UR Codes - Keys & Digital Signatures

Learn more about the Supported Curves and the Public/Private Key Pairs that can be used to generate and validate a UR Code's Digital Signature.

UR Codes - Supported Curves

FaceTec currently supports two curves for the Digital Signature embedded in UR Codes.

  1. The secp256k1 curve (the same curve used to secure Bitcoin, and referenced in NIST SP 800-186).
  2. The ed25519 curve (another curve recommended by NIST).

Secp256k1 vs. Ed25519

Both the secp256k1 curve and ed25519 curve are widely used within Software Applications. While both are considered secure Digital Signature Schemes, there are some differences between the two. FaceTec recommends using the one that best suits your requirements.

Curve TypeAdvantagesDisadvantages
Secp256k1
  • Very well-tested due to its prevalent use in cryptocurrency.
  • There is effectively a ~2 Trillion dollar bounty to bypass secp256k1, as this would allow Bad Actors to steal BTC and other cryptocurrency.
  • Developed independently from government agencies.
  • Although mentioned as acceptable in NIST SP 800-186, it is not in NIST's "recommended" curve list.
  • Not mentioned in FIPS 186-5.
Ed25519
  • Generally considered to be secure.
  • Many implementations exist and are very solid and have been well-tested.
  • Developed independently from government agencies.
  • Compliant with NIST's latest recommendations.
  • Estimated to be less-used than secp256k1 due to its prevalence in cryptocurrency.

Generating a Secp256k1 Public/Private Key Pair

Private Key:

openssl ecparam -genkey -name secp256k1 | openssl pkcs8 -topk8 -nocrypt -out secp256k1_private_key.pem

Public Key:

openssl ec -pubout -in secp256k1_private_key.pem -out secp256k1_public_key.pem

Generating a Ed25519 Public/Private Key Pair

Private Key:

openssl genpkey -algorithm ed25519 -out ed25519_private_key.pem

Public Key:

openssl pkey -in ed25519_private_key.pem -pubout -out ed25519_public_key.pem

Configuring the UR Code Private Key

Use FaceTecInitializationConfig.urCodeSignaturePrivateKey (String) to configure your ECDSA Private Key.  FaceTec is working on enhanced configuration options for Private Key Security for the initial release of UR Codes.

Verifying UR Code Digital Signatures With Your Own Cryptography

FaceTec's UR Code Verification Function is a convenience function that uses standard cryptography to verify the UR Code Data and the digital signature using the UR Code Public Key.

FaceTec encourages Partners & Customers to perform their own cryptographic verification of UR Codes to prove that cryptographic operations are correct.

FaceTec also provides OpenSSL sample code and a sample NodeJS App that demonstrates cryptographic verification of UR Codes using 100% open source tools and code.

Extracting the Digital Signature from the UR Code:

/verify-ur-code returns the UR Code Digital Signature as text. The Digital Signature can be saved and verified using standard cryptography libraries. 

UR Codes are an open format, and the Digital Signature can be retrieved via parsing. FaceTec provides a command line script in the Server SDK to demonstrate how to extract the Digital Signature using parsing.

./extract_signature_from_ur_code.sh UR_CODE_DATA.txt > UR_CODE_SIG.txt

Verifying a UR Code Digital Signature using Open SSL:

The example below shows how to use OpenSSL to verify the UR Code Digital Signature:

openssl dgst -verify UR_CODE_KEY.pub -keyform PEM -sha256 -signature UR_CODE_SIG.txt -binary UR_CODE_DATA.txt