---
title: Is That Device Really Yours? The CyberRock Authentication Flow, Step by Step
description: Knowledge Base
---
[Skip to content](https://portal.sandgrain.eu/knowledge-base/what-questiis-that-device-really-yours-the-cyberrock-authentication-flow-step-by-stepon-is-your-article-answering#main-content)
English
Show submenu for translations
.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1).png)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Contact us](https://portal.sandgrain.eu/login)
[Contact us](https://portal.sandgrain.eu/login?hsLang=en)
How can we help you?
- There are no suggestions because the search field is empty.
1. [Knowledge Base](https://portal.sandgrain.eu/knowledge-base?hsLang=en)
2. [SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en)
3. [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#sandgrain-sdk)
October 6, 2026
# Is That Device Really Yours? The CyberRock Authentication Flow, Step by Step
## A step-by-step look at the challenge-response exchange between the SandGrain token and the CyberRock cloud - from reading the TID to AUTH\_OK.
***Every device claims to be genuine. Only one holding the right silicon can prove it.***
In the CyberRock Core Functions SDK, authentication is a direct challenge-response exchange between the host application and the CyberRock cloud over HTTPS - no Gateway or MQTT broker is involved. The SandGrain token and the cloud HSM each hold the same per-token secret key, which never leaves either side. A party proves itself by returning the keyed hardware response (HMAC) to a fresh 32-byte challenge; the verifier recomputes the same response with its own copy of the key and compares.
### **The core idea: a secret that never travels**
Both sides of the exchange hold the same secret key - the token in tamper-resistant hardware, the cloud in its HSM. Neither ever transmits it. Instead, one side poses a fresh 32-byte challenge and the other returns the HMAC of that challenge. Only a party holding the key can answer correctly, and because every challenge is new, an intercepted answer is useless for replay. Everything below is a variation on this single trick.
### When the device starts the conversation: Host Auth (HCW → HRW)
Use this flow when the device decides when to prove itself - at boot, on reconnect, or before a sensitive operation.
1. **Read the TID -** the host reads the token's 32-byte Token ID (get\_tid()); every cloud call is scoped to it.
2. **Generate a challenge -** the host generates a fresh Host Challenge Word (HCW) locally (make\_challenge(): SHA-256 of the current timestamp).
3. **Get the token's response -** the token computes HRW = HMAC(HCW) inside the crypto chip (do\_host\_auth) and returns it; the secret key never leaves the hardware.
4. **Log in -** the host logs in to the Device API (deviceLogin with the IoT credentials) and receives an access token.
5. **Submit -** the host submits (TID, HCW, HRW): synchronously via priorityhostauth (verdict returned in the same call), or asynchronously via hostauth\_request followed by hostauth\_checkstatus polling.
6. **Cloud verification -** the cloud HSM looks up the key for that TID, recomputes HRW' = HMAC(HCW), and compares it with the submitted HRW.
***Figure 1.*** *Device-initiated authentication - Host Auth (HCW → HRW): local challenge, hardware response, HSM verification (priorityhostauth shown; the polled variant uses hostauth\_request / hostauth\_checkstatus).*
### When the cloud starts it: Token Auth (CW → RW)
Use this flow when verification is driven server-side - a scheduled re-attestation or an admin-triggered check.
1. **Read the TID and log in -** as above.
2. **Request a challenge -** tokenauth\_requestcw: the cloud generates a fresh Challenge Word (CW), stores it against a transaction ID, and returns it to the host.
3. **Get the token's response -** the token computes RW = HMAC(CW) (do\_token\_auth).
4. **Reply -** the host returns the RW via tokenauth\_replyrw; the cloud HSM recomputes RW' = HMAC(CW) and compares.
5. **Fetch the verdict -** the host polls tokenauth\_checkstatus until a terminal status is returned.
***Figure 2.*** *Cloud-initiated authentication - Token Auth (CW → RW): the cloud issues the challenge (tokenauth\_requestcw), the token answers, the HSM verifies (tokenauth\_replyrw / tokenauth\_checkstatus).*
### Reading the verdict
Both flows end with one of three terminal statuses:
| **Verdict** | **Meaning** |
| --- | --- |
| **AUTH\_OK** | The response matches and the TID is claimed by the authenticated tenant. |
| **CLAIM\_TOKEN** | The response matches (the token is genuine) but it is not yet claimed; run the token-claim flow once, then re-authenticate. |
| **AUTH\_NOK** | The response does not match; the hardware is not genuine or the exchange was corrupted. |
### Trust both ways: Mutual Authentication
The flows above prove only the device to the cloud. In the mutual\_auth flows the cloud additionally returns HRW2 - HMAC(RW||RW) in the cloud-initiated form, HMAC(HRW||HRW) in the device-initiated form - which the host recomputes through its token and compares locally.
**A mismatch means the server is an impostor, even if it reported AUTH\_OK - both checks must pass.**
***Figure 3.*** *Mutual authentication - after verifying the device, the cloud returns HRW2, which the host recomputes through the token and compares locally; a mismatch means an impostor server.*
### What about errors?
Transport integrity is provided by HTTPS, so there is no bit-flip error management in this flow (the CW-echo comparison and candidate-CW mechanism of earlier gateway-based versions no longer apply). Failures surface as HTTP errors with the response body, or as the terminal statuses above. Note that the polling calls have no timeout; production integrations should impose their own retry and timeout policy.
That's the entire trust model: one shared secret, two directions of proof, zero secrets on the wire.
Ready to try it? The SDK ships runnable scripts for every flow described here.
[Get started -](https://portal.sandgrain.eu/knowledge-base/proving-device-identity-token-host-and-mutual-authentication?hsLang=en)
- [User Documentation](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#main-content)
- [Quick Starter Guide](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#quick-starter-guide)
- [User Manual](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#user-manual)
- [Whitepaper](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#whitepaper)
- [Token Leaflet](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#token-leaflet)
- [Claim Token Procedure](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#claim-token-procedure)
- [Daisy Chain](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#daisy-chain)
- [Release Note](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#release-note)
- [Naming Convention](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#naming-convention)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#sandgrain-sdk)
- [TrustBridge](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#trustbridge)
- [API Documentation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#main-content)
- [Device API Integration](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#device-api-integration)
- [Daisy Chain and Attestation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#daisy-chain-and-attestation)
- [SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#main-content)
- [Core Functions](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#core-functions)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#sandgrain-sdk)
[-1.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1)-1.png "SandGrain_Logo_RGB_white-bijgesneden (1)-1")](https://portal.sandgrain.eu/?hsLang=en)
[mailto:email@email.com](mailto:email@email.com)
Copyright © 2026, sandgrain.eu