Authentication

Authentication mechanism

We use AES encryption to encrypt user identity of client and send it to eKYC Platform. How it works:

1. AES key base64

A pair of:

  • Key: 256 bits (32 bytes)

  • IV (initialization vector): 16 bytes

TrustVision team will provide an (key, iv) pair and client_code for each customers before integration.

2. Client encrypt the user identity to do eKYC journey.

  • Encrypt user identity use AES-256 CBC with padding PKCS7.
  • Encode the Base64 URL of the above encrypted value.
  • Concatenate encrypted value with client_code.
  • Encode Base64 URL of the above-concatenated value.
  • Use the encoded value to send it to the eKYC Platform.

eg.

  1. Use Web or WebView via link:
Production
The production host follows the same naming pattern, with `-production` in place of `-staging` — for example, `https://ekyc-platform-ph-production.trustingsocial.com/lu/[ENCODED_VALUE]`.
  1. Pass [ENCODED_VALUE] to init iOS/Android/Flutter/ReactNative SDK.

Pseudo code:

UserID    = "user_id"    // client-generated value
KeyBytes  = Base64StdDecode(aesKey) // Base64 Standard Decoding
IVBytes   = Base64StdDecode(aesIV)  // Base64 Standard Decoding
// Step 1
EncryptedUserID    = AES256CbcPkcs7PaddingEncrypt(UserID, KeyBytes, IVBytes)
// Step 2
EncodedBase64EncryptedValue = Base64UrlEncode(EncryptedUserID)
// Step 3
UniqueToken        = KeyID + ":" + EncryptedUserID
// Step 4
EncodedBase64Token = Base64UrlEncode(UniqueToken)  // Base64 URL Encoding
URL                = "https://ekyc-platform-ph-staging.trustingsocial.com/lu/" + EncodedBase64

Sample code:

Reference:

package main

import (
    "crypto/aes"
    "crypto/cipher"
    "encoding/base64"
    "fmt"

    "github.com/zenazn/pkcs7pad"
)

func main() {

    key := "YOUR_KEY"
    iv := "YOUR_IV"
    keyID := "YOUR_KEY_ID"
    url := "YOUR_URL"

    keyBytes, err := base64.StdEncoding.DecodeString(key)
    if err != nil {
        panic(err)
    }

    ivBytes, err := base64.StdEncoding.DecodeString(iv)
    if err != nil {
        panic(err)
    }

    block, err := aes.NewCipher(keyBytes)
    if err != nil {
        panic(err)
    }

    userID := "PLiOA_EdK3xx1M4sJPsOlQZqgX"
    // Step 1: Padding userID and encrypt
    contentPadding := pkcs7pad.Pad([]byte(userID), block.BlockSize())
    encryptedValue := make([]byte, len(contentPadding))
    blockMode := cipher.NewCBCEncrypter(block, ivBytes)
    blockMode.CryptBlocks(encryptedValue, contentPadding)

    // Step 2: Encode encrypted value to base64
    encodedBase64EncryptedValue := base64.RawURLEncoding.EncodeToString(encryptedValue)
    // Step 3: Generate unique token
    uniqueToken := keyID + ":" + encodedBase64EncryptedValue
    // Step 4: Encode unique token to base64
    encodedBase64Token := base64.RawURLEncoding.EncodeToString([]byte(uniqueToken))
    fmt.Println(url + "/" + encodedBase64Token)
}