Introduction

DESlock+ is a data encryption tool designed to provide fast and transparent protection to files and folders on a Windows client or server PC. It can be used to protect any data including personal files, corporate information, confidential records or email.

The ability to use common encryption keys means that DESlock+ users are able to work with shared encrypted data. By using a common key, a workgroup can edit and update shared files within an encrypted folder on a network drive without the need to decrypt and re-encrypt the files whilst working.

Data can be encrypted to and from any storage device on the host PC using one of several proven and trusted encryption algorithms. Up to 64 encryption keys are stored within the hardware of a DK5 DESkey and are only available for use after entering a secure user definable password or phrase. Software based Key-Files provide only a single encryption key.

Encryption keys can be securely transferred between DK5 DESkeys and the entire process is taken care of by a simple user wizard. The powerful RSA public-key algorithm is used within the DESkey itself to encrypt and decrypt encryption key data. By using hardware based public key cryptography, encryption key data is well protected during transmission between users even over insecure channels. Encryption keys cannot be transferred between Key-Files.

Key management and administration when using DESlock+ with a DK5 is controlled using protected settings within the DESkey hardware. Once a DESkey is configured, its permissions are the same from one PC to the next. In addition unique key propagation controls make it possible to control the range and scope of key sharing within workgroups.

See About this version for more information about this version of DESlock+.


Encryption Algorithms

DESlock+ currently supports three algorithms to perform encryption of files and folders. The Key Generation Wizard allows the encryption type to be specified from the list, but a Key-File can only supports Blowfish. These available encryption algorithms are:

AES

Blowfish

Triple DES (3DES)


Key Exchange Algorithm

DESlock+ also uses the RSA algorithm and Public Key cryptography techniques for all key transfer operations. This allows encryption keys to be securely transferred even via insecure communication channels e.g. the Internet. Encryption keys can only be transferred between DK5 DESkeys, and not Key-Files.

RSA

The RSA asymmetric algorithm was named after Ronald Rivest, Adi Shamir and Leonard Adelman, Computer Science researchers at the Massachusetts Institute of Technology, who developed and patented the algorithm in 1977.


DESlock+ Components

DESlock+ can be used with hardware tokens known as DK5 DESkeys, or with a software based Key-File. DESlock+ may be downloaded freely from our website www.deslock.com, or is included with a DESlock+ sales pack. Key-Files can be downloaded from our website. Please review the licensing information for restrictions on use of Key-Files.

A copy of DESlock+ using a Key file can be used with hardware tokens at any time if they are available. A DESlock+ sales pack and additional DK5s can be purchased online or by calling our sales department.

A DESlock+ sales pack will contain the following items. Please follow the installation instructions carefully before trying to use DESlock+.

· | 2 Identical DK5 USB DESkeys
· | DESlock+ software and driver CD
· | DESlock+ User Manual
· | USB extension cable

NOTE: There are two identical DK5 USB DESkeys supplied with the DESlock+ sales pack. One of the DESkeys is intended to be the 'User' DESkey for everyday use. The second is intended to be a 'Backup' DESkey, to be kept as a means to backup important encryption keys. This safeguards access to encrypted data should the User DESkey ever be lost or damaged.

Once installed, the DESlock+ software provides utilities and wizards to allow, amongst other things, encryption keys to be managed (including generating and transferring keys), a scratchpad to access secure memory within the DESkey and an encryption plug-in for the Microsoft® Outlook® email client.

See Also


Minimum System Requirements

DESlock+ requires a minimum specification of machine in order to run effectively. The system should comply with or exceed the specifications listed below:

  • Microsoft Windows 98, Windows 98 Second Edition, Windows Me, Windows 2000 Professional, Windows XP Home Edition or Windows XP Professional.

  • 64MB of hard-disk space

  • CD-ROM Drive

  • VGA (640 X 480) or higher resolution monitor with 256 colours or more

  • Pointing Device and Keyboard

  • Type A USB Port which complies with the USB 1.1 or later specification

  • Internet Explorer 4 or later

For Windows 98 or Windows 98 Second Edition:

  • Pentium 166MHz

  • 32MB of RAM

For Windows Me:

  • Pentium 166MHz

  • 64MB of RAM

For Windows 2000, Windows XP Home Edition or Windows XP Professional:

  • Pentium 300MHz

  • 128MB of RAM

DESlock+ will not run on Windows 95 or Windows NT4.


Installation Overview

The installation and setup of DESlock+ comprises the following steps:

Step 1: Install the DESlock+ software

Step 2: Install the 'Backup' DESkey

Step 3: Configure the 'Backup' DESkey

Step 4: Install and Configure the 'User' DESkey

Step 5: Configure the Key-File


DESkey Setup Wizard

DESlock+ can be used with either a hardware DK5 DESkey or a software Key-File. Before either is used however, it must be configured.

Configuring:

Hardware: DK5 DESkey

Software: Key-File


Hardware: DK5 DESkey

Before a DK5 DESkey can be used with DESlock+, it must first be configured. There are two basic configuration methods: a single user setup and a corporate setup.

