LogoLogo
  • Introduction
  • Getting Started
  • SenseCrypt Server
    • Starting the server
    • Configuration
    • Licensing and Authorization
    • Using the Swagger Docs page
    • Authorization
    • Using a JWT Token for Mobile Authorization
    • Getting information about your license
    • SenseCrypt eID
      • Generating your first SensePrint eID QR
      • Generating a raw SensePrint
      • Decrypting a raw SensePrint
      • Parsing a SensePrint
    • SenseCrypt Face PKI
      • Configuration
      • Accessing your Root Certificate
      • Generate your first Face Certificate
      • Verifying a Face Certificate
      • Encrypting Data/Keys using a Face Certificate
      • Face Decrypting Data/Keys
      • Face Signing
      • Face Signature Verification
    • Accessing the server for testing
    • Liveness Image Requirements
  • SenseCrypt Mobile SDKs
    • Licensing
    • Authorization for Online SDKs
    • Liveness and Face Capture
    • Android SDK
    • iOS SDK
  • Conclusion
  • FAQ & Search
  • Appendix
    • Privacy Preserving Biometric Verifiability
    • Principles of Privacy Preserving Face Verification
    • Foundational vs Functional eID
Powered by GitBook
On this page

Was this helpful?

Export as PDF
  1. SenseCrypt Server
  2. SenseCrypt Face PKI

Encrypting Data/Keys using a Face Certificate

How to use Face Certificates to encrypt keys

PreviousVerifying a Face CertificateNextFace Decrypting Data/Keys

Last updated 9 months ago

Was this helpful?

As a Face Certificate contains a public key, it can be used to encrypt data. To decrypt the encrypted data, a user would, then, need the right private key.

This private key can only be generated from the user's face, SensePrint, and the purpose ID specified to generate the Face Certificate.

Hence, encrypted data can only be decrypted via a live Face Scan of the intended recipient.

The type of key contained in a Face Certificate is an Elliptic Curve Cryptography (ECC) key based on the Secp256k1 (Bitcoin) curve.

It is possible to directly use the public key in the Face Certificate to encrypt any arbitrary size of data using an implementation of Elliptic Curve Integrated Encryption Scheme (ECIES) in a programming language of your choice.

However, to make life simpler, we offer an end-point to encrypt data using a Face Certificate.

As a web end-point, we restrict the size of data to be encrypted. However, we suggest that instead of encrypting a large amount of data directly, the end-point can be used to encrypt a symmetric key or the private key from an assymetric key pair.

Then the encrypted key can be stored side by side with encrypted data. To decrypt the data, the steps needed would be:

  1. Decrypt the encrypted key using a SensePrint, Face, and Purpose ID

  2. Decrypt the encrypted data using the decrypted key in step 1

As before, on the Swagger Docs page authorize using the API Key you setup earlier.

Expand the /encrypt-with-face-certificate section and then click the Try it out button as shown below:

Upon clicking Try it out you should be able to submit the data as shown below:

{
  "face_certificate_pem": "-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----",
  "key_base_64": "MHQCAQEEIKu0Xuf...."
}

Please note that when you generate a Face Certificate, it is returned with line breaks. When you submit it through the Swagger Docs page, those line breaks need to be replaced with escaped \n characters to be a proper JSON representation.

However, if you submit the Face Certificate programaitically, you would not need to manually replace the line breaks with \n.

Encrypting a key using a Face Certificate