Cryptography & On-Chain
In-transit protection is inherent in HTTPS/SSL. Cryptography adds at-rest protection: detecting manipulation, encrypting sensitive data, and anchoring high-value records to the blockchain.
The platform is non-prescriptive about your scheme, and provides helper methods for storing keys and ciphertext.
Hash a record with your private key and store the signature on the record. On retrieval the view-controller checks the hash before using the data.
Store your public key in your space and encrypt sensitive data with it. Decrypt locally in JavaScript with the matching private key.
The entityOS SDK includes utility functions using the crypto-js library and the AES algorithm within its _util.protect namespace.
AES, SHA-256, SHA-512 and MD5 — for signatures and integrity checks.
RSA for asymmetric signing and key exchange.
CORE_PROTECT_KEY stores public keys within your space.
CORE_PROTECT_CIPHERTEXT stores hashes and encrypted data in the context of a record.
A symmetric (single private key) manipulation-protection pattern with MVC and entityOS.
Generate a private key and store it on the secure local device using the browser localStorage API — not in entityOS, which would reduce the value of the protection.
Retrieve the key and, using selected data-record attributes (typically including modified date), create a SHA-512 hash that acts as a digital signature.
POST the hash to entityOS using CORE_PROTECT_HASH_MANAGE, keeping it in the context of the data via CORE_PROTECT_CIPHERTEXT.
On read, recompute the SHA-512 hash and compare it with the stored signature. If they match, the data is valid and un-manipulated.
For records that must be immutable — such as a certificate of approval to a standard — the off/on-chain service anchors a hash of the data to the blockchain.
Initialise once: generate and store a key off-chain and on-chain. In use: hash the data, store it off-chain in entityOS, and anchor the hash on-chain for tamper-evidence.