UniToken Integration Guide FreeOTFE Keyfile

Template:Infobox

Install the PKI package

This part explains how to install the PKI package that you can find inside the SDK. The End User package can be found inside the folder Redist/Enduser.

1	Right-Click on the PKI package installation file and choose “Run as administrator” Execute the file with an account that has administrator rights on this computer.
2	Click on [Next] in the welcome screen.
3	Input your username and Company Name and click on [Next].
4	Select [Complete] and click on [Next].
5	Click on [Install] to begin the installation of the PKI package.
6	Verify that the install wizard completed correctly and click on [Finish].

Configure PKCS support in TrueCrypt

1	In the main menu, go to [Settings], [Security　Tokens].
2	In the [Options] window, [PKCS#11] tab, Check [Enable PKCS#11 support] and choose the library file. By default the PKI package will install this file in the Windows\System32\ folder. Choose where to save the settings in the field [Save above settings to] and click on OK to apply the settings.

Create an encrypted volume with FreeOTFE

1	To create a new encrypted volume, click on [New].
2	On the [FreeOTFE Volume Creation Wizard] welcome page, click on [Next] to start the volume creation procedure.
3	You can choose to store the encrypted volume as a file or to encrypt a whole partition/disk. Choose the one that fits the best to your needs. In our case, we chose to store the encrypted volume as a file. Click on [Next] to continue.
4	Choose where you want to store the volume and click on [Next] to continue.
5	Choose the size of your encrypted volume and click on [Next] to continue.
6	Keep the default encryption algorithms or change it depending on your needs. Click on [Next] to continue.
7	Choose the elements to use to secure your volume, the more you use elements, the more you can secure your volume. We have chosen to use Microsoft CryptoAPI and PKCS#11 token.
8	Check that you have selected the right UniToken and click on [Next] to continue.
9	Input a password for your encrypted volume. This doesn’t have to be the same password with your UniToken. Click on [Next] to continue.
10	Check that the details for the new volume creation are correct and click on [Finish] to create the volume.

Create a keyfile for the encrypted volume and store it inside UniToken

1	In the main menu, click on [Tools] [Create keyfile…]
2	Choose the type of your encrypted volume (file or partition) and click on [Next].
3	Indicate where your encrypted volume is located and click on [Next].
4	Input the password of your volume and click on [Next].
5	Choose where you want to store the keyfile (At this step you cannot directly store the keyfile directly to the Token, you first have to save it to your computer and import it to your Token later).
6	Input a password for your keyfile and confirm it. Click on [Next] to continue.
7	Choose the elements that you want to use for password salting and random padding data. We have decided to choose Microsoft CrytoAPI and PKCS#11 Token. Click on [Next].
8	Check that the correct UniToken is selected and click on [Finish].
9	In the main menu, choose [Tools] [PKCS#11 token management].
10	Input the PIN for the UniToken and click on [OK].
11	In the [Keyfiles] tab, click on [Import] and select the keyfile that you just created.
12	When the dialog box [Keyfile imported successfully as : (name of the keyfile)] appears, the import is finished. For more security, you can choose to delete the keyfile stored on your computer and keep only the one inside the UniToken.

Unlock the encrypted volume with the keyfile stored in UniToken

1	If you lost the password for your volume, you can now use your UniToken to access the data. Click on [Mount file] (or [Mount Partition] if you encrypted a whole partition).
2	Check [PKCS#11] and when the [Security Token/SmartCard PIN] dialog box appears, fill in your PIN and click on OK.
3	Input the password for the keyfile in the password field and select the right keyfile in the PKCS#11 file. Click on [OK] to confirm and get access to your encrypted volume.

Glossary

Public Key Infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates.

Microsoft Cryptography API, MS-CAPI is an application programming interface included with Microsoft Windows operating systems that provides services to enable developers to secure Windows-based applications using cryptography.

PKCS refers to a group of public-key cryptography standards devised and published by RSA Security.