Once a DESkey has been successfully configured, details of the device will be stored in the local Key Transfer Database. Use of the Key Transfer Database is described in more detail later in the manual.

When the DESkey setup wizard is run, a wizard will be displayed prompting the user to select either the single user or corporate setup type.

Figure 3 - 1

The single user setup is designed for individuals to easily configure their own DESkey. This is ideally suited for small business and personal use where access to the DESkey does not need to be restricted by an administrator. The DESkey can be setup and used immediately.

Choosing corporate setup will launch the administration stage of the corporate setup. The corporate setup is designed for larger organisations where access to and operation of the DESkey can be restricted. The setup is intended to be run by the administrator who can pre-set various options within the DESkey and can specify the access level of the final user. Before use the DESkey must finally be configured via a final corporate user setup phase.

If the single user setup type is chosen, a further option dialog will be shown. The typical setup is the quickest setup type as default values will be used for certain configuration questions. The advanced setup type will allow the user to configure the DESkey options during the DESkey setup process. These options can be changed after setup is complete using the DESlock+ Control Panel.

Figure 3 - 2

Both setups are the same. The corporate simply allows the key to be partially setup and finalised by the end user. An alternative would be to do a single user setup and give the DESkey a dummy password the user could change. At the end of the day, there would be no difference.

Typical Single User Setup

Advanced Single User Setup

Corporate Setup


Typical Single User Setup

Enter an Administrative Master password in the first box and re-enter it in the second box to confirm. The Next button will be disabled until the password has been confirmed. When this has been done, click Next to continue.

Figure 3 - 3

Enter a User password in the first box and re-enter it in the second box to confirm. The user password will be used to activate the DESkey. When ready, click Next to continue.

Figure 3 - 4

Enter a name to identify the DESkey. This name can be between 1 and 16 characters long and can contain spaces. When a suitable name has been entered click Next. The default name is "My DESkey."

Figure 3 - 5

The options you have chosen will now be saved to the DESkey, along with generation of an RSA private and public key pair. Click Next to begin this process. The exact length of time required to generate both cannot be predetermined. It is related to the speed of the machine so if running on a slow machine this process could take some time. When complete, click Next to proceed.

Figure 3 - 6

A default encryption key can now be generated if required. If a key is required at this stage then select the option and enter the desired name and algorithm type. The key will be added to the first slot within the DESkey key space. Click Next to continue.

Figure 3 - 7

The newly created encryption key can be backed up at this point if desired. The target DESkey list will contain a list of all connected DESkeys and all DESkeys listed in the Key Transfer Database. The backup process is described in more detail here.

Figure 3 - 8

If a key was created, it will be displayed below. Click Next to continue.

Figure 3 - 9

The DESkey has now been fully configured for single user use. It can now be activated and used with DESlock+ if desired. Click Finish to close the wizard.

Figure 3 - 10


Advanced Single User Setup

Enter an Administrative Master password in the first box and re-enter it in the second box to confirm. The next button will be disabled until the password has been confirmed. When this has been done, click Next to continue.

Figure 3 - 11

Enter the allowed number of user and master password retries and resulting action. If the password is entered incorrectly more than the allowed value the DESkey can either erase the DESkey key space, enter a time loop algorithm or lock out the user account. A locked DESkey can only be unlocked using the correct Master password. These settings can be changed at a later date using the DESlock+ Control Panel.

Figure 3 - 12

DESkey functionality can be limited based upon the password entered. Entering the master password will allow all DESkey settings in the list to be modified. Any options that are not checked cannot be changed if logged in as a user. These are:

  • Change User Password

  • Change User Password Options

  • Change DESkey Name

  • Add Encryption Keys

  • Create Encryption Keys

Figure 3 - 13

Enter a User password in the first box and re-enter it in the second box to confirm. The user password will be used to activate the DESkey. When ready, click Next to continue.

Figure 3 - 14

Enter a name to identify the DESkey. This name can be between 1 and 16 characters long and can contain spaces. When a suitable name has been entered click Next. The default is "My DESkey".

Figure 3 - 15

The options you have chosen will now be saved to the DESkey, along with generation of an RSA private and public key pair. Click Next to begin this process. The exact length of time required to generate both cannot be predetermined. It is related to the speed of the machine so if running on a slow machine this process could take some time. When complete, click Next to proceed.

Figure 3 - 16

A default encryption key can now be generated if required. If a key is required at this stage then select the option and enter the desired algorithm type and name. Click Next to continue.

Figure 3 - 17

The newly created encryption key can be backed up at this point if desired. The target DESkey list will contain a list of all connected DESkeys and all DESkeys listed in the Key Transfer Database. The backup process is described in more detail here.

Figure 3 - 18

If a key was created, it will be displayed below. Click Next to continue.

Figure 3 - 19

The DESkey has now been fully configured for single user use. It can now be activated and used with DESlock+ if desired. Click Finish to close the wizard.

