Authentication

Authentication is how the client proves who you are to the virtual hub. You pick one method per profile, in the profile editor under Authentication. Rammbock supports five methods, from a simple username and password up to a PIV smart card tapped over NFC.

Choosing a method

If you don’t know which to use, ask your server administrator. Most servers use Password.

Password

Enter your Username and Password. That’s it.

• The password is never stored or sent in the clear. SoftEther transmits a hash of it (SHA‑0(password + UPPERCASE(username))), and Rammbock stores your profile encrypted on the device.
• When you edit a saved password profile, the field shows a hint that a password is already stored. Leave it blank to keep the current password, or type a new one to replace it.

RADIUS / NT domain

Also a Username and Password, but the hub forwards them to an external RADIUS server or a Windows domain controller to check. Use this only if your administrator tells you the hub is set up that way; otherwise use Password.

Anonymous

No credentials are sent. This only works if the hub explicitly permits anonymous connections — otherwise the connection is refused.

Client certificate

Use a certificate and private key held in Android’s system keystore.

1. Set Authentication to Client certificate.
2. Tap Choose certificate and pick one from the system keystore.
3. Save and connect.

Notes and limits:

• Only RSA certificates are supported.
• The private key never leaves the keystore and is never exported — signing happens inside Android’s secure key store.
• To install a certificate into the keystore in the first place, use Android’s own certificate‑install flow (Settings, or an app that provisions it). Once it’s in the keystore, Rammbock can select it.

Smart card (NFC)

Sign in with an RSA key stored on a PIV smart card, read over NFC. The private key stays on the card; the card itself performs the signature.

One‑time setup — read the card certificate

1. Set Authentication to Smart card (NFC).
2. Tap Read card (NFC).
3. Enter nothing yet — hold the card flat against the back of the phone and keep it still while it reads the PIV authentication certificate (slot 9A).
4. The certificate is stored in the profile (only the public certificate — no secret leaves the card). The editor then shows Certificate: stored.

Connecting with the card

Each time you connect, the card must sign a fresh challenge, so:

1. Start the connection. Rammbock prompts for your card PIN.
2. Enter the PIN, then hold the card against the phone and keep it still until signing completes.

Important constraints:

• Rammbock must stay in the foreground during connecting. The card signs in the middle of the handshake, so if you switch away from the app the sign‑in times out and the connection fails.
• Only RSA cards are supported.
• Because every connection needs a live card tap, smart‑card auth cannot be used with Dual connection (its background reserve session can’t tap the card).
• If your phone has no NFC or NFC is turned off, the app tells you — turn NFC on in system settings and try again.

What can be shared

See Import, export & QR sharing for details, including the warning that a QR code carrying a password should only be shared with people you trust.