Your 3D FaceScan, 3D FaceMap, and IDScan Encryption Keys

3D FaceScans, 3D FaceMaps, and IDScans are encrypted by default using a combination of Asymmetric RSA Encryption and Randomized AES-256 Encryption. Generating Your Own Private Key is required for Production Apps. This ensures that 3D FaceScans, 3D FaceMaps, and IDScans cannot be tampered with after they are created and that Your FaceTec Data cannot be accessed by those outside of Your Organization.

Once the Private Key is configured, the FaceTec Server automatically generates the Public Key for Your Team. The Public Key, which is retrieved during Initialization of the Device SDK, encrypts Your App's FaceTec Data before it is sent in the API Request. Once it is received, the FaceTec Server uses its Private Key to decrypt the FaceTec Data, so it can be processed and used by the FaceTec Server.

Requirements

To run FaceTec SDKs in Production, you are required to generate a Private Key and initialize the FaceTec Server with it.

Warning! Do not perform any of the steps in this guide until you have a fully functioning integration. Updating your keys is the last step before entering a Production Environment. Until you have reached this point, you should continue to use the default keys that FaceTec provides. Specifically, if you have not completed ALL of the steps in the Setting up the FaceTec Server Guide, then you should still be using the default keys.

Generating Keys

To create Your Private 3D FaceScan, 3D FaceMap, and IDScan Encryption Key, you first need to create your Private Key and place the Private Key into the FaceTec Server. Afterwards, you need to generate the Public Key from your Private Key and place the Public Key into the Device SDK.

The steps for Generating Keys can be found below. For a Video Tutorial of these steps, please see our Video Walkthrough for Generating Keys.

Step 1: Create your Private Key

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 | openssl pkcs8 -topk8 -nocrypt &> MyPrivateEncryptionKey.pem

Step 2: Place the Private Key into the FaceTec Server

Copy the PrivateFaceMapEncryptionKey in a format compatible with the config.yaml file. To get a compatible single line string, use the below command.

tr -d '\n' < MyPrivateEncryptionKey.pem

In config.yaml, replace the value to the right of faceMapEncryptionKey: with the Private Encryption Key output from above.

faceMapEncryptionKey: "-----BEGIN PRIVATE KEY----- Your-Private-Key -----END PRIVATE KEY-----"

Warning! Performing any of these steps incorrectly can cause the "Decryption was not possible" Error when processing files on the Server.
For more information on the "Decryption was not possible" Error, see our Encryption/Decryption Behaviors Guide.

Windows Users: Please see this guide to use openssl on windows.

Video Walkthrough for Generating Keys

Re-Encryption of 3D FaceMaps

If you need interoperability between your 3D FaceMaps and additional FaceTec Servers for verifying users against a 2D Database of Govt ID Photos, for sending the FaceMap via HTTPS to the Govt's. Server, or for any other authorized reason, you will use both your Public & Private Encryption Keys and the Public Key of the Govt's. FaceTec Server.

More information on Re-encryption & Interoperability