Search Keyword : 0

• In Thunderbird, how to set up digital certificate?

  Before Signing/Encrypting an E-Mail, Thunderbird should know which Digital Certificate(s) to use for each operation. Make sure that you already had requested a Digital Certificate from a Certificate Authority before doing the steps below. To set-up the digital certificate to be used for signing/encrypting e-mails in Thunderbird: First, make sure that you have requested a certificate in a Certificate Authority and that you have Installed the ACS' PKCS#11 Module in Thunderbird. The e-mail address that you registered when requesting a certificate SHOULD be the same e-mail account that you are using in Thunderbird. After successfully requesting a digital certificate. Launch Thunderbird. Navigate to "Tools" -> "Account Settings". The "Account Settings" window will be displayed. Select the "Security" section on the tree-view on the left side (Figure 1). Figure 1: Security Account Settings in Thunderbird. Notice that there are 2 Panels, each for "Digital Signing" and "Encryption". Click the "Select" button. A password dialog box may appear, enter your PIN here (Figure 2). Figure 2: When asked for a Master Password, enter your card/token PIN. After successfully entering your card/token PIN, you should now see a "Select Certificate" dialog. Select the certificate that you want to use for signing/encryption. You will also see where the certificate(s) are stored. The "Stored in" property of the certificate will tell you in which card/token the selected certificate is stored. The value "Stored in" property should be the same Token Name of your card/token (Figure 3). Figure 3: Select Certificate dialog in Thunderbird. Select the appropriate signing/encrypting certificate and then select "OK". Your Security Panel should now look like the one below (Figure 4). Figure 4: Security settings after selecting a signing/encrypting digital certificate. There are also other settings that you can enable in the Security Dialog; i.e. Digitally signing every e-mail you send, or encrypting every email you send.

  https://www.acs.com.hk/en/frequently-asked-questions/1/smart-cards-smart-card-operating-systems/
• In Thunderbird, how to sign e-mails?

  Signing Emails is synonymous to putting your own signature (or maybe a thumbprint or a seal) in a letter. This ensures your recipient that the message really came from you and that you have put your own mark on the e-mail for the recipient to verify. This also ensures that the message has not been tampered in between the sender and the recipient. To use a digital certificate to sign e-mails in Thunderbird: Compose a new Email Message. Click the "Security" icon on the main panel (Figure 5). Figure 5: Select "Digitally Sign This Message". Check the "Digitally Sign This Message" icon. You can also set to Digitally-Sign all of your outgoing messages by going to "Tools" -> "Account Settings" -> "Security" (see Figure 4 above). Upon sending your Digitally-signed email, a "Master Password" prompt will appear (similar to the one in Figure 2 above). Enter the card/token PIN when asked for the "Master Password". Note that the time it takes to digitally-sign an email may vary depending on the size (or if there are attachments) of the email. When your recipient(s) has recieve(s) your digitally signed email, it should look like the one below (Figure 6) as viewed in Thunderbird. Figure 6: A digitally signed email with an envelope icon. There are times that your recipient(s) can view an invalid digital signature (Figure 7). Figure 7: An Email with an Invalid Digital Signature. If this happens, you may check the steps discussed here .

  https://www.acs.com.hk/en/frequently-asked-questions/1/smart-cards-smart-card-operating-systems/
• In Thunderbird, how to encrypt e-mails?

  Encrypted e-mail adds another security feature because it prevents a third party entity to see the actual content of the e-mail and it also protects sending of e-mail message thru an unsecure medium (e.g. a compromised wireless network). Take note that you can't just encrypt any e-mail that you want to send. You also have to make sure that your recipients can decrypt the encrypted email you have just sent. This means that Encrypting an e-mail message with your own Digital Certificates and sending it out to your intended recipients will be useless, since you are the only one that can decrypt the e-mail that you have just sent. Your recipients cannot decrypt your email and thus would not be able to read it. This also means that people who want to send you an encrypted email should have a copy of your public key. The public key is the one needed to encrypt emails that people want to send to you. If you want to send your recipients a copy of your certificate, all you have to do is send a signed email to them. On the other hand if you have received a signed email, then you can also reply to that email and have it encrypted. When this happens you can follow the steps below to reply and encrypt a signed message: (for the sample purposes, the sender and the recipient below are the same). Once you have recieve a signed e-mail and you want your reply to that email encrypted just click the "Security" icon on the main panel then Select "Encrypt This Message" (Figure 8). Figure 8: Sending an encrypted reply email. When sending your reply email, a "Master Password" prompt will appear (similar to Figure 2), enter your card/token PIN. When you (or your) recipient(s) recieved your encrypted email, they will be prompted for the card/token PIN. Once you have entered your card/token PIN, the encrypted email should look similar with the one below (Figure 9). Figure 9: An encrypted and signed Email, as viewed in Thunderbird. If the encrypted email does not look similar to the one above, check the steps discussed here. When the envelope/padlock icon is clicked, you should see the Message Security information (Figure 10). Figure 10: Email Message Security information.

