GENERAL
A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. In the context of licensing, it is obviously paramount for any client/device communicating with the SLASCONE API, to validate the data integrity of the message, i.e., that the message was not altered in transit.
SIGNATURE AND RESPONSE HEADER
The response header contains the property x-slascone-signature. This signature is generated based on the content of the response body.
Once a client receives a SLASCONE API response, it needs to validate it. The validation is based on the header x-slascone-signature. Visit our GitHub code examples for more information.
SYMMETRIC vs ASYMMETRIC ENCRYPTION
The basic difference between these two types of encryption is that symmetric encryption uses one key for both encryption and decryption, and the asymmetric encryption uses public key for encryption and a private key for decryption.
SLASCONE supports both types, but we strongly recommend the usage of asymmetric encryption. You can set this property in the Administration area of your environment.
ASYMMETRIC (recommended)
You can download the RSA public key certificate (pfx file) in the Administration area of your environment.
RSA-SHA256 is the used algorithm in the asymmetric mode.
SLASCONE comes with a pre-installed certificate. However, if you have an existing certificate you want to use, just contact our support.
SYMMETRIC (obsolete)
Use the following function to create and retrieve the shared EncryptionKey (you need The AdminKey in order to authenticate for this function):
POST /api/v1.3/IsvProfile/isv/{isvId}/signaturekey
HMACSHA256 is the used algorithm in the symmetric mode.
SECURING YOUR SECRETS
Make sure to securely manage your secrets as described here.
Comments
0 comments
Please sign in to leave a comment.