Key-Gen Guide
Key-Gen creates the cryptographic identity used to sign Veralinx Artwork Cards and to associate the account with its TAG signer data.
Before starting
Key-Gen is available only to authorised operational accounts with an active account and no key pair already registered. The operation can be completed only once.
Name to save
The file name is generated automatically from the account name, surname and role. It cannot be edited on the Key-Gen page.
Secret text for TAG signature
Enter a private secret text between 128 and 256 characters. Use a long, unique sequence that cannot be guessed.
The secret text is included in the downloaded Key-Gen package. Keep it confidential and preserve it with the private key. Do not send it by ordinary email or publish it.
Generated files
Select Generate Keys & TAG signer. A 2048-bit RSA key pair is generated locally in the browser and downloaded as a ZIP package containing:
name_private.pem— the private key used to sign Artwork Cards;name_public.pem— the corresponding public key;name_private_text.txt— the secret text entered for TAG signer generation.
Veralinx receives and stores the public key and TAG signer verification data. The private key is not uploaded to the server.
Install the private key in this browser
The optional browser-install checkbox stores the generated private key as a non-extractable browser CryptoKey. The PEM file is not stored in clear text in the browser database.
This option allows the Card Editor to sign future cards without requesting the PEM file each time. The installation applies only to the current browser profile and may be lost if site data, browser storage or the browser profile is deleted.
Private-key backup
The downloaded private key remains the essential backup. Store the ZIP package and private key in a secure offline location. Veralinx cannot recover, reconstruct or resend the private key.
Use in Card Editor
The Card Editor first checks for a valid private key installed in the browser. If none is available, it requests the private PEM file, verifies it against the public key stored by Veralinx and, where supported, installs it as a non-extractable key for later use.
Never select the public-key file when the Card Editor requests the private key.