User manual CHARISMATHICS SMART SECURITY INTERFACE VERSION 4.7

[. . . ] Charismathics Smart Security InterfaceTM V4. 7 Manual Contents 1 2 3 3. 1 3. 2 3. 3 3. 4 3. 5 4 4. 1 4. 1. 1 4. 1. 2 4. 1. 3 4. 1. 4 4. 1. 5 4. 1. 6 4. 1. 7 4. 2 4. 3 4. 4 4. 4. 1 4. 4. 2 4. 4. 3 4. 4. 4 4. 5 4. 5. 1 4. 5. 2 4. 6 4. 6. 1 4. 6. 2 4. 7 4. 7. 1 4. 7. 2 4. 8 4. 8. 1 4. 8. 2 4. 8. 3 4. 8. 4 Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 About this Manual. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Installation Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] 4. 4. 4 Importing a Secret Key If you own a secret key that you want to use, you can import it with the menu "Edit" via the menu item "Store Secret Key". The Secret Key must be specified in hexadecimal representation and be of the correct length: 192 or 128 bits for Triple-DES and 64 bits for DES. Importing takes place by inserting the bits into the field "Secret Key (hexadecimal)", e. g. copy and paste. 4. 5 Generating and Importing Certificates In order to use the smart card for digital signatures or encryption you need a key pair comprised of a private key and a public key. The public key has to be accessible to communication partners via a certificate. These certificates can be generated and managed by the administration tool. These options to create a certificate from within the administration tool are: 18 1. You can sign the certificate corresponding to a public key by yourself or make a certificate request, such that another instance e. g. Then, you can import certificates if needed together with the corresponding key. 4. 5. 1 Generating Self-Signed Certificates and Certificate Requests You can generate the certificate belonging to a public key by signing it yourself or make a certificate request such that another instance, e. g. To this end you highlight the Private Key and select one of the "Create. . . " entries from the "Certificates" menu. In order to generate the certificate request you enter the data into the corresponding fields. In case of a certificate request, you create a file to send it to the authority that should sign the certificate (e. g. Therefore, you store the request as a p10 file in a directory and follow the instructions of the corresponding authority intended to sign the certificate. Once the certificate has been returned by the issuer, you have to import the certificate using the menu item "Import Certificate". Note: There is an explanation of the certificate attributes and how to employ the keys in the appendix B of this manual. 4. 5. 2 Importing Certificates In case you already own certificates that you intend to employ, you can import them with the menu "Certificate" under the item "Import Certificate". Certificates which belong to key pairs are directly assigned to the associated "container" after the importation. Certificates without keys - as for example CA certificates - are assigned to the file "Certificates". 19 4. 6 Creating Profiles If you want to use a smart card, there must be a profile on this smart card. In a first step you have to setup the corporate profile on this smart card. Click the menu "Manager" "Create Token Profile". 4. 6. 1 Smart Card with Profile If there is already a profile on the card and you want to create a new one, the existing one will be deleted as a first step. If you have created the profile yourself, you have to enter the Card PIN you have assigned to the card. The further proceedings are the same as in the following section ". . . in the case of an empty smart card". [. . . ] Order C_VerifyRecoverInit, C_VerifyRecover, C_VerifyRecover, where on the first C_VerifyRecover a NULL_PTR will be passed as data. For further verifications C_VerifyRecoverInit must be called first. Special Feature: Encrypt (RSA): Description: Order: Encrypts data. C_EncryptInit, C_EncryptUpdate, C_EncryptFinal or C_EncryptInit, C_Encrypt C_Encrypt works as if C_EncryptUpdate and then C_EncryptFinal were called. If you don't do this, you receive with C_EncryptFinal all data at one time. [. . . ]