UniToken Integration Guide BitLocker Drive Encryption: Difference between revisions

From SecuTech Wiki
Jump to navigationJump to search
← Older edit

Bao (talk | contribs)

0 edits
Bao (talk | contribs)
0 edits
mNo edit summary
 
(10 intermediate revisions by 3 users not shown)
Line 1: Line 1:
[[category:UniToken_Integration_Guide]]
<!--
{{Infobox
{{Infobox
|title       = Bitlocker/UniToken integration guide
|title   = UniToken BitLocker Integration
|image       = [[Image:Flex.png|50px]]
|image   = [[Image:Flex.png|50px]]
|header1 = Compatible products:
|label1  = Models
|header2 = UniToken PRO, UniToken Drive
|data1  = UniToken Pro, UniToken Drive
|header3 = Compatible Systems:
|label2  = Compatible Systems
|Header4 = Windows 7, Windows Server 2008
|data2 = Windows 7, Windows Server 2008
}}
}}
-->


<br><br><br><br><br><br>
== Install the PKI Package ==
 
== Install the PKI package ==


This part explains how to install the PKI package that you can find inside the SDK. The End User package can be found inside the folder Redist/Enduser.  
This section explains how to install the PKI package that can be found inside the UniToken SDK. The End User package can be found inside the folder "Redist/Enduser/".  


{| cellspacing="0" cellpadding="0" border="0" width=""
{| class="wikitable"
|-
|-
| width="50" | &nbsp;'''1'''  
| width="50" | '''1'''  
| width="400" | Right-Click on the PKI package installation file and choose “Run as administrator”<br>Execute the file with an account that has administrator rights on this computer.<br><br>
| width="400" | Right-click on the PKI package installation file and choose [Run as administrator]. Execute the file with an account that has administrator rights on this computer.
| [[Image:Bitlocker img01.jpg|370x259px]]<br><br>
| [[Image:Bitlocker img01.jpg|370x259px]]
|-
|-
| width="50" | &nbsp;'''2'''  
| width="50" | '''2'''  
| width="400" | Click on [Next] in the welcome screen.<br>
| width="400" | Click on [Next] in the InstallShield Wizard welcome screen.
| [[Image:Bitlocker img02.jpg|370px]]<br><br>
| [[Image:Bitlocker img02.jpg|370px]]
|-
|-
| width="50" | &nbsp;'''3'''  
| width="50" | '''3'''  
| width="400" | Input your username and Company Name and click on [Next].<br>
| width="400" | Input your User Name and Company Name and click on [Next].
| [[Image:Bitlocker img03.jpg|370px]]<br><br>
| [[Image:Bitlocker img03.jpg|370px]]
|-
|-
| width="50" | &nbsp;'''4'''  
| width="50" | '''4'''  
| width="400" | Select [Complete] and click on [Next].<br>
| width="400" | Select [Complete] and click on [Next].
| [[Image:Bitlocker img04.jpg|370px]]<br><br>
| [[Image:Bitlocker img04.jpg|370px]]
|-
|-
| width="50" | &nbsp;'''5'''  
| width="50" | '''5'''  
| width="400" | Click on [Install] to begin the installation of the PKI package.<br>
| width="400" | Click on [Install] to begin the installation of the PKI package.
| [[Image:Bitlocker img05.jpg|370px]]<br><br>
| [[Image:Bitlocker img05.jpg|370px]]
|-
|-
| width="50" | &nbsp;'''6'''  
| width="50" | '''6'''  
| width="400" | Verify that the install wizard completed correctly and click on [Finish].<br>
| width="400" | Verify that the InstallShield Wizard completed successfully and click on [Finish].
| [[Image:Bitlocker img06.jpg|370px]]<br><br>
| [[Image:Bitlocker img06.jpg|370px]]
|}
|}


<br>
== Create a Compatible Smartcard Certificate ==
 
== Create a compatible SmartCard certificate ==
 
In this Tutorial, we will use a self-signed certificate to encrypt the disk with BitLocker, but you can also use a SmartCard Certificate signed by a Certificate Authority, but you have to make sure it is supported by BitLocker. Please go to Microsoft Website to get more information about the requirements for a compatible BitLocker certificate.


In this tutorial, we will use a self-signed certificate to encrypt the disk with BitLocker. A smart card certificate signed by a Certificate Authority can also be used, but ensure it is supported by BitLocker. More information about the requirements for a compatible BitLocker certificate can be found on Microsoft's website.