Figure 3 - 20


User Stage

After the admin stage of the corporate setup, before the DESkey can be used with DESlock+ the user stage setup must also be completed.

When the key is inserted prior to this final stage activation the user will be prompted to complete the DESkey setup process.

Figure 3 - 29

If selected the final stage setup wizard will run.

Figure 3 - 30

Enter a User password in the first box and re-enter it in the second box to confirm. The user password will be used to activate the DESkey. When ready, click Next to continue.

Figure 3 - 31

If the Administrator has allowed the DESkey to be renamed, enter or confirm a name to identify the DESkey. This name can be between 1 and 16 characters long and can contain spaces. The default name was set by the administrator and can be left if desired. When a suitable name has been entered click Next to continue.

Figure 3 - 32

The DESkey has now been fully configured for use. It can now be activated and used with DESlock+ if desired. Click Finish to close the wizard.

Figure 3 - 33


Admin Stage

Enter an Administrative Master password in the first box and re-enter it in the second box to confirm.

Figure 3 - 21

Enter the allowed number of user and master password retries and resulting action. If the password is entered incorrectly more than the allowed value the DESkey can either erase the DESkey key space, enter a time loop algorithm or lock out the user account. A locked DESkey can only be unlocked using the correct Master password. These settings can be changed at a later date using the DESlock+ Control Panel.

Figure 3 - 22

DESkey functionality can be limited based upon the password entered. Entering the master password will allow all DESkey settings in the list to be modified. Any options that are not checked cannot be changed if logged in as a user. These are:

  • Change User Password

  • Change User Password Options

  • Change DESkey Name

  • Add Encryption Keys

  • Create Encryption Keys

Figure 3 - 23

Enter a name to identify the DESkey. This name can be between 1 and 16 characters long and can contain spaces. When a suitable name has been entered click Next. The default is "My DESkey".

Figure 3 - 24

The options you have chosen will now be saved to the DESkey, along with generation of an RSA private and public key pair. Click Next to begin this process. The exact length of time required to generate both cannot be predetermined. It is related to the speed of the machine so if running on a slow machine this process could take some time. When complete, click Next to proceed.

Figure 3 - 25

When the key pair has been generated, click Next to proceed.

A default encryption key can now be generated if required. If a key is required at this stage then select the option and enter the desired algorithm type and name. Click Next to continue.

Figure 3 - 26

The newly created encryption key can be backed up at this point if desired. The target DESkey list will contain a list of all connected DESkeys and all DESkeys listed in the Key Transfer Database. The backup process is described in more detail here.

Figure 3 - 27

The DESkey has now been configured for administration. Before it can be used with DESlock+ it must be finally configured by the end user. Click Exit to close the DESkey Setup Wizard.

Figure 3 - 28


Software: Key-File

DESlock+ can be used with an encryption key based upon a Key-File. A Key-File itself is based on two parts of information, namely a licence file and a PEK code. The licence file is obtained from Data Encryption Systems, and the PEK code is entered by the user.

To begin the setup, the location of the licence file on the machine must be specified. Browse to the location of the file, or enter the location of the file directly. Click Next to continue.

Figure 3 - 34

Next, enter the PEK code. The licence file and PEK code determine the encryption key the Key-File will provide. Any PEK code can be entered, although the encryption key cannot be recreated without knowing the PEK code so a note of it should be kept in a safe place as a backup.

Figure 3 - 35

Next enter the name by which to refer to the Key-File and the password you require to secure access to the Key-File. If the password to the Key-File is lost, the Key-File can be recreated only if both the licence file and PEK code are known.

Figure 3 - 36

Access to the Key-File is secured by the password entered. To deter against attempts at guessing this password, the Key-File will become disabled if an invalid password is entered too many times. The Key-File will only become active again after a complete reboot of the system, at which point the bad password counter will be reset. Set the number of password attempts here.

Figure 3 - 37


Activating DESlock+

Before use, DESlock+ may be in a disabled state, denoted by the flashing disabled state icon in the system tray (Figure 4 - 1).

Figure 4 - 1

To activate DESlock+ you must login to an attached and already setup DK5 DESkey or software Key-File. If either is available, right click the DESlock+ icon and select Activate (Figure 4 - 2).

Figure 4 - 2

The DESlock+ Login box will now be displayed (Figure 4 - 3). Select the DESkey or Key-File you wish to activate and enter the correct user password for that DESkey and click OK. Click r or press the Esc key to close the login box without logging in.

Figure 4 - 3

Check the Perform Master Login box and enter the correct Master password to login to a DK5 DESkey as a Master rather than a User. Click the Show Typing box to make the password visible on screen. This option is not available with Key-Files.

If the password was entered correctly, the DESlock+ icon in the system tray will change to the enabled state (Figure 4 - 4) and DESlock+ can now be used.

Figure 4 - 4

If the password was entered incorrectly, the user can reattempt to login.

