Authentication Suite Server SDK provides several functions that are used for offline authentication.
Only software versions of OneSpan Authentication Suite Server SDK support functionalities related to offline authentication (hash data block and state data block generation, state data block synchronization). The HSM versions of Authentication Suite Server SDK do not support offline authentication.
AAL2GenHashDataBlock (Function)
Function prototype
aat_int32 AAL2GenHashDataBlock (
TDigipassBlob* DPData,
TKernelParms* CallParms,
aat_int32 EventWindow,
aat_int32 StartTime,
aat_int32 EndTime,
aat_byte* Salt,
aat_int32 SaltLength,
aat_word32 MaxRadomValue,
aat_byte* bKey,
aat_int32 KeyLength,
aat_byte* bHashDataBlock,
aat_int32* HashDataBlockLength);Description
This function generates a hash data block for the event window or time period for the given authenticator application BLOB. The content of HashDataBlock is transparent to the caller and loaded into the client-side hash verification library.
The buffer for HashDataBlock must be allocated by the client prior to the function call. It is returned as a byte string in the following format:
Serial number on 22 ASCII characters
Data block size on 4 bytes
Data block version on 2 bytes
Maximum random diversifier on 4 bytes
Start window on 4 bytes. It can be an event value or time indicated in seconds.
Number of hashes used on 4 bytes.
Since Authentication Suite Server SDK 3.17.1, the maximum number of OTP hashes is 12000.
Prior Authentication Suite Server SDK 3.17.1, the maximum number of OTP hashes was 3000.
Data which contains the hashes list. Size of data is (number of hashes x 20) bytes
CRC on 4 bytes
The allocated buffer size for bHashDataBlock must be (44 + (number of hashes x 20)) bytes. The number of hashes depends on the following parameters:
For event-based authenticators, the HashDataBlock buffer to allocate is (44 + (EventWindow x 20)) bytes.
The maximum value for EventWindow is 12000 since Authentication Suite Server SDK 3.17.1 and was 3000 for earlier versions.
For time-based authenticators, the HashDataBlock buffer to allocate is (44 + ( ( (EndTime – StartTime) / TimeStep) x 20)) bytes.
The maximum value for ( (EndTime – StartTime) / TimeStep) is 12000 since Authentication Suite Server SDK 3.17.1 and was 3000 for earlier versions.
Parameters
Return codes
AAL2GetStateDataBlock (Function)
Function prototype
aat_int32 AAL2GetStateDataBlock (
TDigipassBlob* DPData,
TKernelParms* CallParms,
aat_byte* bStateDataBlock,
aat_int32* StateDataBlockLength);Description
This function generates a state data block from an authenticator application BLOB.
The buffer for StateDataBlock must be allocated by the client prior to the function call. It is returned as a byte string in the following format:
Serial number on 22 ASCII characters
Data block size on 4 bytes
Data block version on 2 bytes
Token status on 1 byte
Static PIN length on 1 byte
OTP length on 1 byte
OTP format on 1 byte
Codeword on 4 bytes
LastTimeUsed value on 4 bytes
LastTimeShift Value on 4 bytes
Error counter on 4 bytes
Use counter on 4 bytes
Static PIN delta on 8 bytes
CRC on 4 bytes
The allocated buffer size for bStateDataBlock must be 64 bytes.
Parameters
Return codes
AAL2SyncStateData (Function)
Function prototype
aat_int32 AAL2SyncStateData (
TDigipassBlob* DPData,
TKernelParms* CallParms,
aat_byte* bStateDataBlock,
aat_int32 StateDataBlockLength);Description
This function synchronizes an authenticator application BLOB with the state data block. It synchronizes the current event for event-based algorithms, the last time used and the last time shift for time-based algorithms, as well as the error and use counts.