  https://www.acs.com.hk/en/frequently-asked-questions/1/smart-cards-smart-card-operating-systems/
• How to use certificates in MS domain logon?

  Before using your card/token for domain logon, you should first configure your computer to be connected on a particular domain (your company domain for example). This domain server should also be configured to issue certificates. There are many sources in the internet for configuring your Active Directory Certificate Service, so that will no longer be discussed here. First, configure your computer to connect to a particular domain. Follow the steps below to connect to a particular domain: In your Local Area Network Connection properties. Click "Internet Protocol (TCP/IP)" (Figure 1). Figure 1: Click your TCP/IP settings in your LAN connection. In your TCP/IP settings, check "Use the Following DNS server addreses" (Figure 2). Figure 2: Type in your DNS address. Type in the IP of the Domain Name server. If you don't know the IP address of your DNS server, contact your Network Administrator. Click OK. After successfully configuring your DNS server address. Right Click the "My Computer" icon on your desktop and select "Properties". In the "Computer Name" tab, click the "Change" button. A "Computer Name Changes" dialog box will appear (Figure 3). Figure 3: Computer Name Changes dialog box. Select "Domain" in the "Member of" Panel. Type in the Domain Name of the DNS Server that you are trying to connect to. When prompted for a username and password, type in the username and password that have been assigned to you by your Network Administrator. You will be prompted to restart your computer after you have successfully entered your username and password. Save all your work and restart the computer. After a reboot you will notice that the welcome screen of your OS is different. Just follow the instructions on the welcome screen. If you already have a card/token with a smart card logon certificate stored in it, you can now use this to login to your computer. If you don't have a smart card with a certificate then follow this link to request a smart card certificate or contact your network administrator so he/she can request one for you.

  https://www.acs.com.hk/en/frequently-asked-questions/1/smart-cards-smart-card-operating-systems/
• How to use certificates in VPN logon?

  Your Card/Token can be used to connect to a Virtual Private Network (VPN). Make sure that the VPN server is configured to issue smart card certificates. You may contact your Network Administrator regarding setting up a VPN server to accept smart card certificate connections. To set-up your PC to use smart card for VPN connection: In Control Panel. Select "Network Connections" double Click "New Connection Wizard" (Figure 4). Figure 4: New Connection Wizard. Click Next and Choose "Connect to the network at my workplace", click Next again. Choose "Virtual Private Network connection". Click Next. Enter a brief description of the Connection Name (preferably your Company Name). Click Next. If asked to dial an initial connection choose "Do not dial the initial connection" option. Click Next. You will be prompted to enter the IP address or Host Name of your VPN Server. Contact your Network Administrator if you do not know the Host Name or IP Address of your VPN server. Click Next Choose "Use my smart card" option (Figure 5). Insert your smart card/token (that already has a certificate issued by the VPN server) into a smart card reader or a USB slot. Click Next. Figure 5: Select "Use my smart card" option. Choose the appropriate "Connection Availability" option. Click Next then click Finish. Wait while the process reads certificate information in your card/token. If prompted to install a server certificate, choose "OK" (Figure 6 ). Figure 6: Select "OK" to install the server certificate to your computer. Enter the Smart Card PIN when prompted (Figure 7). Figure 7: Enter your Smart Card PIN. Wait until the process shows that you have been successfully authenticated with the VPN Server. An "Authenticated" dialog box will appear (Figure 8) Figure 8: You have successfully connected to a VPN using your Smart Card

  https://www.acs.com.hk/en/frequently-asked-questions/1/smart-cards-smart-card-operating-systems/
• How to sign documents in MS Office?