The DESkey will be disabled after the configured number of wrong password attempts. The number of attempts allowed, plus a subsequent security measure, was defined during DESkey setup. This behaviour can be changed via the DESlock+ Control Panel when logged in as a Master.

See Also


Using DESlock+

When DESlock+ is active, the system tray menu will change as shown below (Figure 4 - 5). Note that previously disabled menu items are now available and the 'Activate' entry has changed to 'Deactivate'.

Figure 4 - 5

Menu Options

About DESlock+

Help

Key Manager

Key Transfer

Key Transfer Database

Control Panel

ScratchPad

Mount Manager

Switch DESkey

Tools

Deactivate

Exit


Backup Configuration Wizard

When a DK5 DESkey is configured initially, the backup assignments shown on the Backup Page of the DESlock+ Control Panel will not have been set. Until at least one has been set, each time the DESkey is activated the following wizard will run.

This wizard enables the Backup DESkey assignments to be quickly made and any non-backed up encryption keys to be backed up.

The wizard may be cancelled, but it will run each time the DESkey is activated until at least one Backup assignment has been made.

This wizard will only appear when activating a DK5 DESkey and will never appear when activating a Key-File.

Figure 5 - 1

The first step in the wizard is to specify the 'Backup DESkey'. The Backup DESkey can be any other DESkey, and should be set to the DESkey to which you will most commonly use to store copies of encryption keys.

The assignment can be made from another DESkey that is connected to the machine, or by using an entry from the Key Transfer Database or from a DESkey encryption key request file (dlr file).

Figure 5 - 2

If the 'Use Public Key Request…' option is chosen, one must then specify which key request to use, or which entry from the Key Transfer Database to use. All available entries in the Key Transfer Database will be listed, and the option to browse to a DESkey encryption key request file (dlr file) is given.

Figure 5 - 3

Next one of the two available assignment slots must be specified to be used. The DESkey selected previously will be added as the backup DESkey into the slot selected.

Figure 5 - 4

The wizard will then make the backup assignment.

Figure 5 - 5

If the current DESkey contains any encryption keys that have not yet been backed up, this wizard can extract them so they may be added to the previously specified Backup DESkey. Please note, only encryption keys that have not been backed up to another DESkey will be extracted, and the updates must be manually imported into the specified Backup DESkey following this extraction in order to complete the backup process.

Figure 5 - 6

When the wizard is complete, the backup assignment in the DESkey will have been set and saved, and any un-backed up encryption keys found will have been extracted and can then be imported into the backup DESkey using the key manager restore function by using the Backup DESkey on this machine.

Figure 5 - 7


Description

The Terminator Code is a value within an encryption key to allow the originator control over the propagation of that encryption key. To transfer a key to another DESkey this value must be more than 0. When a key is transferred, the Terminator Code is decremented in the copy, but remains unchanged in the original.

The Group Code defines a group the DESkey can be a member of and can be used to further restrict key transfers. By default, a DESkey will not be members of any group and any encryption keys generated can, assuming a valid terminator code, be transferred to any other DESkey. However, if the DESkey is a member of a group, any encryption keys generated by that DESkey can be tied to the group so encryption keys cannot, even if the terminator code allows it, be transferred to another DESkey that is not in the same group. Even if the DESkey is a member of a group, it can still generate encryption keys that can be transferred to DESkeys outside of the group if required.

A DESkey can be a member of only one group at any one time. The group code must be set by Data Encryption Systems.


Terminator Code Example

In many cases when a common encryption key is transferred between users, the originator will want to decide whether or not a recipient can forward the key to another user.

Suppose User A creates a new project key and wishes to share it with others on the project team. User A sends the key to B and C with a Terminator Code of 0, to User D with a code of 1 and to User E with a code of 2.

Users B and C cannot copy the key any further.

User D can copy the key to other users, in this case F and G.

Because the Terminator Code is decremented at every generation, users F and G cannot copy the key.

User E had a value of 2, who copied the key to user H who in turn copied it to I, J and K.

I, J and K cannot copy the key any further.

User E also copied it to User L but in this instance manually reduced the Terminator Code to 0 (it cannot be increased or kept constant.)

L is unable to copy the key any further.

Figure 6 - 1


Group Code Example

To maintain data security, it is often necessary to control key transfers within a defined group.

In this example, user A creates a new project key and wishes to share it with others on the project team. Group code has been assigned to match that of User A’s DESkey.

User A has previously issued B, C, D and E with DESkey units having the correct fixed Group Code. User F is not a project team member and does not have a correctly coded DESkey unit.

User A transfers the key to B, with a terminator code of 1. B is then left to update the other users. C, D and E are successfully updated, but F cannot receive the encryption key.

Figure 6 - 2


DESlock+ Control Panel

The DESlock+ Control Panel allows the user to configure the DESlock+ program and to set various DESkey options. It can be launched by double clicking on the DESlock+ icon (Figure 7 - 1) in the Windows Control Panel or from the DESlock+ System Tray Menu. Some control panel pages are dependant on the activated status of DESlock+ and may not be available at all times.

