GemSAFE User Guide Version 2.1 TM CONTENTS INTRODUCTION ...................................................................................1 Purpose............................................................................................1 Conventions .....................................................................................1 Documentation .................................................................................1 GEMSAFE BASICS ..............................................................................2 What Is GemSAFE? .........................................................................2 What Is a Smart Card? ......................................................................2 What Is the GemSAFE Smart Card? ..................................................3 Onboard Key Generation ...........................................................3 Increased Certificate Storage .....................................................3 Increased Signature and Unwrap................................................4 What Is Public Key Cryptography? ....................................................4 What Is a Key Pair?..........................................................................5 Are There Different Security Levels?.................................................6 What Is a Digital Certificate? ............................................................6 What Are Certificate Authorities?......................................................7 What Is a Digital Signature?..............................................................7 What Is S/MIME? ............................................................................8 What Is SSL? ...................................................................................8 GETTING STARTED ..........................................................................10 The GemSAFE Kit ......................................................................... 10 Requirements ................................................................................. 10 Platform ................................................................................. 10 Peripherals.............................................................................. 10 Browser ................................................................................. 10 E­mail Account ...................................................................... 10 Installation ..................................................................................... 11 Connecting the Card Reader .................................................... 11 Installing GemSAFE ............................................................... 11 WINDOWS 2000..................................................................................13 Installation on Windows 2000.......................................................... 13 Smart Card Logon .......................................................................... 13 Lock and Unlock Computer............................................................. 13 i CONTENTS Signing Macros .............................................................................. 13 Opening Signed Documents ............................................................ 14 CERTIFICATE MANAGEMENT .........................................................15 Your Certificates ............................................................................ 15 Obtain Your Certificate ........................................................... 15 View Your Certificate ............................................................. 15 Delete Your Certificate............................................................ 16 User Certificates............................................................................. 18 Add User Certificates.............................................................. 18 View User Certificates ............................................................ 19 Delete User Certificates........................................................... 20 Public Directories.................................................................... 21 Web Site Certificates ...................................................................... 22 View Web Certificates ............................................................ 23 Install Web Site Certificates .................................................... 23 Select Your Certificate for the Web.......................................... 23 Certificate Authorities..................................................................... 24 View CAs .............................................................................. 24 Add CAs ................................................................................ 26 Delete CAs............................................................................. 26 CA Integrity............................................................................ 27 SECURE E­MAIL................................................................................28 Link Your Certificate...................................................................... 28 Secure E­mail Settings.................................................................... 29 Change Session Key Length............................................................ 30 Test Secure E­mail ......................................................................... 31 Send Secure E­mail ........................................................................ 31 SECURE WEB SITES ........................................................................33 Test User Authentication................................................................. 33 CARD DETAILS TOOL ......................................................................34 Services ......................................................................................... 34 Card Selection ................................................................................ 35 Card Release.................................................................................. 35 Certificate Registration.................................................................... 35 PIN Code Management................................................................... 35 Verify PINs ............................................................................ 35 Change PINs .......................................................................... 