{| cellspacing="0" cellpadding="0" border="0" width=""
{| class="wikitable"
|-
|-
| width="50" | &nbsp;'''1'''  
| width="50" | '''1'''  
| width="400" | In the [Start] menu, type regedit in the search field and when the regedit icon appears, right-click on it and choose [Run as administrator].<br><br>
| width="400" | From the Start Menu, type "regedit", without quotation marks, in the search field, then right-click on "regedit" and click [Run as administrator].
| <center>[[Image:Bitlocker img07.jpg|370x259px]]</center><br><br>
| <center>[[Image:Bitlocker img07.jpg|370x259px]]</center>
|-
|-
| width="50" | &nbsp;'''2'''  
| width="50" | '''2'''  
| width="400" | Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE and right click in the right pane. Choose [New] [DWORD(32-bit Value)]<br>
| width="400" | Navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE" and right click in the right pane. Choose [New] [DWORD(32-bit Value)].
| [[Image:Bitlocker img08.jpg|370px]]<br><br>
| [[Image:Bitlocker img08.jpg|370px]]
|-
|-
| width="50" | &nbsp;'''3'''  
| width="50" | '''3'''  
| width="400" | Name the DWORD value that you just created as “SelfSignedCertificates”<br>
| width="400" | Name the DWORD value as “SelfSignedCertificates”.
| [[Image:Bitlocker img09.jpg|370px]]<br><br>
| [[Image:Bitlocker img09.jpg|370px]]
|-
|-
| width="50" | &nbsp;'''4'''  
| width="50" | '''4'''  
| width="400" | Double click on the value you just created and set the field [Value data] to “1”. Click on OK to confirm and close regedit.<br>
| width="400" | Double click on the value and set the field [Value data] to "1". Click on [OK] to confirm and close regedit.
| [[Image:Bitlocker img10.jpg|370px]]<br><br>
| [[Image:Bitlocker img10.jpg|370px]]
|-
|-
| width="50" | &nbsp;'''5'''  
| width="50" | '''5'''  
| width="400" | Copy this text in a the notepad and save it as blcert.txt<br>
| width="400" | Copy and save the text to the right as "blcert.txt".
| [NewRequest] <br>
| [NewRequest]  
 
<code>
Subject = "CN=BitLocker"


Subject = "CN=BitLocker" <br>
KeyLength = 2048


KeyLength = 2048 <br>
ProviderName = "UniToken PRO CSP v2.0"


ProviderName = "UniToken PRO CSP v2.0" <br>
KeySpec = "AT_KEYEXCHANGE"  


KeySpec = "AT_KEYEXCHANGE" <br>
KeyUsage = "CERT_KEY_ENCIPHERMENT_KEY_USAGE"


KeyUsage = "CERT_KEY_ENCIPHERMENT_KEY_USAGE"<br>
KeyUsageProperty = "NCRYPT_ALLOW_DECRYPT_FLAG"


KeyUsageProperty = "NCRYPT_ALLOW_DECRYPT_FLAG"<br>
RequestType = Cert


RequestType = Cert<br>
SMIME = FALSE


SMIME = FALSE<br>
[EnhancedKeyUsageExtension]


[EnhancedKeyUsageExtension]<br>
OID=1.3.6.1.4.1.311.67.1.1
</code>


OID=1.3.6.1.4.1.311.67.1.1<br>
<br><br>
|-
|-
| width="50" | &nbsp;'''6'''  
| width="50" | '''6'''  
| width="400" | In the [Start] menu, type “cmd.exe” and when the cmd icon appears, right-click on it and choose [Run as administrator].<br>
| width="400" | From the Start Menu, type "cmd.exe", without quotation marks, in the search field, then right-click on "cmd" and click [Run as administrator].
| [[Image:Bitlocker img12.jpg|370x259px]]<br><br>
| <center>[[Image:Bitlocker img12.jpg|300px]]</center>
|
|
|-
|-
| width="50" | &nbsp;'''6'''  
| width="50" | '''7'''  
| width="400" | Go to where you save the file blcert.txt, right-click on it and choose [Properties], search for the field [location] and copy the path of your file.<br>
| width="400" | Retrieve the path of the "blcert.txt" file saved earlier. To do so, navigate to where "blcert.txt" is saved, right-click on the file and select [Properties], search for the field [Location] and copy the path of your file.
| [[Image:Bitlocker img13.jpg|370x259px]]<br><br>
| <center>[[Image:Bitlocker img13.jpg|300px]]</center>
|-
|-
| width="50" | &nbsp;'''6'''  
| width="50" | '''8'''  
| width="400" | Go back to the cmd console and type “cd (path of your file)” to go to the directory where it is saved.
| width="400" | On the cmd console, type "cd " followed by the path of your file" to go to the directory where it is saved. For example "cd C:\Users\SecuTech\Desktop", without quotation marks (, at this point, make sure that the corresponding UniToken is correctly plugged in before executing the following operation). Afterwards, type "certreq –new blcert.txt" to request the BitLocker certificate.
Then type “certreq –new blcert.txt” to request the BitLocker certificate (make sure that your UniToken is correctly plugged before executing this operation)
.
.<br>
| <center>[[Image:Bitlocker img14.jpg|300px]]</center>
| [[Image:Bitlocker img14.jpg|370x259px]]<br><br>
|}
|}