Figure 7 - 1

If running under Windows XP you may need to turn 'Classic View' on to see the control panel icon in Windows control panel. Note that the control panel menu item will always be present on the DESlock+ system tray menu even if it is not visible in the Windows control panel.

Figure 7 - 2

The available control panel pages are:

General

Timeout

Hotkeys

Keys

Passwords

Backup

Adminstration

Key File


General

The general page allows the DESlock+ options to be modified.

Figure 7 - 3

Settings

Show splash screen during startup

If selected, a splash screen will be shown when DESlock+ is loading.

Don’t show login box on DESkey insertion

If selected, the DESlock+ login box will not be shown when a compatible DESkey is inserted.

Show link in IE Favourites

If selected, a URL to the DESlock+ website will be placed in the Internet Explorer favourites list.

Close DESlock+ without timed warning

If this option not selected, a warning box (Figure 7 - 4) will be displayed if DESlock+ is activated and the user attempts to exit the application. The shutdown can be cancelled before the 10 second timout is complete.

Figure 7 - 4

Synchronise folders when activating DESlock+

If selected, any DESlock+ offline network folders will attempt to be synchronised with the local copy. See Offline encrypted folders.

Disable DESlock+ Tools

If selected, DESlock+ Tools will be disabled and will not be available for use in any application.

When active, double clicking on the tray icon:

Choose the desired double click option from the drop down list. This relates to the action performed when double clicking on the icon in the system tray.

Send to settings

Disabled

Do not allow an encryption key to be emailed directly from the key manager using the "Send To…" option.

Use Default MAPI client

Use the default MAPI client to allow encryption keys to be emailed using the standard Windows "Send To…" shell extension option.

Encrypted file settings

Delete encrypted file

If selected, when decrypting an individual file (see Decrypt files with DESlock+) the encrypted original copy will be deleted.

Leave encrypted file

If selected, when decrypting an individual file (see Decrypt files with DESlock+) the encrypted original copy will be left.

Ask

If selected, when decrypting an individual file the user will be prompted to choose what to do with the encrypted original copy.


Timeout

The Timeout options control the inactivity timeout detection of DESlock+.

Figure 7 - 5

When enabled, DESlock+ can deactivate itself after a period of inactivity. This is measured as the idle time since the last key press or mouse movement, whichever is later. Alternatively, DESlock+ can be automatically deactivated when the Windows screensaver is activated.

The 'Show inactivity alert message' controls whether a warning dialog box (Figure 7 - 6) will be displayed when DESlock+ has been deactivated due to inactivity.

Figure 7 - 6

Once deactivated, access to protected files will be denied and the user must log back into the DESkey to continue working with protected files.


Hot Keys

Hot keys are keyboard shortcuts that can be used to quickly activate a particular function.

Figure 7 - 7

Two hot keys are available in DESlock+ to close DESlock+ and remove it from the system tray or to control activation of the DESkey: If the DESkey is currently active the hot key will deactivate it; If the DESkey is not active the hot key will activate it and prompt the user to login.

To enable these options make sure the check box is set and type the desired key press combination into the edit box. The result will then automatically be displayed. If the value needs to be modified, simply type the new key press combination and it will be automatically updated.

Use the 'Space' key to clear the hot key selection.


Keys

The options available on the Keys page are dependent on user privileges so this may require being logged on as a Master. It allows access to the encryption key wizards and allows the DESkey name to be changed.

This page is only available if DESlock+ has been activated with a DK5 DESkey.

Figure 7 - 8


Passwords

The options available on the Passwords page are dependent on user privileges so this may require being logged on as a Master. It allows the user and master password to be changed along with the user password retry limit and resulting action to be modified.

This page is only available if DESlock+ has been activated with a DK5 DESkey.

Figure 7 - 9

User Password Options

Erase if incorrect: If selected, all encryption keys held within the DESkey will be deleted.

Time-loop if incorrect: If selected, the DESkey will enter a time loop delay between login attempts. The time delay will increase exponentially starting at 1 minute.

Lock if incorrect: This option is only available for the user account. If selected the DESkey will only respond when logging in as a master, even if the correct user password is used. Successfully logging in as a master will unlock the user account.

Retries: This specifies the number of consecutive wrong password attempts the DESkey will permit before performing the specified action.


Backup, control panel page

Backup

Backup assignments

Backup DESkeys are intended to store copies of important encryption keys so that encrypted data can still be accessed even if the original DESkey and/or encryption key is lost. If the only copy of an encryption key is lost there is no way to recover data encrypted using the key, so important keys should always be backed up.

Each DESkey can store details of two other DESkeys which can be assigned as intended recipients for encryption key backups. The Backup page is used to assign the Backup DESkeys.

This page is only available if DESlock+ has been activated with a DK5 DESkey.

Figure 7 - 10

Backup DESkeys can only be assigned from the local Key Transfer Database. This means to be present in the local Key Transfer Database either the DESkey must have been setup on the local machine or the public key must have been imported when the key transfer wizard was used previously.

