> For the complete documentation index, see [llms.txt](https://developer.gotadi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.gotadi.com/english/b2b2c-partner/webview-method/security-requirements.md).

# Security Requirements

### **SSL/HTTPS Transmission Channel**

SSL/HTTPS is applied for data transmission between the partner's system and Gotadi. The purpose of using SSL/HTTPS is to ensure that the exchanged data is encrypted, making it difficult to be stolen or forged.

### Security Headers and Traffic Monitoring

All requests from the partner system to Gotadi must include the following headers to support Gotadi's security operations and data analytics:

```
apikey: <api_key>
x-ibe-req-name: <access_code>
```

**Note**

The values of `<api_key>` and `<access_code>` are provided by Gotadi to the Partner.

### Data Encryption and Digital Signature Authentication

The request/response between Gotadi and the Partner for certain critical APIs requires encryption using the **asymmetric 3DES encryption algorithm** and includes a **digital signature** for authentication. The encryption and decryption algorithms will be described in detail in this document.

**Notes:**

* APIs that require data encryption and digital signatures will be specified in the **Security Requirements** section.

#### **Outgoing Data Encryption**

* **Input:**
  * Original data
  * RSA Public Key of the recipient
  * RSA Private Key of the sender
* **Output:**
  * Encrypted Key
  * Encrypted Data

<details>

<summary>Step 1: Generate a Random Key</summary>

![](/files/RFdXSrBKfHqQ3Pb83rEE)

The **3DES Key Generate** function is used to create a **random key** based on the **DESedeKeySpec** standard (**Key length: 24 bytes**). Each **request/response** will be assigned a unique **random key** to ensure security and prevent replay attacks..

#### Example:

```javascript
    public static byte[] generateKey() throws Exception {
        KeyGenerator keyGenerator = KeyGenerator.getInstance("DESede");
        SecretKey secretKey = keyGenerator.generateKey();
        SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance("DESede");
        DESedeKeySpec deSedeKeySpec = (DESedeKeySpec)   secretKeyFactory.getKeySpec(secretKey, DESedeKeySpec.class);
        byte[] randomKey = deSedeKeySpec.getKey();
        return randomKey;
    }
```

</details>

<details>

<summary>Step 2: Encrypted random key</summary>

![](/files/e5U1faHd5mKFzLfWzY7X)

The **random key** generated in Step 1 will be encrypted using the **asymmetric encryption algorithm RSA** with the **receiver’s Public Key**.

#### Example:

```javascript
public static String encryptRSA(byte[] randomKey, String xmlPublicKey) throws Exception {
    Cipher cipher = createCipherEncrypt(xmlPublicKey);
    byte[] encryptedKey = cipher.doFinal(randomKey);
    return Base64.encodeBase64URLSafeString(encryptedKey);
}
```

</details>

<details>

<summary>Step 3: Signature</summary>

![](/files/zin1m5qbAqwYD2rh8bxR)

The **sender** applies the **RSA-SHA256 algorithm** combined with its own **Private Key** to generate the **digital signature** on the **signature data**.

**Note:**\
The schema for constructing the **signature data** will be specifically described for each API.

#### Example:

```java
public static String signRSA(String signatureData, String xmlPrivateKey) throws Exception {
    PrivateKey privateKey = getPrivateKeyFromXML(xmlPrivateKey);
    Signature instance = Signature.getInstance("SHA256withRSA");
    instance.initSign(privateKey);
    instance.update(signatureData.getBytes("UTF-8"));
    byte[] signature = instance.sign();
    return Base64.encodeBase64String(signature);
}
```

</details>

<details>

<summary>Step 4: Encrypted data</summary>

![](/files/7DoQbHIjfvjzdRDjJTJw)

The **Original Data**, which includes the **signature**, will be **encrypted using the 3DES algorithm** with the **random key** generated in the previous step.

**Note:**\
The **schema** for constructing the **Original Data** will be specifically described for each API.

#### Example:

```javascript
public static String encryptTripleDes(String originalData, byte[] randomKey) throws Exception {
    Cipher cipher = Cipher.getInstance("DESede");
    SecretKeySpec secretKeySpec = new SecretKeySpec(randomKey, "DESede");
    cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);
    byte[] encryptedData = cipher.doFinal(originalData.getBytes("UTF-8"));
    return Base64.encodeBase64URLSafeString(encryptedData);
}
```

</details>

#### **Decrypting Received Data and Verifying Digital Signature**

**Input:**

* **Encrypted Key**
* **Encrypted Data**
* **RSA Private Key** (of the recipient)
* **RSA Public Key** (of the sender)

**Output:**

* **Original Data**
* **Verification Result**

<details>

<summary>Step 1: Decrypted random key</summary>

![](/files/DSwaXG1fA9SEjRjlIwx2)

The recipient **uses their own Private Key** to decrypt the received **Encrypted Key**.

#### Example:

```java
public static byte[] decryptRSAToByte(String encryptedKey, String xmlPrivateKey) throws Exception {
    Cipher cipher = createCipherDecrypt(xmlPrivateKey);
    byte[] bts = Base64.decodeBase64(encryptedKey);
    byte[] randomKey = cipher.doFinal(bts);
    return randomKey;
}
```

</details>

<details>

<summary>Step 2: Decrypted data</summary>

![](/files/lDWqmxvL61iTMZUx9hTF)

The recipient applies the **3DES algorithm** using the **random key** obtained in the previous step to decrypt the **Encrypted Data**, retrieving the **Original Data**, which contains the **signature**.

**Note:**\
The **schema** for constructing the **Original Data** will be specifically described for each API.

#### Example:

```java
public static String decryptTripleDes(String encryptedData, byte[] randomKey) throws Exception {
    Cipher cipher = Cipher.getInstance("DESede");
    SecretKeySpec secretKeySpec = new SecretKeySpec(randomKey, "DESede");
    cipher.init(Cipher.DECRYPT_MODE, secretKeySpec);
    byte[] originalData  = cipher.doFinal(Base64.decodeBase64(encryptedData));
    return new String(originalData, "UTF-8");
}
```

</details>

<details>

<summary>Step 3: Verify the electronic signature</summary>

![](/files/QiaWWe7L3PsOBj0h2Eiw)

The recipient applies the **RSA-SHA256 algorithm** along with the **sender’s Public Key** to verify the **signature** extracted from the **Original Data**.

#### Example:

```java
public static boolean verifyRSA(String signedData, String signature, String xmlPublicKey) throws Exception {
    PublicKey publicKey = getPublicKeyFromXML(xmlPublicKey);
    Signature instance = Signature.getInstance("SHA256withRSA");
    instance.initVerify(publicKey);
    instance.update(signedData.getBytes("UTF-8"));
    return instance.verify(Base64.decodeBase64(signature));
}
```

</details>

<br>