Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# GatewaySecurityPhraseToken

GatewaySecurityPhraseToken

A GatewaySecurityPhraseToken is used to elevate the authentication level associated with a user's User ID/password from 1 to 1.5. This is important because a service may be configured such that the user must have at least an authentication level of 1.5 to to enrol in the service.

The Portal/ISV application first authenticates the user with the Gateway using the user’s supplied User ID/password to obtain a standard (i.e. authentication level 1.0) GatewayToken, The 3 characters the user provides from their security phrase are then incorporated into a GatewaySecurityPhraseToken which is sent, along with the user's standard GatewayToken, to the Security Token Service (STS). Provided the characters are correct, the STS returns a new GatewayToken with an authentication level of 1.5. For details see Logging on to Gateway Using a Security Phrase.

An example of a GatewaySecurityPhraseToken is given below:

    <gateway:GatewaySecurityPhraseToken
      xmlns:gateway="urn:GSO-System-Services:external:1.67:gatewaysecurityphrasetoken"
      gateway:TokenId="SecurityToken-3fcbdc48-9f81-4b26-8113-e4216183c98a">
      <gateway:AnswerCharactersDigest>iPpP5bowO7KmB/BaS1UGxUGBtMg=</gateway:AnswerCharactersDigest>
      <wsse:Nonce>qlGlKLuEaVbFWQeKFWjgvw==</wsse:Nonce>
      <wsu:Created>2005-11-21T16:06:00Z</wsu:Created>
    </gateway:GatewaySecurityPhraseToken>

Calculating the Answer Character Digest

Once the answer characters have been lowercased and converted into a UTF-8 this is then used to calculate the digest value required by the GatewaySecurityPhraseToken.

To create the digest value, the two additional nodes in the GatewaySecurityPhraseToken are used:

- Nonce - this is a random value
- Created - this is the timestamp (the Gateway will reject timestamps older than five minutes)

The digest value is calculated as follows: AnswerCharactersDigest = Base64 (SHA-1 (nonce + created + answer characters))

That is, concatenate the nonce, creation timestamp, and answer characters, digest the combination using the SHA-1 hash algorithm, then Base64 encode the result. This helps obscure the password and offers a basis for preventing replay attacks.

Note:

- The nonce is hashed using the octet (i.e. eight-bit byte) sequence of its decoded value while the timestamp is hashed using the octet sequence of its UTF-8 encoding as specified in the contents of the element.

© Crown Copyright 2008. All rights reserved