The benefit of the two Backup assignments is that the details are stored in the hardware of the DESkey itself. This means that encryption key backups can be created for these two DESkeys on any machine, regardless of whether or not the local Key Transfer Database also has details of the DESkeys.

Encryption keys can be Backed up either when they are created using the Key Generation Wizard, or by using the Encryption Key Manager. Encryption keys may also be transferred to a backup DESkey using the Key Transfer Wizard. The backup process is described in more detail in the Key Manager section of the manual.

If DESlock+ is activated but no Backup DESkey assignments have been made in the active DESkey, the Backup Configuration Wizard will run.


Administration

The Administration page is only available when logged into a DK5 DESkey with the Master password. It allows DESkey options to be set.

Figure 7 - 11

Master Password Options

These options will control the action in the event of the specified number of consecutive incorrect password attempts being entered in an attempt to login.

Erase and time-lock if incorrect: If selected, all encryption keys held within the DESkey will be deleted. This will also enable the time-lock feature.

Time-lock if incorrect: If selected, the DESkey will enter a time loop delay between login attempts. The time delay will increase exponentially starting at 1 minute.

Retries: This specifies the number of consecutive wrong password attempts the DESkey will permit before performing the specified action.

User Rights

Select the operations that are available when logged on as a User. Please note that when logged in with the master password there are no access restrictions.


Key File, control panel page

Key File

The Key-File page allows the Key-File name, password and password retries count to be configured. If the incorrect password is entered more than the retries count, the Key-File will be disabled until the machine has been rebooted.

This page is only available when DESlock+ has been activated with a Key-File.

Figure 7 - 12


Encryption Key Manager

The Encryption Key Manager allows encryption keys to be created, renamed, deleted, transferred, backed up and restored.

The Encryption Key Manager can be launched by right clicking the DESlock+ icon in the system tray and selecting Key Manager.

When using DESlock+ with a Key-File, this applet is for reference only as there is no encryption key management functionality with a Key-File.

Figure 8 - 1

The DESkey name and DESkey serial number are shown on this screen. The name can be changed at this stage if the logged in user has sufficient privileges to do so. The DESkey serial number cannot be changed and is shown for reference purposes only.

If the DESkey is a member of a key group then the group code will be shown to the right of the serial number. If the DESkey is not a member of a group then nothing will be shown.

Key Storage


Key Storage

All encryption keys are stored within the DESkey. The list shown above is split into multiple rows representing the 64 key slots available. The columns are labelled as follows:

Key Slot

The location of the encryption key in the DESkey key storage space.

The following icons can be displayed alongside the slot number:

Icon | Meaning
 | The slot contains the default encryption key. Note the text will also be bold.
 | The slot contains an encryption key but it is not set as the default key.
 | The slot does not currently contain an encryption key.
 | The slot contains an encryption key (which may be the default encryption key) but there is no record that a backup file or database entry has been made for any DESkey other than that which created the DESkey. If the DESkey is lost then any data encrypted using this key may be unrecoverable.

Name

A user definable descriptive name given to the encryption key. For example this could be the name of a person, a department or a project.

Type

The name of the algorithm the key can be used with. The various algorithm types available are AES (Rijndael), 3DES (Triple DES) and Blowfish.

Length

The length of the key measured in bits. AES and Blowfish keys are 128-bits long. The 3DES key is 112-bits and comprises 2 unique 56-bit DES keys. Key length cannot be changed for these algorithms.

Terminator Code

The current value of the Terminator Code.

The following icons can be displayed to represent the terminator status.

Icon | Meaning
 | The Terminator Code value of this key is set to 5. This key can be transferred with a new Terminator Code value less than the value displayed i.e. the value can be no greater than 4.
 | The Terminator Code value of this key is zero. This key cannot be transferred under any circumstances.

The default terminator value for new keys is 255.

When issuing an encryption key, the Terminator Code of the original key will not change. The new value specifies the Terminator Code value of the encryption key within the destination DESkey.

Encryption Key Slot Options


Options

A list of option buttons is displayed on the right hand edge of the Encryption Key Manager. The options available are related to the state of the currently selected key slot e.g. the option to delete an empty key slot is not available.

These options can also be selected from a popup menu after right clicking anywhere within the key slot. Please note that some of these options are dependent on user permissions and may require Master access to perform them.

The following options may be available on a key slot containing an encryption key:

Delete Key

Rename

Make Default

Send To

Backup

The following options may be available on an empty key slot:

Generate

Restore


Key Generation Wizard

The Key Generation Wizard is used to create new encryption keys on a DK5 DESkey. New keys can be used to encrypt data and can also be transferred to other DK5 DESkeys if desired. Additional encryption keys cannot be created on a DESlock+ Key-File.

Generating a new Encryption Key


Generating a new Encryption Key

When the wizard is launched, the welcome screen (Figure 9 - 1) is shown. Click Next to begin key generation.

