Palm Vein Data Encryption & Key Management
Know what the SDK encrypts, what your team implements, and who controls the image encryption keys.
What is already encrypted?
| Data | Encryption & responsibility | Independent flag |
|---|---|---|
| Palm features | The feature-value SDK outputs encrypted feature data using built-in AES-256-CBC encryption. | is_encrypted |
| Palm images | Your team implements image encryption using AES-256-GCM, with a key generated and managed by your organisation. | is_image_encrypted |
These flags are independent. Encrypted feature output does not mean the palm images have also been encrypted. Set each flag to match its corresponding payload.
Why does X-Telcom not provide the image key?
Your organisation generates and manages the image encryption key, so X-Telcom does not supply or retain it. Your deployment or security team controls how the key is configured and made available to authorised application components.
Generate
Your security or deployment team generates a random 32-byte AES-256 key.
Configure
On the server, encode the key using standard Base64 and assign it to IMAGE_ENCRYPTION_KEY_B64.
Implement
The client-side encryption uses the same 32-byte key after Base64 decoding. Your team manages secure key provisioning and access.
Encoding a key in Base64 does not encrypt or protect it. Keep production keys out of public code, logs and support messages.
Will your encrypted images work with the server?
Start with the original bytes
Treat the palm image as binary data and encrypt it using your AES-256-GCM implementation.
Check the round trip
Decrypt your test payload and confirm that the recovered bytes exactly match the original image.
Test the server path
Confirm the encrypted payload works with your deployed algorithm service. Check key configuration, API formatting and the image encryption flag.
Using the same algorithm name alone does not verify payload compatibility. Confirm the IV/nonce, authentication tag, AAD and payload layout against the supplied interface documentation before production use.
Keep encryption responsibilities clear.
This page covers the large-model integration. The SDK provides feature encryption; your team implements image encryption and manages its keys. These controls do not replace your application, transport or infrastructure security policies.
Discuss Your Encryption Requirements ↗