7.40.2.5 EccEncryptedSecret DataType

The EccEncryptedSecret uses ECC based Asymmetric Cryptography.

Additional semantics for the fields in the EncryptedSecret layout for the EccEncryptedSecret Structure are described in Table 186.

The EccEncryptedSecret uses ECC or RSA Diffie-Hellman (RSA-DH) Finite Field Group EphemeralKeys to create the symmetric key used to encrypt the Secret. The handshake required to create and use the EphemeralKeys is described in OPC 10000-6.

Table 186 – EccEncryptedSecret Layout
NameTypeDescription
TypeIdNodeIdThe NodeId of the EccEncryptedSecret DataType Node.
EncodingMaskByteSee Table 183
LengthUInt32See Table 183
SecurityPolicyUriStringSee Table 183
CertificateByteString

The signing Certificate encoded in DER form.

The value shall include the entire chain.

This value may be null or empty if the SigningCertificate is known to the receiver. This is true if the structure is used to provide a UserIdentityToken to a Server over a SecureChannel and the SigningCertificate is the Client ApplicationInstance Certificate.

SigningTimeDateTimeSee Table 183
KeyDataLengthUInt16The length of the KeyData without encryption.
KeyDataThe KeyData is not encrypted.

SenderPublicKey

ByteStringThe Public Key for the EphemeralKey created by the sender.

ReceiverPublicKey

ByteStringThe Public Key for the EphemeralKey created by the receiver.
NonceByteStringA Nonce. This is the last ServerNonce returned in the CreateSession or ActivateSession Response when proving a UserIdentityToken passed in the ActivateSession Request. In other contexts, this is a Nonce created by the sender with a length between 32 and 128 bytes inclusive and it is not checked by the receiver.
SecretByteStringSee Table 183
PayloadPaddingByte [*]See Table 183
PayloadPaddingSizeUInt16See Table 183
SignatureByte [*]The Signature calculated using the Certificate and the AsymmetricSignatureAlgorithm. The data to sign is shown in Figure 39.