  Using Microsoft Office Suite and ACS' CSP Middleware, users can sign Documents, Powerpoint presentaion and Excel files using certificates that are stored on the ACOS5 Card/CryptoMate devices. Digital certificates and signatures help to assure you that the file that you are about to use comes from a reliable source. They help to assure you that the file has not been tampered with. Before signing, users must ensure that he/she had requested a digital certificate from a trusted CA. Follow the steps below to Sign a document in MS Word. In MS Word, click Tools -> Option -> Security -> Digital Signatures? Select the certificate for your signature and encryption (Figure 1). Figure 1: Selecting Certificate for Document signing Click "OK" on the "Select Certificate" dialog. Enter ACOS5 PIN to get access to the Digital Certificate inside the ACOS5 (Figure 2). Figure 2: Enter ACOS5 PIN After submitting the PIN, wait until the signing process is finished. The Signing process might depend on the file size of the document that is being signed. After successfully signing the document, the user should see a "Red Ribbon" at the status bar of the document. This indicates that the document has been signed (Figure 3). Figure 3: A signed document. No modification is allowed, or the signature will be invalid (Figure 4) Figure 4: A signed document that is being modified The same can be done on powerpoint, Excel and other applications in MS office.

  https://www.acs.com.hk/en/frequently-asked-questions/1/smart-cards-smart-card-operating-systems/
• How to sign PDF documents?

  Using the Adobe Professional Suite and ACS' CSP Middleware, users can sign and encrypt PDF documents using certificates that are stored on the ACOS5 Card/CryptoMate devices. Before signing PDFs, user must ensure that he/she had requested a digital certificate from a trusted CA. As an example, we will use Adobe Professional Suite 8 for the steps discussed below.   Signing your PDF documents ensures that your document had not been tampered since the signature has been applied. This security feature is particularly important when sending your document through e-mails. To put your digital signature on a newly created PDF document: Make sure that your ACOS5 card is inserted in the reader. If you are using a CryptoMate Device, make sure that it is inserted in a USB slot. Start the Adobe Professional Suite.If you have properly installed the Adobe Pro Suite, you should see a welcome screen similar to the one below (Figure 1). Figure 1: Creating a PDF using Adobe Pro Suite 8. Select "CREATE PDF". You can easily create a PDF document that comes from a *.doc, a .txt file or even from multiple files. Select the proper source file for your PDF documents (Figure 2). Figure 2: Select the appropriate source file in creating your PDF document. Once you have selected the proper source file for your PDF document, you can now start signing your documents. Note that you have to save the newly generated pdf file before you can put a digital signature in it. In the main panel of the Adobe Pro Suite, Click the "Sign" Drop Down button (Figure 3). Figure 3: Signing your document with a digital certificate. You can see from the drop down menu that you can choose how you will place your digital signature in a pdf document. For the purpose of this example we will choose "Certify with Visible Signature". Once you have chosen how to put your digital signature in the document, you will be prompted as to where to place the digital signature in the document. After this, you will also be prompted to choose which specific Digital Certificate to use for document signing Choose what particular Digital Certificate you want to use to sign your PDF document (Figure 4). If you can't see your digital certificate, try to re-insert the ACOS5 card or CryptoMate token and repeat Steps 5 to 7. If re-inserting your card/token does not solve the issue, restart the Adobe Suite or try the steps discussed here. Figure 4: Select which digital certificate to use for digital signing. Once you have selected which digital certificate to use for document signing, you will be prompted to enter your ACOS5 PIN. In this step you will also see how your Digital Signature is placed in the PDF document. Figure 5: Enter your Card/Token PIN. Upon entering the correct card/token PIN, your document will have a permanent watermark. This watermark indicates who signed the document. Upon giving your document to someone else, they will see the document having this watermark (Figure 6). Figure 6: The newly created PDF document as viewed in an Acrobat Reader 7. The user who is viewing this document can verify if the document has been modified since it was signed. By Double Clicking the watermark, the "Signature Properties" dialog box will show up. This shows information regarding the document modifications and the digital signature itself (Figure 7). Figure 7: Signature Properties of the Digital Signature embedded in a PDF document.

  https://www.acs.com.hk/en/frequently-asked-questions/1/smart-cards-smart-card-operating-systems/
• How to encrypt PDF documents?

