crypto

README

Crypto package

Includes various encryption algorithms for payment applications in Sudan. Currently, the library supports:

• PIN encryption (DES for POS) in Python
• iPIN encryption (RSA) in Go (go language)

Soon we will be adding:

• JS (iPIN)
• Java (PIN, iPIN)
• WASM (IPIN)

Notes TODO #3

This project uses different languages, but we tried to make clear instructions per each directory.

TODO #1s

• Add more testing
• Implement web interface

Directory listing

We follow a simple directory structure, since we have PIN and IPIN encryption, it goes like this:

• directories have *.language_extension to indicate the language being used. E.g., ipin.js directory means this holds ipin encryption in javascript. And so on

We currently have the following implementations and languages, authors are listed as well:

• pin (@adonese)
• ipin.js (fakhrisati)
• pin.java (@wadjaafar)
• cli (@adonese)
• ipin.java (@wadjaafar)

Documentation

Overview

Package crypto implements IPIN encryption as per EBS It supports libraries in different languages including: Go, Python, JavaScript, Java and Dart. The code is battle-tested and has been used in production for years.

Signing and Verifying

In addition to the EBS encryption support, crypto also supports signing and verifying for keys. Most notably, noebs uses crypto to sign users for token refresh.

Index

• func DecryptNoebs(privkey string, payload string) (string, error)
• func Encrypt(pubkey string, payload string) (string, error)
• func EncryptNoebs(pubkey string, payload string) (string, error)
• func Sign(privkey string) (string, error)
• func Verify(pubkey string, signature, message string) (bool, error)
• func VerifyWithHeaders(pubkey string, signature, message string) (bool, error)

Functions

func DecryptNoebs

func DecryptNoebs(privkey string, payload string) (string, error)

DecryptNoebs given a private key and payload to EBS compatible RSA payload you must provide the payload in:

msg := uuid + pin

so that it is compatible with EBS' standard encryption

func Encrypt

func Encrypt(pubkey string, payload string) (string, error)

Encrypt given a public key and payload, encrypt encrypts to EBS compatible RSA payload you must provide the payload in:

msg := uuid + pin

so that it is compatible with EBS' standard encryption

func EncryptNoebs

func EncryptNoebs(pubkey string, payload string) (string, error)

EncryptNoebs given a private key and payload to EBS compatible RSA payload you must provide the payload in:

msg := uuid + pin

so that it is compatible with EBS' standard encryption

func Sign

func Sign(privkey string) (string, error)

Sign is a reference implementation of how our signing and verification works it is used by noebs clients (android app) to send signed messages that we can verify in noebs to ensure that the message is actually correct. Note that: - we don't really sign a message, it is always hardcoded - we used sha256 to sign the hash of the message, instead of the actual message WE expect that the client side will abide by this same interface we are designing here

NOTES

Ideally, implementer should use a secure mechanism to generate private - public keys and sign messages. In android, this is done via `Android keystore`, in particular

val ks: Keystore = Keystore.getInstance("AndroidKeyStore").apply {
	load(null)
}
val aliases: Enumeration<String> = ks.aliases()

Using secure facilities such as android keystore offers the utmost level of security and ensures our compliance with payment standards.

func Verify

func Verify(pubkey string, signature, message string) (bool, error)

Verify used by noebs systems to verify the authenticity of the clients. We are currently using it to ensure that noebs mobile clients are valid (providing their keys are valid) this is a rather very tricky api, but it is the only way we can ensure a simple way of authenticating our users

pubkey is base64 string encoding for the public key! [signature]: is base64 encoded [message]: is the message that we want to sign

func VerifyWithHeaders

func VerifyWithHeaders(pubkey string, signature, message string) (bool, error)

VerifyWithHeaders appends a ----Begin of Public---- into a public key string and pass over to Verify