== Encrypt the hard disk with BitLocker ==
== Encrypt the Hard Disk with BitLocker ==


{| class="wikitable"
|-
| width="50" | '''1'''
| width="400" | From the Start Menu, type "BitLocker", and from the results that appear, choose [Manage BitLocker].
| [[Image:Bitlocker img15.jpg|370x259px]]
|-
| width="50" | '''2'''
| width="400" | Choose the disk that you wish to enable BitLocker on and click on [Turn on BitLocker].
| [[Image:Bitlocker img16.jpg|370px]]
|-
| width="50" | '''3'''
| width="400" | On the screen "Choose how you want to unlock this drive", check [Use my smart card to unlock the drive] and click on [Next].
''Options differ depending if you encrypt a partition from an internal or an external disk. For now, UniToken cannot be used to encrypt the system partition.''
| [[Image:Bitlocker img17.jpg|370px]]
|-
| width="50" | '''4'''
| width="400" | On the screen "How do you want to store your recovery key?", choose where you want to save the file containing the recovery key - you can also choose to print it. ''Be sure to keep the recovery key in a safe place. If you lose your smart card, it is the only way to decrypt the data on the encrypted drive: otherwise, all data will be lost.''
| [[Image:Bitlocker img18.jpg|370px]]
|-
| width="50" | '''5'''
| width="400" | On the screen "Are you ready to encrypt this drive", click [Start Encrypting].
| [[Image:Bitlocker img19.jpg|370px]]
|-
| width="50" | '''6'''
| width="400" | The encryption process will take place. This may take a long time depending on the characteristics of your computer and the disk size to be encrypted. (On the tested configuration, encrypting a 8GB partition took approximately 30 minutes).
| [[Image:Bitlocker img20.jpg|370px]]
|-
| width="50" | '''7'''
| width="400" | When the dialog window "Encryption of (disk) is complete" appears, the disk is now protected. Click on [Close] to finish.
| [[Image:Bitlocker img21.jpg|370px]]
|}


== Access to the Encrypted Disk ==


== Access to the encrypted disk ==
{| class="wikitable"
|-
| width="50" | '''1'''
| width="400" | When attempting to access the encrypted disk, the following window will appear (You can also choose to unlock the disk automatically when the smart card is inserted.
Insert your UniToken device and click on [Unlock].


| [[Image:Bitlocker img22.jpg|370px]]
|-
| width="50" | '''2'''
| width="400" | You will be asked to type the User PIN for your UniToken to unlock the drive. The drive will be unlocked only if the correct password is entered. Enter the User PIN and click [OK] to access the encrypted drive.
| [[Image:Bitlocker img23.jpg|370px]]
|}


== Glossary ==
== Glossary ==


'''SmartCard:''' is any pocket-sized card with embedded integrated circuits. There are two broad categories of ICCs. Memory cards contain only non-volatile memory storage components, and perhaps dedicated security logic. Microprocessor cards contain volatile memory and microprocessor components.
'''Smart Card''': any pocket-sized card with embedded integrated circuits. There are two broad categories of ICCs. Memory cards contain only non-volatile memory storage components, and perhaps dedicated security logic. Microprocessor cards contain volatile memory and microprocessor components.


'''Public Key Infrastructure (PKI)''' is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates.
'''Public Key Infrastructure (PKI)''': a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates.


'''Microsoft Cryptography API, MS-CAPI''' is an application programming interface included with Microsoft Windows operating systems that provides services to enable developers to secure Windows-based applications using cryptography.
'''Microsoft Cryptography API, MS-CAPI''': an application programming interface included with Microsoft Windows operating systems that provides services to enable developers to secure Windows-based applications using cryptography.


'''PKCS''' refers to a group of public-key cryptography standards devised and published by RSA Security.
'''PKCS''': refers to a group of public-key cryptography standards devised and published by RSA Security.

Latest revision as of 16:46, 23 August 2016


Install the PKI Package

This section explains how to install the PKI package that can be found inside the UniToken SDK. The End User package can be found inside the folder "Redist/Enduser/".

