...
| Code Block | ||
|---|---|---|
| ||
<?xml version="1.0" encoding="UTF-8"?>
<engineSignEncrypt>
<descriptors>
<descriptor name="EncryptedFields" version="1">
<type algorithm="AES/CBC/PKCS7Padding" size="256" result="NX02" key="encCert"
asymCipher="RSA/None/OAEPWithSHA384AndMGF1Padding"/>
</descriptor>
<descriptor name="ConfigZipEncrypter" version="1">
<type algorithm="AES/CBC/PKCS7Padding" size="256" key="configZipEncrypterCert"
asymCipher="RSA/None/OAEPWithSHA384AndMGF1Padding"/>
</descriptor>
<descriptor name="ConfigZipSigner" version="1">
<type algorithm="SHA-256" key="configZipSignerCert" />
</descriptor>
<descriptor name="ObjectHistorySigner" version="1">
<type algorithm="SHA-256" key="objectHistorySignerCert" />
</descriptor>
<descriptor name="SignEmailDescriptor" version="1">
<type algorithm="SHA256withRSA" key="emailSigningCert" />
</descriptor>
<descriptor name="hermodDeviceEnc" version="1">
<type algorithm="SHA256withRSA" key="serverCert" />
</descriptor>
<descriptor name="SelfServiceJWTSigner" version="1">
<type algorithm="RSA" key="selfServiceJWTSignerCert" />
</descriptor>
<descriptor name="ContentProviderJWSSigner" version="1">
<type algorithm="RSA" key="contentProviderJWSSignerCert" />
</descriptor>
<descriptor name="att_external-attestation-1" version="1">
<type algorithm="SHA256withRSA" key="attestationKey_mobile_1" />
</descriptor>
<descriptor name="att_external-attestation-2" version="1">
<type algorithm="SHA256withRSA" key="attestationKey_mobile_2" />
</descriptor>
<descriptor name="att_external-attestation-3" version="1">
<type algorithm="SHA256withRSA" key="attestationKey_mobile_3" />
</descriptor>
<descriptor name="att_external-attestation-4" version="1">
<type algorithm="SHA256withRSA" key="attestationKey_mobile_4" />
</descriptor>
<descriptor name="att_ATTESTATION" version="1">
<type algorithm="SHA256withRSA" key="attestationKey_mobile_pda_def" />
</descriptor>
</descriptors>
<keys>
<key name="encCert">
<type name="pkcs12" locationValue="classpath:hybridEncKeypair.p12" pin="1234"/>
</key>
<key name="configZipEncrypterCert">
<type name="pkcs12" locationValue="classpath:encryptConfig.p12" pin="1234"/>
</key>
<key name="configZipSignerCert">
<type name="pkcs12" locationValue="classpath:signConfig.p12" pin="1234"/>
</key>
<key name="objectHistorySignerCert">
<type name="pkcs12" locationValue="classpath:sign.p12" pin="1234"/>
</key>
<key name="selfServiceJWTSignerCert">
<type name="pkcs12" locationValue="classpath:signJWT.p12" pin="1234"/>
</key>
<key name="contentProviderJWSSignerCert">
<type name="pkcs12" locationValue="classpath:signJWS.p12" pin="1234"/>
</key>
<key name="emailSigningCert">
<type name="pkcs12" locationValue="classpath:emailSigning.p12" pin="1234"/>
</key>
<key name="serverCert">
<type name="pkcs12" locationValue="classpath:deviceEncCA.p12" pin="1234"/>
</key>
<key name="attestationKey_mobile_1">
<type name="pkcs12" locationValue="classpath:attKeyMobile1.p12" pin="936584967"/>
</key>
<key name="attestationKey_mobile_2">
<type name="pkcs12" locationValue="classpath:attKeyMobile2.p12" pin="873145568"/>
</key>
<key name="attestationKey_mobile_3">
<type name="pkcs12" locationValue="classpath:attKeyMobile3.p12" pin="8564789632"/>
</key>
<key name="attestationKey_mobile_4">
<type name="pkcs12" locationValue="classpath:attKeyMobile4.p12" pin="9263564893"/>
</key>
<key name="attestationKey_mobile_pda_def">
<type name="pkcs12" locationValue="classpath:attKeyMobileDef.p12" pin="2586453793"/>
</key>
</keys>
</engineSignEncrypt> |
Descriptor
...
names
IDM references descriptors by their name. Most names are fixed (e.g. ConfigZipEncrypter is always used for encrypting configuration files) and a few can be named arbitrarily (e.g. descriptors for PIN blob decryption).
Descriptor
...
versioning
Some descriptors support multiple versions. For example, you can replace the key of the ObjectHistorySigner by adding a descriptor of this name with a newer version, and leaving the existing descriptor with the old version configured. This will cause any new signatures to be created with the new key, but you can still verify signatures made with the old one.
...
There are also descriptors which cannot be versioned, e.g. EncryptedFields. For those the version always needs to be set to 1.
...
Configuration elements
Descriptor
See the tables below the example for more information on the different possible attributes of a descriptor/-type.
...