This article is valid for Smart ID Identity Manager 24.R1 or later.
IDM 24.R1 makes a number of significant changes compared to earlier releases!
Please review this document and its related pages carefully before proceeding with a fresh installation or upgrade.
Important: Most descriptors need to have their certificates and keys bootstrapped before starting the application(s) for the first time.
The sign and encrypt engine is the central component of Identity Manager for signing, verification and encryption using keys and certificates. It handles several use cases, and most of them have to be configured for each deployment, so that the private keys are kept secret. The keys themselves can be stored in files or preferably on a Hardware Security Module (HSM) for increased security.
The use cases the engine handles include:
Encryption and decryption of fields in the Identity Manager database (“encryptedFields“)
Signing and verification of the object history (“objectHistorySigner“)
Signing and validation of the configuration files (“configZipSigner“)
Encryption of the configuration files (“configZipEncrypter“)
Signing and encryption of emails (“signEmailDescriptor“) Does the engine really handle email encryption?
Creation of device encryption certificates that are used in Smart ID messaging (“hermodDeviceEnc“)
Creation of JWS signatures used for Smart ID messaging content provider API (“ContentProviderJWSSigner“)
Authentication of Smart ID Self-Service users to the Identity Manager backend (“SelfServiceJWTSigner“)
Decryption of PIN blobs from pre-personalized smart-cards created with the Personal Desktop Client
Attestation for provisioning to Smart ID Mobile / Desktop Apps (“att_*“)
The sign and encrypt engine provides a consistent configuration of keys and certificates for both signing and encryption. You can define algorithms and parameters and reference keys from an HSM (for most use-cases) or from PKCS#12 files (for all use cases).