Cryptographic Authentication

Cryptography is a large subject matter. There many different types of cryptographic processes, each with their own

different purpose and type of math. In this tutorial, we are focusing on cryptographic authentication. On a very high

level, this usually involves data, digital signatures and verification. First, we must understand what a digital

signature is and how it is created. Second we must understand verification which includes the use of a

private/public key pair. Let's jump into digital signatures!

Digital signatures

A digital signature is quite similar to a hand-written signature. After you write a letter, you add your signature at the

bottom. Just like the hand-written signature, a digital signature is added to your data. When we say "added" we

mean that it is included as a separate chunk of data. So when sending some data with a digital signature, you

would send the data as one piece of data, and then you would also send the digital signature as a separate piece

of data. So this is the first difference to understand: digital signatures are like hand-written signatures, except they

don't live on the same piece of paper (they are a separate chunk of data).

Another big difference: to create a digital signature, you need a bit more than a pen. You actually need three

things:

1. Data: This is the data you want to sign. For this co-processor, we are going to sign 32 bytes of data. This is

essentially your "letter without a signature".

2. A Key: Is simply a unique chunk of data. The key lives on a protected part of the co-processors memory. It

was created during configuration. We will never have access to it. The idea of a single digital key is pretty

straight forward. It parallels the physical door key quite well. The chunk of data is unique, just like the

grooves and cuts of a physical key are unique.

3. An Algorithm: The complex math that we will offload to the co-processor. It is a particular type of

cryptographic math called Elliptic Curve Cryptography (ECC). Using our data and key, this algorithm will

output a digital signature.

One more thing: digital signatures will be different when you change your message. This is pretty different than the

traditional idea of a signature. When we think of hand-written signatures, we think that the entire purpose is for it to

be exactly the same every time. The author should be the only one who can hold the pen like so and make that

unique signature. With digital signatures we need to think a bit differently. Remember that we are sending our

message (and a key) into an algorithm. This will result in a new and different signature if the message or key

changes. In most cases, a digital signature is always unique from all other previous digital signatures.

So that was easy enough, right? Good. Digital signatures aren't so scary now. But what would we want to do with

one of these? Verify it.

Verification

Verification of a digital signature is quite similar verifying a hand-written signature. In both cases, we want to

determine if the signature is authentic. With a hand-written signature, you might just use your eyes to see if it looks

correct. With a digital signature we need to use a bit more than our eyes. We need the data, the signature, a key,

and an algorithm (sound familiar?). Simple enough, right? Well this is where it starts to get slightly more complex.

We need to understand one more concept: the idea of key pairs.

Up until this point, we have called the "key" simply a "key", but to be more accurate, this should be called the

private key. And it is part of a key pair. When we configure the co-processor it actually creates a key pair which

includes two keys: one private key and one public key. These two keys work together, and they allow us to sign