36 Unblock PINs......................................................................... 36 Card Information ............................................................................ 36 ii CONTENTS Card Initialization ........................................................................... 36 Diagnostic Information.................................................................... 37 EXPORT REGULATIONS ..................................................................38 ABOUT GEMPLUS.............................................................................39 TERMINOLOGY..................................................................................40 Abbreviations and Acronyms........................................................... 40 Glossary......................................................................................... 40 iii INTRODUCTION Purpose The GemSAFE User Guide provides simple, easy­to­follow instructions to install, configure, and use GemSAFE 2.1 and the GemSAFE Card Details Tool, a simple administration tool for GemSAFE cards. The GemSAFE User Guide addresses topics to effectively use GemSAFE. The guide does not address all browser­specific topics related to using digital certificates. Refer to your browser documentation for additional information. The GemSAFE User Guide was validated on the Windows 2000 platform with the following versions of Microsoft and Netscape applications: Outlook Express 5.0, Outlook 2000, Microsoft Internet Explorer 5.0, and Netscape Communicator 4.6.1. If you are using a different platform or different versions of Microsoft or Netscape applications, you may encounter different options regarding the management and use of your digital certificates. The GemSAFE Quick Start Guide and GemSAFE User Guide are located in the \Doc folder of the GemSAFE CD­ROM. You can also refer to GemSAFE Online Help for quick and easy task instructions. Access GemSAFE Online Help from the GemSAFE CD­ROM. NOTE: Use Adobe Acrobat Reader to view all documentation on the GemSAFE CD­ROM. You can download Acrobat Reader from Adobe's Web site at www.adobe.com/acrobat. Conventions Documentation 1 GEMSAFE BASICS Learn basic information about GemSAFE, smart cards, public key cryptography, and current IT standards. GemSAFE is a smart card-based solution designed to secure e-mail communication and Internet transactions. The GemSAFE smart card supports encryption/decryption and signature functions. GemSAFE for Windows 2000 also supports secure logon and the capability to sign Office 2000 macros. The encryption/decryption function enables you to send and receive secure e­mail to protect confidential or private information. You can use the signature function to sign your messages. By signing messages, you can prove to the recipient that you are who you claim to be. GemSAFE combines the privacy, integrity, and authentication functionalities provided by cryptographic algorithms with the simplicity, portability, and convenience of smart cards. Your private key, digital certificate, and other personal information are securely stored on your GemSAFE card to prevent fraudulent use of your electronic identity. The latest industry standards such as SSL3 (for Web access) and S/MIME (for e-mail) enable inter-operability of security services between any browser interface and any Web server. However, the security hole in SSL3 and S/MIME is the management of your private key and digital certificate. Without GemSAFE, your private key and digital certificate are stored on your hard drive, which makes them susceptible to unauthorized access and fraudulent use. Without GemSAFE, your electronic identity is at risk. GemSAFE provides double­barreled security! With GemSAFE, you get the hardware­based security inherent in smart cards and the software­based security of PIN codes. Hardware­based security is a principal security advantage. It is significantly more secure than software­only solutions. Without possession of your smart card and knowledge of your PIN code, no one can use your identity. GemSAFE is your electronic passport to the digital world. · Your private key never leaves your smart card. · The smart card is hardware­based security. · The PIN code protects key use. · GemSAFE is portable and convenient. What Is GemSAFE? What Is a Smart Card? Smart cards are the latest addition to the IT world. The smart card is the size of a conventional credit card. But unlike the credit card, which has a magnetic stripe, the smart card has a silicon microprocessor chip to store and process electronic data and applications. The advantage of the smart card is SECURITY. 2 GEMSAFE BASICS Gemplus manufactures two types of smart cards: contact and contactless. Contact smart cards must be inserted into a smart card reader. Contactless smart cards use a microprocessor chip and antenna to process data. Smart cards provide the most sophisticated security available on the market. Your GemSAFE card stores your private key and digital certificate. In the past, your only option was to store your private key on your local hard drive, rendering it susceptible to theft and fraudulent use. With GemSAFE, your electronic identity is secure. You must have both the card and PIN code to use the card. The GemSAFE card is tamper resistant. The structure and operating system of the card make it practically impossible to penetrate, probe, or pilfer card data. Perhaps the most convenient aspect of the GemSAFE smart card is portability. With GemSAFE, you can carry your electronic passport with you at all times and use it on any GemSAFE­equipped computer in the world. The GemSAFE smart card has a robust and flexible design. Three specific features offer greater freedom and enhanced security. What Is the GemSAFE Smart Card? Onboard Key Generation The GemSAFE card offers onboard key generation. With this feature, every time you enroll a new certificate on your card, a NEW key pair is generated on your card. In other words, you are not limited to using the same key pair for every certificate that you enroll. One significant advantage of onboard key generation is the ability to monitor and control the life span of your RSA key pairs. Increased Certificate Storage You can store up to four key pairs and four digital certificates on your GemSAFE card. This feature provides the convenience of using up to four digital certificates for whatever purposes you want. For example, you can use o ...