Figure 9 - 1

Enter a name to identify the encryption key. This name can be anything for example the name of a person or the name of a project with which the key will be used.

The Set as default key checkbox is used to set this key as the default key for encryption. The default key will always be initially highlighted when selecting encryption keys. Click Next to continue.

Figure 9 - 2

Select the type of encryption key to generate. This relates to the algorithm that the key will be used with.

The different types of algorithm are described in more detail on page 2. A brief description is also given in the Algorithm Details box. Click Next.

Figure 9 - 3

If you choose to backup an encryption key, a copy will be saved to the Key Transfer Database and optionally also to a DESkey Update file. Saving to a file allows the encryption key to be imported to another DESkey using the Key Transfer Wizard.

Figure 9 - 4

From the target DESkey list, choose the DESkey(s) to which you wish the encryption key to be backed up. The list will contain any DESkey which is referenced in the Key Transfer Database on the local machine, or which is defined as a Backup key for the current DESkey.

See Backup for more details on creating the backup file or database entry and information and additional steps required to complete the backup.

The new key has now been generated and added to the DESkey key space. It can now be used for encryption of data. The terminator code value of all new keys will be 255. Click Finish to end the Wizard.

Figure 9 - 5


Key Transfer Database

The Key Transfer Database is a database stored on the local machine. It contains public key information for DK5 DESkeys, and also encryption key updates for those DESkeys. Encryption key updates are encryption keys that have been previously extracted with the specified DESkey as the intended destination. The Key Transfer Database is not used when working with a Key-File.

Access to the Key Transfer Database is achieved via the Key Transfer Database applet. This is launched by right clicking the DESlock+ icon in the system tray and selecting Key Transfer Database.

Figure 10 - 1

When encryption keys are backed up, or transferred to another DESkey, the first step is always to extract the encryption key. The encryption key cannot be extracted directly; instead one must specify the DESkey to which the encryption key is destined so it may be securely extracted and protected.

Each DESkey contains a public/private RSA key pair. The public key of a DESkey must be known in order to extract the encryption key. This encryption key is protected with this public key so that it can only be understood by the DESkey with the corresponding (paired) private key. No other DESkey would be able to use the encryption key.

Extracted encryption keys are stored in the key transfer database, encrypted with the recipient's public key. From here they can be deleted if required. To do this, select a DESkey from the "Public Key Requests" list and select the encryption key update from the "Key Backups For Selected Request" list. Then click the "Delete" button associated with this list.

To delete the public key request for a specified DESkey click the "Delete" button associated with the "Public Key Requests" list. This in turn will delete all encryption key updates associated with that public key.

To add a Public Key Request, click the "Import" button. This will read the public key from an existing DESkey Request (DLR) file which can be created using the Key Transfer Wizard.


Key Transfer Wizard

The Key Transfer Wizard has three steps designed to allow encryption keys to be transferred to and from a DK5 DESkey. Key-Files do not support key transfer so the Key Transfer Wizard cannot be used with a Key-File.

Whenever an encryption key is required to decrypt data, but is not present within the active DESkey, it must be requested using this wizard.

The three steps involved in key transfer are:

  • Key Request

  • Key Issue

  • Key Update

The Request and Update steps are performed by the user requesting the key. The Issue step is performed by the user issuing the key.

Files used in the key transfer process will have one of the following two icons.

Icon | Meaning
 | A DESkey Request file (file extension .DLR).
 | A DESkey Update file (file extension .DLU).

As files created in the backup process are equivalent to DESkey Update files, the Key Transfer Wizard can also be used to add encryption key backups to a DESkey.

Transferring Encryption Keys


Transferring Encryption Keys

When the Wizard is launched normally, the option screen (Figure 11 - 1) is shown.

Figure 11 - 1

If the Wizard is launched by the Outlook plug-in, this screen is not shown as the desired action is already known. Similarly, if double clicking on a DLU or DLR file the Wizard will be launched with the appropriate option selected.

Request a key from another user

Issue a key to another user

Update your DESkey with a key from another user


Request a key from another user

The request option of the Key Transfer Wizard will create a request file. This file is necessary to issue an encryption key.

Either 'browse' for or manually enter the location and filename to store the request. Click Next.

Figure 11 - 2

The request is complete and the request file has been saved to the location specified. This file must now be sent to the issuing DESkey, for example by email.

Figure 11 - 3


Issue a key to another user

The issue option of the Key Transfer Wizard will extract an Encryption Key and protect it with the requesting DESkeys Public Key. A copy of the Public Key must be available either from details stored in the Key Transfer Database or by using a request file.

Either Browse for or manually enter the path and filename of the request file, created by the requesting DESkey. Or alternatively, if it is listed select the DESkey from the Key Transfer Database. Click Next.

Figure 11 - 4

Details of a DESkey will be stored in the Key Transfer Database if the requesting DESkey was setup using the DESkey Setup Wizard on this machine or the public key was chosen to be added during a previous key transfer operation.

