A protected item is defined by the structure in the dongle memory called descriptor. The descriptor contains fields describing the type of data stored in the protected item, its properties, status, activation/deactivation passwords and passwords for executing operations with data.
A protected item/hardware algorithm is addressed by its numerical name. Number name is a 2-byte identifier kept in a special table of item number names and algorithms (Algorithm Root Table, ART). A number name allows identifying the item regardless what memory area is occupies, since the items can be placed randomly in the memory.
| Field offset from the beginning of descriptor | Field length (bytes) | Field name | Field description |
|---|---|---|---|
| 00h | 1 | rs_LoFlags | Lower byte of flags, see nsafl_xxx |
| 01h | 1 | rs_algo | Algorithm type, see rs_algo_XXXX |
| 02h | 2 | ReservedForEven | Reserved |
| 04h | 4 | rs_HiFlags | More flags, see nsafh_xxx |
| 08h | 4 | rs_klen | Data size of protected item or dongle (determinant) algorithm in bytes (rs_K[]) |
| 0C | 4 | rs_blen | Size of data block for hardware algorithm |
| 10 | 8 | rs_hash | This field is reserved and must be filled with 0 |
| 18 | 4 | rs_ActivatePwd | Activation password (if flag nsafl_ActivationSrv exists) |
| 1C | 4 | rs_DeactivatePwd | Deactivation password (if flag nsafl_DeactivationSrv exists) |
| 20 | 4 | rs_ReadPwd | Password for reading fields rs_GP, rs_ErrorCounter, rs_K[] using GrdPI _Read function (if flag nsafh_ReadPwd exists) |
| 24 | 4 | rs_UpdatePwd | Password for updating field rs_GP, rs_ErrorCounter, rs_K[] using GrdPI_Update function(if flag nsafh_UpdateSrv exists) |
| 28 | 6 | rs_BirthTime | |
| 2E | 6 | rs_DeadTime | |
| 34 | 8 | rs_Lifetime | |
| 3C | 8 | rs_FlipTime | |
| 44 | 4 | rs_GP | Reverse counter |
| 48 | 4 | rs_ErrorCounter | Permissible number of password entry attempts (if one of the following flags exists: nsafl_ ActivationSrv, nsafl_DeactivationSrv or nsafl_ UpdateSrv) |
| 4C | rs_klen | rs_K[] | Protected item data or algorithm determinant sized rs_klen |
Field rs_LoFlags contains lower byte of flags defining the properties of protected items. The following flags can be set (flag names listed below are used in Guardant API):
| Flag name | Value | Comment |
|---|---|---|
| nsafl_ID | 1 | |
| nsafl_GP_dec | 2 | Decrements GP counter on each algorithm call. Once GP counter reaches 0, algorithm is automatically deactivated and returns error code GrdE_InactiveItem in response to further calls |
| nsafl_GP | 4 | Not used for modern dongles |
| nsafl_ST_III | 8 | Flag should be set for modern dongles |
| nsafl_ActivationSrv | 16 | Activation service available |
| nsafl_DeactivationSrv | 32 | Deactivation service available |
| nsafl_UpdateSrv | 64 | Password-protected service for changing data in items rs_K[] available (GrdPI_Update function supported) |
| nsafl_InactiveFlag | 128 | Algorithm/cell is inactive at the moment. Operations GrdTransform, GrdPI_Read, GrdPI_Update not available |
| Flag name / Algorythm type | AES128,GSII64 | ECC160 | SHA256 | Loadable Code | Protected Item |
|---|---|---|---|---|---|
| nsafl_ID | + | - | - | - | - |
| nsafl_GP_dec | + | + | + | + | - |
| nsafl_GP | - | - | - | - | - |
| nsafl_ST_III | + | + | + | + | - |
| nsafl_ActivationSrv | + | + | + | + | + |
| nsafl_DeactivationSrv | + | + | + | + | + |
| nsafl_UpdateSrv | + | + | + | + | + |
| nsafl_InactiveFlag | + | + | + | + | + |
| nsafh_ReadSrv | + | + | + | + | + |
| nsafh_ReadPwd | + | + | + | + | + |
| nsafh_BirthTime | + | + | + | + | - |
| nsafh_DeadTime | + | + | + | + | - |
| nsafh_LifeTime | + | + | + | + | - |
| nsafh_FlipTime | + | - | - | - | - |
Field rs_algo contains protected item type code.
The following protected item type codes available for Guardant Sign/Time/Net dongles:
Flag name Value Comment 0-4 Reserved rs_algo_GSII64 5 Symmetrical data encryption algorithm. 128 or 256-bit secret key rs_algo_HASH64 6 Calculation of 64-bit hash. 128 or 256-bit secret key rs_algo_RND64 7 Generation of 64-bit random number rs_algo_PI 8 Protected item rs_algo_GSII64_ENCRYPT 10 rs_algo_GSII64_DECRYPT 11 rs_algo_ECC160 12 rs_algo_AES128 13 rs_algo_SHA256 15 The following protected item type codes available for Guardant Code/Code Time:
Flag name Value Comment rs_algo_PI 8 Protected item rs_algo_ECC160 12 rs_algo_AES128 13 rs_algo_LoadableCode 14 rs_algo_SHA256 15 rs_algo_AES128Encode 16 rs_algo_AES128Decode 17