---
title: Signing and verifying data with hardware (HRW)
description: Tag your own data with a hardware-backed HRW to prove integrity and device origin in one check, with sync, async, and session-key variants.
---
[Skip to content](https://portal.sandgrain.eu/knowledge-base/signing-and-verifying-data-with-hardware-hrw#main-content)
English
Show submenu for translations
.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1).png)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Contact us](https://portal.sandgrain.eu/login)
[Contact us](https://portal.sandgrain.eu/login?hsLang=en)
How can we help you?
- There are no suggestions because the search field is empty.
1. [Knowledge Base](https://portal.sandgrain.eu/knowledge-base?hsLang=en)
2. [SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en)
3. [Core Functions](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#core-functions)
October 6, 2026
# Signing and verifying data with hardware (HRW)
An **HRW** is a hardware-backed tag over data you choose: a sensor reading, a log record, a firmware hash, a message. The token computes it with its internal secret, so a valid HRW proves two things at once: the data is **unmodified**, and it was tagged by **that specific physical device**.
### **Two directions**
| Direction | How | Use when |
| --- | --- | --- |
| **Device tags, cloud verifies** | The token computes the HRW over your data; the cloud checks it against its HSM copy of the secret. | Proving field data came from a genuine device and wasn't altered in transit. |
| **Cloud derives (`hrwrequest`)** | You supply the data; the cloud computes what the HRW *should* be, for the host to compare. | Server-side verification of a tag received earlier, or pre-computing expected values. |
### **The six examples**
All live in [`examples/04-sign-and-verify-data/`](https://github.com/SandGrain-CyberRock/CyberRock-Core-Functions/tree/main/examples/04-sign-and-verify-data) and combine the standard suffixes:
| Script | Sync? | Also derives an EK? | EK delivery |
| --- | --- | --- | --- |
| [`hrwrequest.py`](https://github.com/SandGrain-CyberRock/CyberRock-Core-Functions/blob/main/examples/04-sign-and-verify-data/hrwrequest.py) | Polls | No | n/a |
| [`hrwrequest_priority.py`](https://github.com/SandGrain-CyberRock/CyberRock-Core-Functions/blob/main/examples/04-sign-and-verify-data/hrwrequest_priority.py) | Immediate | No | n/a |
| `hrwrequest_ek.py` | Polls | Yes | Plain (HTTPS) |
| [`hrwrequest_ek_priority.py`](https://github.com/SandGrain-CyberRock/CyberRock-Core-Functions/blob/main/examples/04-sign-and-verify-data/hrwrequest_ek_priority.py) | Immediate | Yes | Plain (HTTPS) |
| [`hrwrequest_ek_rsa2048.py`](https://github.com/SandGrain-CyberRock/CyberRock-Core-Functions/blob/main/examples/04-sign-and-verify-data/hrwrequest_ek_rsa2048.py) | Polls | Yes | RSA-2048 wrapped |
| [`hrwrequest_ek_priority_rsa2048.py`](https://github.com/SandGrain-CyberRock/CyberRock-Core-Functions/blob/main/examples/04-sign-and-verify-data/hrwrequest_ek_priority_rsa2048.py) | Immediate | Yes | RSA-2048 wrapped |
**Recommended starting point:** [`hrwrequest_priority.py`](https://github.com/SandGrain-CyberRock/CyberRock-Core-Functions/blob/main/examples/04-sign-and-verify-data/hrwrequest_priority.py): one synchronous call, no polling.
**Typical integration pattern**
1. Your device produces data worth protecting (a reading, an event, a file hash).
2. The host passes the data through the token, which returns the HRW tag.
3. Data + HRW travel to your backend by whatever channel you already use.
4. Your backend asks the CyberRock Cloud to verify (or derive) the HRW for that data and TID.
5. A match confirms integrity and hardware origin in a single check.
The `_ek` forms additionally leave both sides holding a session key when the exchange completes; useful when tagging data and establishing an encrypted channel in one round-trip.
See *Deriving a session key* for how EK delivery and the RSA-2048 envelope work.
### **Related flows**
- Attesting *firmware* specifically, with one token call per boot stage: see [*Secure boot attestation*](https://portal.sandgrain.eu/knowledge-base/secure-boot-attestation-proving-which-firmware-ran?hsLang=en).
- Tagging a whole *batch* of items with one verification: see [*Daisy chain*](https://portal.sandgrain.eu/knowledge-base/daisy-chain-covering-a-batch-of-items-with-one-verification?hsLang=en).
---
**Source code:** [SandGrain CyberRock - Core Functions on GitHub](https://github.com/SandGrain-CyberRock/CyberRock-Core-Functions/tree/main)
- [User Documentation](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#main-content)
- [Quick Starter Guide](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#quick-starter-guide)
- [User Manual](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#user-manual)
- [Whitepaper](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#whitepaper)
- [Token Leaflet](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#token-leaflet)
- [Claim Token Procedure](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#claim-token-procedure)
- [Daisy Chain](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#daisy-chain)
- [Release Note](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#release-note)
- [Naming Convention](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#naming-convention)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#sandgrain-sdk)
- [TrustBridge](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#trustbridge)
- [API Documentation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#main-content)
- [Device API Integration](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#device-api-integration)
- [Daisy Chain and Attestation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#daisy-chain-and-attestation)
- [SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#main-content)
- [Core Functions](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#core-functions)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#sandgrain-sdk)
[-1.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1)-1.png "SandGrain_Logo_RGB_white-bijgesneden (1)-1")](https://portal.sandgrain.eu/?hsLang=en)
[mailto:email@email.com](mailto:email@email.com)
Copyright © 2026, sandgrain.eu