1 Right-click on the PKI package installation file and choose [Run as administrator]. Execute the file with an account that has administrator rights on this computer.
2 Click on [Next] in the InstallShield Wizard welcome screen.
3 Input your User Name and Company Name and click on [Next].
4 Select [Complete] and click on [Next].
5 Click on [Install] to begin the installation of the PKI package.
6 Verify that the InstallShield Wizard completed successfully and click on [Finish].

Create a Compatible Smartcard Certificate

In this tutorial, we will use a self-signed certificate to encrypt the disk with BitLocker. A smart card certificate signed by a Certificate Authority can also be used, but ensure it is supported by BitLocker. More information about the requirements for a compatible BitLocker certificate can be found on Microsoft's website.

1 From the Start Menu, type "regedit", without quotation marks, in the search field, then right-click on "regedit" and click [Run as administrator].
2 Navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE" and right click in the right pane. Choose [New] [DWORD(32-bit Value)].
3 Name the DWORD value as “SelfSignedCertificates”.
4 Double click on the value and set the field [Value data] to "1". Click on [OK] to confirm and close regedit.
5 Copy and save the text to the right as "blcert.txt". [NewRequest]

Subject = "CN=BitLocker"

KeyLength = 2048

ProviderName = "UniToken PRO CSP v2.0"

KeySpec = "AT_KEYEXCHANGE"

KeyUsage = "CERT_KEY_ENCIPHERMENT_KEY_USAGE"

KeyUsageProperty = "NCRYPT_ALLOW_DECRYPT_FLAG"

RequestType = Cert

SMIME = FALSE

[EnhancedKeyUsageExtension]

OID=1.3.6.1.4.1.311.67.1.1

6 From the Start Menu, type "cmd.exe", without quotation marks, in the search field, then right-click on "cmd" and click [Run as administrator].
7 Retrieve the path of the "blcert.txt" file saved earlier. To do so, navigate to where "blcert.txt" is saved, right-click on the file and select [Properties], search for the field [Location] and copy the path of your file.
8 On the cmd console, type "cd " followed by the path of your file" to go to the directory where it is saved. For example "cd C:\Users\SecuTech\Desktop", without quotation marks (, at this point, make sure that the corresponding UniToken is correctly plugged in before executing the following operation). Afterwards, type "certreq –new blcert.txt" to request the BitLocker certificate.

.

Encrypt the Hard Disk with BitLocker

1 From the Start Menu, type "BitLocker", and from the results that appear, choose [Manage BitLocker].
2 Choose the disk that you wish to enable BitLocker on and click on [Turn on BitLocker].
3 On the screen "Choose how you want to unlock this drive", check [Use my smart card to unlock the drive] and click on [Next].

Options differ depending if you encrypt a partition from an internal or an external disk. For now, UniToken cannot be used to encrypt the system partition.

4 On the screen "How do you want to store your recovery key?", choose where you want to save the file containing the recovery key - you can also choose to print it. Be sure to keep the recovery key in a safe place. If you lose your smart card, it is the only way to decrypt the data on the encrypted drive: otherwise, all data will be lost.
5 On the screen "Are you ready to encrypt this drive", click [Start Encrypting].
6 The encryption process will take place. This may take a long time depending on the characteristics of your computer and the disk size to be encrypted. (On the tested configuration, encrypting a 8GB partition took approximately 30 minutes).
7 When the dialog window "Encryption of (disk) is complete" appears, the disk is now protected. Click on [Close] to finish.

Access to the Encrypted Disk

1 When attempting to access the encrypted disk, the following window will appear (You can also choose to unlock the disk automatically when the smart card is inserted.

Insert your UniToken device and click on [Unlock].

2 You will be asked to type the User PIN for your UniToken to unlock the drive. The drive will be unlocked only if the correct password is entered. Enter the User PIN and click [OK] to access the encrypted drive.

Glossary

Smart Card: any pocket-sized card with embedded integrated circuits. There are two broad categories of ICCs. Memory cards contain only non-volatile memory storage components, and perhaps dedicated security logic. Microprocessor cards contain volatile memory and microprocessor components.

Public Key Infrastructure (PKI): a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates.

Microsoft Cryptography API, MS-CAPI: an application programming interface included with Microsoft Windows operating systems that provides services to enable developers to secure Windows-based applications using cryptography.

PKCS: refers to a group of public-key cryptography standards devised and published by RSA Security.

Retrieved from "https://esecutech.com/wiki/index.php?title=UniToken_Integration_Guide_BitLocker_Drive_Encryption&oldid=157"