the authenticator application BLOB used for the validation must correspond to the crypto application of the Digipass instance defined for the post-activation step. Information on the crypto application used for post-activation is part of the Digipass client configuration.

In case of verifying the signature of a request message, (that was containing a Secure Channel transaction), the authenticator application BLOB used for the validation must correspond to the crypto application of the Digipass instance selected for signing the message. Information on the crypto application selected for signing the message is part of the request body; it allows the Digipass device to perform the operation with the proper application.

The OnlineSG kernel parameter is also applied to the present function and is used as described in OnLineSG.

Signed message optional expiration check

This function allows optionally checking a maximum amount of time authorized since the generation of the Activation Message 2 or request message for which the signature validation is performed. This message time validity check depends on the MessageExpirationTime parameter.

If MessageExpirationTime = 0, the function will not perform any message time validity check.

If MessageExpirationTime > 0, MessageExpirationTime represents the maximum amount of time (expressed in seconds) authorized since the generation of the message (Activation Message 2 or a request message).

The instances of Activation Message 2 or request messages must have been MANDATORILLY generated by Authentication Suite Server SDK version 3.15.1 or later if checking the time validity (i.e. MessageExpirationTime > 0).

The timestamp of the generation time is embedded in the instances of Activation Message 2 and request messages only since Authentication Suite Server SDK 3.15.1.

Score-based Digipass

For Digipass devices that integrate the score-based algorithm, Authentication Suite Server SDK performs a score-based message signature validation which allows retrieving the Digipass scoring value. Once Authentication Suite Server SDK has successfully validated the signature, it returns either SUCCESS or SUCCESS with the relevant scoring warning code. See the list of return codes in Table: Return codes (AAL2VerifyMessageSignature) for more details.

Parameters

Return codes