DAT Certificate ​

1. Overview (Introduction) ​

A DAT Certificate is a specification for controlling the authority to issue DAT (Data Authentication Token) and for managing the signing and encryption algorithm and key information used by tokens.

Each certificate has a unique ID (CID) and safely manages the token lifecycle by enforcing the issuance period of DATs and the default time-to-live (TTL) of generated tokens.

2. Certificate Structure (Structure) ​

2.1. Field Specifications ​

CID : Hex (uint64)

• A unique Certificate ID that identifies the certificate. It maps to the CID field of a DAT to determine which certificate to use during validation.

DAT Issuance Start : uint64 (Unix Time)

• Represents the start time from which DATs can be issued using this certificate, expressed in seconds (Unix Time).

DAT Issuance Duration : uint64 (Seconds)

• The issuance validity period of the certificate. After this duration (in seconds) has elapsed since DAT Issuance Start, no new DATs can be issued using this certificate.

DAT TTL (Time To Live) : uint64 (Seconds)

• The default validity period (Time To Live) of DATs issued with this certificate. When creating a DAT, the expire value is set to the issuance time (current time) plus dat-ttl.

Signature Algorithm : String / Enum

• The signing algorithm used to generate and verify the signature field of a DAT.

Crypto Algorithm : String / Enum

• The encryption algorithm used to encrypt and decrypt the secure field of a DAT.

Signature Key : Base64Url (Binary)

• Key data used for signing and verification. (Depending on the algorithm, this may be the Public/Private Key of an asymmetric key pair or a symmetric key.)

Crypto Key : Base64Url (Binary)

• Encryption key data used for encrypting and decrypting the secure field.

3. Algorithm ​

Signature Algorithm ​

A list of signing algorithms used to prevent forgery and tampering of DATs.

Both symmetric and asymmetric key methods are supported.

ECDSA-P256

• Elliptic Curve Digital Signature Algorithm (NIST secp256r1)

ECDSA-P384

• Elliptic Curve Digital Signature Algorithm (NIST secp384r1)

ECDSA-P521

• Elliptic Curve Digital Signature Algorithm (NIST secp521r1)

HMAC-SHA256-MFS

• Keyed-Hashing based on a 256-bit Maximum Fixed Secret (MFS) key

HMAC-SHA384-MFS

• Keyed-Hashing based on a 384-bit Maximum Fixed Secret (MFS) key

HMAC-SHA512-MFS

• Keyed-Hashing based on a 512-bit Maximum Fixed Secret (MFS) key

MFS (Maximum Fixed Secret): A method that uses a fixed-size secret key whose bit length equals the output size of the hash algorithm.

Crypto Algorithm ​

A list of Authenticated Encryption algorithms used to protect confidential data (the secure field) inside a DAT.

The encryption output is structured as a combination of the IV and the encrypted data to prevent decryption and Replay Attacks.

IV-AES128-GCM

• IV(96bit) + Encrypted_Result(Binary)
• AES-GCM mode using a 128-bit key

IV-AES256-GCM

• IV(96bit) + Encrypted_Result(Binary)
• AES-GCM mode using a 256-bit key

IV (Initialization Vector) Embedding: To prevent Replay Attacks, a unique 96-bit NONCE (IV) generated for each encryption operation is prepended as a prefix to the encrypted result data and included in the binary output. During decryption, the first 96 bits are separated and used as the IV to perform decryption.