For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

End-to-end encryption

Our end-to-end encryption (E2EE) security mechanism is foundational for MobileID, as all communication between the SDK integrated into your application and our backend servers uses E2EE.

How does E2EE work?​

We achieve this using a public-key cryptography system, where a cryptographic key pair consisting of a public and a private key are used to establish a secure channel for all data exchange

By encrypting all data with the public key before it leaves the device's memory, we guarantee that the information remains confidential and secure throughout the entire transmission process.

Security​

The always-on E2EE between the SDK and our server provides a robust defence against a wide range of network-based attacks. We encrypt the data at the application layer, which means that the security of the communication channel itself becomes less critical.

Threat mitigation​

For some examples of threats that our E2EE security mechanism can mitigate, see the table below:

E2EE keys for SDK 3.22 and later​

Starting with MobileID SDK 3.22, key exchange between the SDK and the server uses the X25519 algorithm. Existing E2EE keys that use the legacy SECT233K1 algorithm are not compatible with SDK 3.22 or later.

Before you upgrade your app to SDK 3.22 or later, you must rotate your E2EE key to one that uses the X25519 algorithm. Follow the key rotation process below to avoid downtime.

Key rotation​

Key rotation is a critical security practice that limits the potential impact of a compromised key. It involves generating a new public/private key pair and updating your application to use the new public key.

Regularly rotating your E2EE keys minimises the risk associated with a key being exposed. If a key was ever compromised, then rotating it would make the old key useless for any future communications, securing the channel once again.

Rotation Process​

We have designed the key rotation process to be straightforward and manageable, with no downtime for your application's end-users. To learn how to do this, see the steps below:

1. Generate a new key pair​

  1. Initiate the generation of a new key pair using the Add E2E key endpoint in the MobileID Admin API. This action creates a new public and private key.

    Choose the appropriate algorithm

    The MobileID Admin API uses X25519 by default when you omit the algorithm parameter. Use the legacy value SECT233K1 only when you generate a key for an app built with an SDK version earlier than 3.22.

  2. Once created, the public key becomes available to retrieve from both:

    • The Get E2E key endpoint in the MobileID Admin API
    • The E2E keys tab on the MobileID Details page in the Signicat Dashboard.

2. Update and distribute your app​

  1. Configure the Encap controller in your mobile application with the new public key. To learn how to do this, see the:
  2. Release an updated version of your app to the Apple App Store and Google Play Store.

3. Transition period​

For a period of time, our server accepts data encrypted with both the old and the new public keys. This ensures that end-users who have not yet updated their app can continue to use the service without interruption.

4. Revoke the old key​

Once you are confident that the majority of your end-users have updated to use the latest version of your app, you can revoke the old key using the Signicat Dashboard or the MobileID Admin API.

From this point on, only data encrypted with the new key is accepted.

On this page