Message signature validation

This article describes the function(s) on which the message signature validation functionality is based. It contains information about parameters and possible return codes, as well as a prototype for each function.

The message signature validation functionality is applicable:

• To hardware or software Digipass authenticators compliant with the multi-device two-step activation (in the context of the multi-device licensing model).
• To hardware Digipass authenticators based on the single-device licensing model and able to perform operations based on the Secure Channel protocol.

Refer to the Authentication Suite Server SDK Product Guide for more information.

AAL2VerifyMessageSignatureICSF

Function prototype

aat_int32 AAL2VerifyMessageSignatureICSF (
                                    TDigipassBlob*  DPData,
                                    TKernelParms*   CallParms,
                                    aat_ascii       *aStorageKeyNameIn,
                                    aat_ascii       *aInitialVectorIn,
                                    aat_int32       MessageExpirationTime,
                                    aat_ascii*      Signature,
                                    aat_ascii*      SignedMessage,
                                    aat_int32       DeferredSignatureData
                                    aat_ascii*      ConfirmationCode,
                                    aat_ascii*      ConfirmationCodeLength);

Description

This function verifies the signature provided by the Digipass device:

• in response to Activation Message 2 (generated with AAL2GenMessageActivation2ICSF) during the multi-device activation process
• or in response to the request message (generated with AAL2GenMessageRequestICSF) during a Secure Channel request process (optionally; depending on whether the request requires a signature validation or not).

In case of verifying the signature of an Activation Message 2, the authenticator application BLOB used for the validation must correspond to the crypto application of the Digipass instance defined for the post-activation step. Information on the crypto application used for post-activation is part of the Digipass client configuration.

In case of verifying the signature of a request message (that contained a Secure Channel transaction), the authenticator application BLOB used for the validation must correspond to the crypto application of the Digipass instance selected for signing the message. Information on the crypto application selected for signing the message is part of the request body; it allows the Digipass device to perform the operation with the proper application.

The OnlineSG kernel parameter is also applied to the present function and is used as described in the Authentication Suite Server SDK C-C++ Programmer's Guide.

Signed message optional expiration check

This function allows optionally checking a maximum amount of time authorized since the generation of the Activation Message 2 or request message for which the signature validation is performed. This message time validity check depends on the MessageExpirationTime parameter.

If MessageExpirationTime = 0, the function will not perform any message time validity check.

If MessageExpirationTime > 0, MessageExpirationTime represents the maximum amount of time (expressed in seconds) authorized since the generation of the message (Activation Message 2 or a request message).

The instances of Activation Message 2 or request messages must have been MANDATORILLY generated by Authentication Suite Server SDK version 3.15.1 or later if checking the time validity (i.e. MessageExpirationTime > 0).

The timestamp of the generation time is embedded in the instances of Activation Message 2 and request messages only since Authentication Suite Server SDK 3.15.1.

Score-based Digipass

For Digipass devices that integrate the score-based algorithm, Authentication Suite Server SDK performs a score-based message signature validation which allows retrieving the Digipass scoring value. Once Authentication Suite Server SDK has successfully validated the signature, it returns either SUCCESS or SUCCESS with the relevant scoring warning code. See the list of return codes in Table: Return codes (AAL2VerifyMessageSignatureICSF) for more details.

Parameters

COBOL calling convention

Entry point: AA2VMSIC
02   W-BLOB                    PIC X(248).
02   W-KERNELPARMS.
     03  W-PARMCOUNT           PIC 9(8) USAGE BINARY.
     03  W-PARM01              PIC 9(8) USAGE BINARY.
     . . .
     03  W-PARM19              PIC 9(8) USAGE BINARY.
02   W-CONFIRMCODE             PIC X(17).
02   W-CONFCODE-LENGTH         PIC 9(8) USAGE BINARY.
02   W-RETURN                  PIC S9(8) USAGE BINARY.
02   W-SIGNATURE               PIC X(17).
02   W-SIGNED-MESSAGE          PIC X(nnnn).
02   W-MESSAGEEXPIRATIONTIME   PIC 9(8) USAGE BINARY.
02   W-SIGNATUREDATA           PIC 9(8) USAGE BINARY.
02   W-STORAGEKEY              PIC X(65).
02   W-INITVECTOR              PIC X(17).
02   W-API-NAME                PIC X(8) VALUE 'AA2VMSIC'.
. . .
     CALL W-API-NAME USING
           BY REFERENCE W-BLOB
           BY REFERENCE W-KERNELPARMS
           BY REFERENCE W-STORAGEKEY
           BY REFERENCE W-INITVECTOR
           BY VALUE W-MESSAGEEXPIRATIONTIME
           BY REFERENCE W-SIGNATURE
           BY REFERENCE W-SIGNED-MESSAGE
           BY VALUE W-SIGNATUREDATA
           BY REFERENCE W-CONFIRMCODE
           BY REFERENCE W-CONFCODE-LENGTH
           RETURNING W-RETURN

Return codes