Cryptographic Token (PKI)

The VIDA Cryptographic Token leverages Public Key Infrastructure (PKI) to provide strong, tamper-proof authentication and transaction security. At the heart of this system is the Phone Token , a device-bound credential that uses cryptographic signing to ensure that only a user’s registered mobile device can authorise sensitive actions such as logins, payments, or high-risk operations.

Cryptographic signing ensures that a transaction request is authentic, tamper-proof, and verifiable. It uses public-key cryptography (asymmetric encryption), where a Private Key (held by the partner server) signs the transaction, and a Public Key (stored by VIDA) verifies it.

Key Pair Generation (During Registration)

• The VIDA CDK in the mobile app generates a key pair:

  • Private Key : Stored securely on the device .

  • Public Key : Sent to VIDA’s server for verification purposes.

• VIDA links the Credential ID with the Phone Token and stores the Public Key securely.

Transaction Signing Process

Step 1: User Initiates a Transaction

• The user tries to perform an action (e.g., login, payment, high-risk operation).

• The app collects transaction details (e.g., amount, recipient, timestamp).

Step 2: Hashing the Transaction Data

• The app creates a hash (fingerprint) of the transaction data using a secure hashing algorithm (e.g., SHA-256).

  • Example:

    Transaction Data: {"amount": 100, "to": "XYZ", "timestamp": 1700000000}
    Hash Output: 4b227777d4dd1fc61c6f884f48641d02b07a7fc1

Step 3: Signing with the Private Key

• The Private Key (stored on the device) is used to encrypt the hash, creating a digital signature.

• The signature is unique to both:

  • The transaction data

  • The Private Key (ensuring only the authorized device can sign it)

Transaction Verification by VIDA

Step 1: Receiving the Signed Request

• The signed transaction (hash + signature) is sent to VIDA.

Step 2: Hash Recalculation

• VIDA recalculates the hash from the received transaction data to check for tampering.

Step 3: Signature Verification

• VIDA decrypts the digital signature using the Public Key (stored from registration).

• If the decrypted value matches the recalculated hash, it proves: - The transaction was signed by the registered device. - The data wasn’t tampered with.

• If verification passes, VIDA approves the transaction. If not, it is rejected.

---

Why is This Secure?

Only the authorized device can sign transactions (Private Key never leaves the device). Even if the transaction data is intercepted, it cannot be altered (hash mismatch would fail verification). The signature is unique for each transaction, preventing replay attacks.

This process ensures that only the user’s registered device can authorize the transactions.