Skip to main content

Key-Pair Authentication

Key-pair authentication is used for Non-Government Entities (NGE) / 3rd Parties (3P) to authenticate to the DataHive API endpoint for data access. This authentication method requires, as a minimum, a 2048-bit RSA key pair. The NGE can generate the Privacy Enhanced Mail (PEM) private-public key pair using OpenSSL. The public key will need to be shared with DataHive to be assigned to the NGE user, while the private key must be stored securely by the NGE, and shall not be shared with DataHive or any other parties.

System Prerequisites​

There is no system prerequisite for macOS or Linux. For Windows users, please install Git Bash.

Generate Key Pair (with Passphrase)​

It is recommended to encrypt your private key with a passphrase for better security.

Private key​

To start, open a terminal window. If you are using a Windows machine, open a Git Bash terminal.

To generate an encrypted private key, use the following command and replace YourPassphraseHere with a passphrase of your choice.

openssl genrsa -aes256 -passout pass:YourPassphraseHere -out rsa_key.p8 2048

The commands generate a private key rsa_key.p8 in PEM format.

-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIE6T...
-----END ENCRYPTED PRIVATE KEY-----

Public Key​

From the command line, generate the public key by referencing the private key. The following command assumes the private key is encrypted and contained in the file named rsa_key.p8. Replace YourPassphraseHere with the passphrase you just used for generating your private key.

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub -passin pass:YourPassphraseHere

The command generates the public key rsa_key.pub in PEM format.

-----BEGIN PUBLIC KEY-----
MIIBIj...
-----END PUBLIC KEY-----

Generate Key Pair (without Passphrase)​

While it is recommended to use an encrypted key, you may also choose to generate an unencrypted version.

Private key​

Please run the following command in your terminal.

openssl genrsa -out rsa_key.p8 2048

The commands generate a private key rsa_key.p8 in PEM format.

-----BEGIN PRIVATE KEY----- # pragma: allowlist secret
MIIE6T...
-----END PRIVATE KEY-----

Public Key​

Generate the public key by referencing the private key.

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

The command generates the public key rsa_key.pub in PEM format.

-----BEGIN PUBLIC KEY-----
MIIBIj...
-----END PUBLIC KEY-----

Next Steps​

The NGE/3P may proceed to share the public key rsa_key.pub with the data requestor (i.e. Agency) to complete the data request. DataHive will assign this public key to the specified NGE/3P user. Make sure to include the ---BEGIN PUBLIC KEY--- and ---END PUBLIC KEY--- lines when sharing the public key.

Note that the private key file must be stored in a secure location by the NGE/3P. The NGE/3P must not share the private key outside of its organisation.