For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

End-to-end encryption

Our end-to-end encryption (E2EE) security mechanism is foundational for MobileID, as all communication between the SDK integrated into your application and our backend servers uses E2EE.

How does E2EE work?​

We achieve this using a public-key cryptography system, where a cryptographic key pair consisting of a public and a private key is used to establish a secure channel for all data exchange.

By encrypting all data with the public key before it leaves the device's memory, we guarantee that the information remains confidential and secure throughout the entire transmission process.

Security​

The always-on E2EE between the SDK and our server provides a robust defence against a wide range of network-based attacks.

We encrypt the data at the application layer, which means that the security of the communication channel itself becomes less critical.

For some examples of threats that our E2EE security mechanism can mitigate, see the table below:

Manage E2E keys​

You can manage your E2E keys directly in the Signicat Dashboard. Here, you can add new keys, disable keys, and permanently delete keys that are no longer needed.

Add a new E2E key​

To add a new E2E key:

  1. Go to Signicat Dashboard > Products > MobileID > Details.
  2. Go to the E2E keys tab and click the + Add new button.
  3. In the Add new E2E key dialogue, enter a Name and a Description for the key.
  4. Select the cryptographic Algorithm that you want to use from the dropdown menu.
    Selecting an algorithm
    • For apps built using an SDK version 3.22 or later, use the default X25519.
    • For apps built using an SDK version earlier than 3.22, use the legacy SECT233K1.
  5. Click the Add button.

The new key appears in the list of Enabled keys.

Disable an E2E key​

If you need to temporarily suspend an E2E key, you can disable it.

Service interruption

Disabling a key will stop all devices configured with this key from functioning.

To disable an active key:

  1. Go to Signicat Dashboard > Products > MobileID > Details.
  2. Go to the E2E keys tab and ensure you are viewing the Enabled list.
  3. Locate the key that you want to disable, then click the Disable button next to it.
  4. In the confirmation dialogue, check that you are disabling the correct key, then click the Confirm button.

The key is moved to the Disabled list.

Enable a disabled key​

To re-enable a key that was previously disabled:

  1. Go to Signicat Dashboard > Products > MobileID > Details.
  2. Go to the E2E keys tab, then click the Disabled selection button to view your disabled keys.
  3. Locate the key that you want to enable, then click the Enable button next to it.
  4. In the confirmation dialogue, click the Confirm button.

The key is moved back to the Enabled list.

Delete an E2E key​

If an E2E key is no longer needed, you can permanently delete it.

Note

A key must be moved to the Disabled list before it can be deleted.

Irreversible operation

Deleting a key is a permanent action. All devices configured with this key will stop functioning immediately.

To delete a disabled key:

  1. Go to Signicat Dashboard > Products > MobileID > Details.
  2. Go to the E2E keys tab, then click the Disabled selection button to view your disabled keys.
  3. Locate the key you want to delete, then click the Delete button next to it.
  4. In the confirmation dialogue, click the Confirm button.

The key is now deleted and no longer appears in the Disabled list.

Rotate E2E keys​

Key rotation is a critical security practice that limits the potential impact of a compromised key. It involves generating a new public/private key pair and updating your application to use the new public key.

Regularly rotating your E2EE keys minimises the risk associated with a key being exposed. If a key was ever compromised, then rotating it would make the old key useless for any future communications, securing the channel once again.

SDK 3.22 and later​

Starting with MobileID SDK 3.22, key exchange between the SDK and the server uses the X25519 algorithm.

This means that existing E2EE keys that use the legacy SECT233K1 algorithm are not compatible with SDK 3.22 or later.

When you upgrade your app to SDK 3.22 or later, you must rotate your E2EE key to one that uses the X25519 algorithm.

Important

You should only use the legacy algorithm SECT233K1 when you are generating a key for an app built with an SDK version earlier than 3.22.

Rotation process​

We have designed the key rotation process to be straightforward and manageable, with no downtime for your application's end-users. To learn how to do this, see the steps below:

1. Generate a new key pair​

Follow the Add a new E2E key steps above to generate a new key pair. Once created, the new public key appears in the Enabled list.

2. Update and distribute your app​

Configure the Encap controller in your mobile application with the newly generated public key, then release the updated version of your app to the Apple App Store and Google Play Store.

3. Transition period​

For a period of time, our server accepts data encrypted with both the old and the new public keys.

This ensures that end-users who have not yet updated their app can continue to use the service without interruption.

4. Revoke the old key​

Once you are confident that the majority of your end-users have updated to use the latest version of your app, you are ready to revoke the old key.

To do this, locate the old key in the Enabled list, then follow the Disable an E2E key steps above to revoke it.

From this point on, only data encrypted with the new key is accepted.

On this page