  Using the Adobe Professional Suite and ACS' CSP Middleware, users can sign and encrypt PDF documents using certificates that are stored on the ACOS5 Card/CryptoMate devices. Before encrypting PDFs, user must ensure that he/she had requested a digital certificate from a trusted CA. As an example, we will use Adobe Professional Suite 8 for the steps discussed below. Encrypting your PDF documents ensures that only the intended readers can decrypt and properly read your documents. To encrypt PDF documents: Make sure that your ACOS5 card is inserted in the reader. If you are using a CryptoMate Device, make sure that it is inserted in a USB slot. Start the Adobe Professional Suite.If you have properly installed the Adobe Pro Suite, you should see a welcome screen similar to the one below (Figure 1). Figure 1: Creating a PDF using Adobe Pro Suite 8. Select "CREATE PDF". You can easily create a PDF document that comes from a *.doc, a .txt file or even from multiple files. Select the proper source file for your PDF documents (Figure 2). Figure 2: Select the appropriate source file in creating your PDF document. Once you have your PDF document ready, select the "Secure" Drop down button in the main panel of the Adobe Pro Suite (Figure 3). Figure 3: Encrypting a PDF document in Adobe Pro Suite 8. Select "Certificate Encrypt" in the Drop down menu. A "Certificate Security Settings" dialog box will appear. You will be prompted for the General settings panel, Click "Next" to proceed to selecting recipients. The next panel will allow you to select the recipients. In this section you can now add the intended readers of your encrypted PDF document. This is the most important part of encrypting your document. If you don't add any recipients in this section, then your the only one who will be able to decrypt and read it properly. To add recipients of your document, you should first have a copy of the .cer certificate file of your recipient's digital certificate. If your recipients use ACOS5/CryptoMate to store their Digital Certificate, then they can easily export their digital certificate using Admin Tool. Click the "Browse..." button to add recipients for your encrypted document. Browse to where the *.cer file is located and then Click "OK" (Figure 4). Figure 4: Click "Browse..." to select the .cer file and then add them as your recipients. You can add as many recipients in your document as you want, as long as you have a copy of their *.cer digital certificate file. Click "Next" and then Click "Finish". Your PDF document is now encrypted, you can now start sending it to your intended recipients. When your recipients recieve the PDF document and they are also using ACOS5/CryptoMate to store their digital certitificates, they will be prompted for the Card/Token PIN (Figure 5). Figure 5: Opening an encrypted PDF file in Acrobat Reader 7.

  https://www.acs.com.hk/en/frequently-asked-questions/1/smart-cards-smart-card-operating-systems/
• How to set up TrueCrypt for ACOS5/ CryptoMage usage?

  TrueCrypt is a software application used for real-time on-the-fly encryption. It is distributed without cost, and has source code available, although under a restrictive licence. It can create a virtual encrypted disk within a file or a device-hosted encrypted volume on either an individual partition or an entire storage device. It supports Microsoft Windows, Mac OS X and Linux (using FUSE) and encrypted volumes can be made portable ( Figure 1). ACOS5/CryptoMate can be used as the storage for key(s) that will be used in Encrypting/Decrypting of a TrueCrypt Volume.  Figure 1: TrueCrypt main window To Initialize your TrueCrypt with ACOS5/CryptoMate, follow the steps below: If you have a fresh card/token, please make sure to Initialize it first. Install the TrueCrypt software first by downloading the latest installer in http://www.truecrypt.org/downloads . In the TrueCrypt main menu, select "Settings" and click "Security Tokens...". The "TrueCrypt - Securty Token Preferences" should pop up ( Figure 2 ). Figure 2: Security Token Preferences window. Click the button "Auto-Detect Library". If you have multiple PKCS Library installed in the system, then click "Select Library . . ." button and navigate to the Program Files, Advanced Card Systems Ltd., then ACOS5 SDK, Middleware and finally the PKCS folder. Select the acospkcs11.dll file. Once you have selected the proper PKCS#11 Library, click the "OK" button on the "Securty Token Preferences" dialog.

  https://www.acs.com.hk/en/frequently-asked-questions/1/smart-cards-smart-card-operating-systems/
• How to create an encrypted volume using ACOS5/CryptoMate?

