> For the complete documentation index, see [llms.txt](https://learn.cypherock.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://learn.cypherock.com/getting-started/how-do-i-know-my-cypherock-is-genuine.md).

# How do I know my Cypherock is genuine?

{% tabs %}
{% tab title="Cypherock X1" %}
Before shipping, each device is provisioned with a unique set of private-public keys for device and card authentication, as well as for end-to-end encrypted NFC communication between the device and the card. Authentication is performed by verifying signatures generated by the private key in the hardware. The server verifies these signatures using the corresponding public key.

## Secure device authentication

* Unique key pairs are generated via a common seed. See the key derivation paths [here](https://github.com/Cypherock/x1_wallet_firmware/blob/main/docs/device_provision_auth.md#auth-and-nfc-pairing-key-derivation-).
* The device includes a secure ATECC608A chip for storing private keys and sensitive data. The ATECC608A and MCU share an IO\_PROTECTION key, which is used to read and write data in encrypted form.
* After provisioning is complete, sensitive data in the ATECC is locked and prohibited from being read.
* **During provisioning**, private keys and NFC pairing keys are stored in the device. Its public key and device serial number are stored on the server for later authentication.
* **During authentication**, the private key generates signatures on serial numbers and random data. The server verifies them using the corresponding public key.
* Changes to hardware, such as the MCU or ATECC, during transport can be detected because the shared key will not match.
* On both the MCU and ATECC, the IO\_PROTECTION key has read access disabled and cannot be used to create clones.

For more information about the authentication process, refer to the device provision documentation on [Cypherock Github](https://github.com/Cypherock/x1_wallet_firmware/blob/main/docs/device_provision_auth.md).

## Secure card authentication

{% stepper %}
{% step %}

### Provision unique authentication keys

Each set of Cypherock X1 is provisioned with a unique set of public and private keys for device authentication and card authentication. These unique pairs are generated from a common seed via different derivation paths.
{% endstep %}

{% step %}

### Provision the X1 cards and device

Before shipping, each set of X1 cards is provisioned with a unique set of private keys for NFC card authentication, along with its derivation path. Correspondingly, the device is provisioned with the xpubs for verification of X1 cards.
{% endstep %}

{% step %}

### Sign and verify a random message

During card authentication, the X1 card signs a random message using its private key and shares the signature along with the derivation path to the device. Since the device is provisioned with xpubs, it can generate the public key corresponding to the private key provisioned on the X1 card and verify the signature of the random message.
{% endstep %}

{% step %}

### Confirm authentication

Only if the message was signed correctly is the card understood to be authenticated by the X1 Vault.
{% endstep %}
{% endstepper %}
{% endtab %}

{% tab title="Cypherock X0" %}
Before shipping, each X0 Card is provisioned with a unique set of private-public keys for card authentication, as well as for end-to-end encrypted NFC communication between the X0 Card and the X0 Wallet App, and between the X0 Cards themselves. Authentication is performed by verifying signatures generated by the private key in the X0 Card.

## Secure card authentication

{% stepper %}
{% step %}

### Tap all four X0 Cards

During setup, tap all four X0 Cards on your smartphone. An internet connection is required.
{% endstep %}

{% step %}

### Authenticate with Cypherock's server

Each X0 Card authenticates itself with Cypherock's server, with the X0 Wallet App relaying the messages. The X0 Card signs a fresh challenge using its provisioned private key and verifies the signed responses it receives from the server.
{% endstep %}

{% step %}

### Confirm the card is genuine

Only once the server has confirmed that the card is genuine does the X0 Card allow wallet operations to be performed on it. The X0 Card remembers this result, so authentication is only done once.
{% endstep %}

{% step %}

### Pair the X0 Cards

During the same setup, your four X0 Cards are paired with each other so they can exchange shards securely whenever a wallet is created or restored.
{% endstep %}

{% step %}

### Verify the card during each app session

At the start of every session with the X0 Wallet App, the X0 Card signs its response with its provisioned private key, proving to the X0 Wallet App that it is communicating with a genuine X0 Card.
{% endstep %}
{% endstepper %}

To make sure the X0 Wallet App itself is genuine, only download it from its official listings, "Cypherock X0 - Crypto Wallet" on the App Store and Google Play. Read more in [Download the X0 Wallet App](file:///getting-started/download-the-x0-wallet-app.md).
{% endtab %}
{% endtabs %}