UniToken Integration Guide BitLocker Drive Encryption

Install the PKI package

This part explains how to install the PKI package that you can find inside the SDK. The End User package can be found inside the folder Redist/Enduser.

1	Right-Click on the PKI package installation file and choose “Run as administrator” Execute the file with an account that has administrator rights on this computer.
2	Click on [Next] in the welcome screen.
3	Input your username and Company Name and click on [Next].
4	Select [Complete] and click on [Next].
5	Click on [Install] to begin the installation of the PKI package.
6	Verify that the install wizard completed correctly and click on [Finish].

Create a compatible SmartCard certificate

In this Tutorial, we will use a self-signed certificate to encrypt the disk with BitLocker, but you can also use a SmartCard Certificate signed by a Certificate Authority, but you have to make sure it is supported by BitLocker. Please go to Microsoft Website to get more information about the requirements for a compatible BitLocker certificate.

1	In the [Start] menu, type regedit in the search field and when the regedit icon appears, right-click on it and choose [Run as administrator].
2	Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE and right click in the right pane. Choose [New] [DWORD(32-bit Value)]
3	Name the DWORD value that you just created as “SelfSignedCertificates”
4	Double click on the value you just created and set the field [Value data] to “1”. Click on OK to confirm and close regedit.
5	Copy this text in a the notepad and save it as blcert.txt	[NewRequest] Subject = "CN=BitLocker" KeyLength = 2048 ProviderName = "UniToken PRO CSP v2.0" KeySpec = "AT_KEYEXCHANGE" KeyUsage = "CERT_KEY_ENCIPHERMENT_KEY_USAGE" KeyUsageProperty = "NCRYPT_ALLOW_DECRYPT_FLAG" RequestType = Cert SMIME = FALSE [EnhancedKeyUsageExtension] OID=1.3.6.1.4.1.311.67.1.1
6	In the [Start] menu, type “cmd.exe” and when the cmd icon appears, right-click on it and choose [Run as administrator].
7	Go to where you save the file blcert.txt, right-click on it and choose [Properties], search for the field [location] and copy the path of your file.
8	Go back to the cmd console and type “cd (path of your file)” to go to the directory where it is saved. Then type “certreq –new blcert.txt” to request the BitLocker certificate (make sure that your UniToken is correctly plugged before executing this operation) .

Encrypt the hard disk with BitLocker

1	From the [Start] menu, type “BitLocker”, and from the results that appears, choose [Manage BitLocker].
2	Choose the disk that you want to enable BitLocker and click on [Turn on BitLocker] on its right.
3	On the screen [Choose how you want to unlock this drive], check [Use my smart card to unlock the drive] and click on [Next]. Options differ depending if you encrypt a partition from your internal hard disk or an external disk. For now, UniToken cannot be used to encrypt the system partition.
4	On the screen [How do you want to store your recovery key?] Choose where you want to save the file containing the recovery key. You can also choose to print it. Make sure to keep the recovery key in a safe place, if you lose your SmartCard, it is the only way to decrypt the data on the encrypted drive. Otherwise, all the data will be lost.
5	On the screen [Are you ready to encrypt this drive].
6	Wait while the disk is encrypted, it can take a rather long time depending on your computer and the disk size. (On the tested configuration, encrypting a 8GB partition took around 30 minutes).
7	When the dialog [Encryption of (disk letter) is complete] appears, the disk is protected, click on [Close] to finish. The encrypted disk will remain accessible until you remove it from your computer or reboot your computer.

Glossary

SmartCard: is any pocket-sized card with embedded integrated circuits. There are two broad categories of ICCs. Memory cards contain only non-volatile memory storage components, and perhaps dedicated security logic. Microprocessor cards contain volatile memory and microprocessor components.

Public Key Infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates.

Microsoft Cryptography API, MS-CAPI is an application programming interface included with Microsoft Windows operating systems that provides services to enable developers to secure Windows-based applications using cryptography.

PKCS refers to a group of public-key cryptography standards devised and published by RSA Security.