  After you have successfully set-up your TrueCrypt settings, follow the steps below to create an encrypted volume using ACOS5/Cryptomate. On the TrueCrypt main window, click the "Create Volume" button. The "TrueCrypt Volume Creation Wizard" should pop-up ( Figure 3 ). Figure 3: TrueCrypt Volume Creation Wizard. In the Volume Creation Wizard, select the "Create an encrypted file container" option and click "Next". In the "Volume Type" selection, click the "Standard TrueCrypt volume" option and click "Next". In the "Volume Location" selection, Select the file in which you want to create your TrueCrypt Volume. Make sure to read the WARNING in this dialog ( Figure 4 ). Figure 4: TrueCrypt Volume Creation Wizard, Volume Location selection. Select "Next" once you have selected the desired file. Next, you will be asked on the "Encryption Options" for your Volume. You can leave the default settings as it is and click "Next" Next, you will be asked on the desired size for your volume. Click "Next" once you have specified the desired size for your Volume. The size that you specify here will be the allocated space for the file that you have created in Step 5 ( Figure 5 ). Figure 5: Specify the size you want for your volume. Next, you will be asked for the Volume Password and (optionally) for the Keyfile that will be used to encrypt/decrypt your TrueCrypt volume. Enter your desired password and select the "Use keyfiles" check box. Selecting to use keyfiles will allow you to store securely the keyfiles to your ACOS5/CryptoMate device. ( Figure 6 ). Figure 6: Enter your password and select the "Use keyfiles" option Once you have set your password, and selected the "Use keyfiles" selection. Click the "Keyfiles.." button. The "TrueCrypt - Keyfiles" will appear ( Figure 7 ). Figure 7: TrueCrypt Keyfiles window. Remember the password that you have entered in this step.  You can select any files for your keyfile (as stated in Figure 7). You can also generate a random keyfile of your own, to do this just click "Generate Random Keyfile. . ." button. The "TrueCrypt Keyfile Generator" will appear. Click the "Generate and Save Keyfile. . ." button. Save your randomly generated keyfile to a temporary file in your hard drive. Once saved, a confirmation box will appear. ( Figure 8 ). Figure 8: Randomly Generate your own Keyfile. Once you have saved your Randomly generated Keyfile. Click the "Close" button in the "TrueCrypt Keyfile Generator". Click Click the "Add Token Files. . ." button in the "TrueCrypt - Keyfiles" dialog window. When prompted, enter the ACOS5/CryptoMate User PIN. ( Figure 9 ). Figure 9: Enter your ACOS5/CryptoMate User PIN when prompted. After successfully validating the PIN, the "Select Security Token Keyfiles" dialog window will show up. In the "Select Security Token Keyfiles" dialog, click "Import Keyfile to Token". Select the file that you have generated and saved in Step 10  Once selected, You will be prompted for a verification. Just Click OK on the "New Security Token Keyfile Properties" dialog. Wait for a while, the process might take some time depending on the size of the Keyfile. Once the Keyfile has been saved, it will be available for selection. ( Figure 10a and Figure 10b ). Figure 10b: Set the Keyfile Name or you can leave the default and select "OK" Figure 10a: The Keyfile is now saved in the ACOS5/CryptoMate token. Select the newly created Keyfile and Click "OK". You should now see your Keyfile in the Keyfiles list ( Figure 11). Figure 11: Newly Created Keyfile in the list.. Select "OK" and you will now go back to the "TrueCrypt Volume Creation Wizard" In the "TrueCrypt Volume Creation Wizard" Click "Next...". In the next Dialog you will be asked to Format your TrueCrypt Volume. Click the "Format" button and wait until the formatting process is done. The formatting process might take a while depending on the Volume size you specified in Step 7 above ( Figure 12 ). Figure 12: Your TrueCrypt Volume is now being formatted. After successfully formatting you Volume/ Your Volume is now created and ready for use ( Figure 13 ). Figure 13: Your TrueCrypt Volume is now being formatted. Click "Next" and then Click "Exit". Now that you have created an Encrypted Volume, you can now delete the file that you have generated in Step 10.

  https://www.acs.com.hk/en/frequently-asked-questions/1/smart-cards-smart-card-operating-systems/