If a request file is used and the key details of the public key are not already stored in the local Key Transfer Database, the user will be given the option of adding the public key here.

Select the encryption key you wish to issue. Any of the keys can be issued provided the Terminator Code is non zero. When the correct key has been selected, click Next.

Figure 11 - 5

Set the new value for the Terminator Code. The new value must be less than the Terminator Code of the encryption key in the issuing DESkey. For example, if the key being issued has a Terminator Code of 5 then the new value must be between 0 and 4 (inclusive). If a value is not explicitly set the default is zero. This value relates to the value assigned to the Terminator Code in the requesting DESkey and will not modify the original copy in the issuing DESkey.

If 'Tie to group code' is selected, this restricts further transfer as the key must stay within the group. The option is only available if the current DESkey is a member of a group.

Figure 11 - 6

Either 'browse' for or manually enter the location and filename for the update file. This file will contain the selected encryption key, protected by the public key of the requesting DESkey so that the key can only be added to the requesting DESkey. This file will need to be used by the requesting DESkey during the update procedure.

Figure 11 - 7

The Issue is complete and the update file has been saved to the location specified. This file must now be sent to the requesting DESkey.

Figure 11 - 8


Update your DESkey with a key from another user

The update option of the Key Transfer Wizard will update your DESkey with an encryption key from another DESkey. This includes encryption keys sent by other users or encryption keys that have been backed up to a file.

Either Browse for or manually enter the path and filename of the update file. Click Next.

Figure 11 - 9

Once the file has been opened, the location in the key storage space of the DESkey must be specified. The name of the encryption key and the Terminator Code will be displayed. Once a suitable location has been specified click Next.

Figure 11 - 10

The update is complete and this DESkey now contains the new encryption key. Files can now be encrypted or decrypted using this key.

Figure 11 - 11


Encrypting with DESlock+

There are several ways to encrypt data using DESlock+. Either an entire folder can be encrypted, allowing transparent and automatic encryption and decryption of the files. Individual files can be encrypted or decrypted manually when required. It is also possible to manually encrypt and decrypt text data in programs without needing to encrypt the entire file.

Folder Encryption

Mountable Encrypted Files

Offline Encrypted Folders

Email encryption with Outlook Plug-in

Text Encryption

Individual File Encryption


Folder Encryption

The following guide demonstrates encryption of a folder using file system encryption. In this example the folder being encrypted is named 'My Encrypted Documents' and is located on the desktop.

Figure 12 - 1

Right click on the folder from Windows Explorer and choose Encrypt with DESlock+… from the context menu. This will launch the Folder Encryption Wizard which will guide you through the encryption process (Figure 12 - 3).

Figure 12 - 2

Please note that not every folder can be encrypted using DESlock+. If DESlock+ determines that a particular folder cannot be encrypted, perhaps because it is a key system folder, then the option to encrypt will not appear. This is to prevent the machine becoming inoperable because folders required by Windows at boot time are unavailable.

DESlock+ may also warn the user that a folder may be unsuitable for encryption if it determines that there is a chance the machine may be inoperable if the folder was encrypted.

Figure 12 - 3

You must choose an encryption key to use for the encryption of the folder. Any key listed in the DK5 DESkey key space or the Key-File can be used to encrypt the folder. A password cannot be used to encrypt a folder.

If the only copy of an encryption key is lost there is no way to recover data encrypted using that key. Important keys should be backed up to avoid loss of data.

Figure 12 - 4

Before the encryption begins, a summary screen will be shown with the name of the folder being encrypted, the name of the key being used and the algorithm type. If this is satisfactory, click Next to begin the encryption process.

Figure 12 - 5

When ready to encrypt, click Start. As the encryption progresses the icons will turn from their initial state to green. This process may take some time if there are a large number of files in the folder. When complete the folder and all files within, including those within sub folders, will have been encrypted using the specified key.

Figure 12 - 6

If all tasks were successful, the folder will now be encrypted.

Figure 12 - 7

Once the folder has been encrypted, any files copied to, moved to or created in the folder, including sub folders, will be automatically protected.

Note that an encrypted folder will have the following icon

Figure 12 - 8

It is important to note that during the encryption process a copy of the original data will have been made and saved in a folder of the same name but with the suffix "(DLP Backup)". If you do not want this backup to be saved you may uncheck the box on the final wizard screen.

See Also


Encrypting Network Shares

It is not possible to encrypt a folder on a network drive. For network drives, you should use a DESlock+ Mountable File. The file can reside on a network location and can be mounted from there when necessary.


Individual File Encryption

DESlock+ can also integrate with the Windows shell to allow encryption and decryption of individual files. This allows files to be encrypted enabling them to be transferred securely, remaining in encrypted format. Please note that this is not the same as folder encryption as encryption and decryption is not automatic, although the same encryption keys and algorithms can be used in both cases.

The shell integration allows files to be encrypted or decrypted after 'right-clicking' on them (Figure 12 - 10).

Figure 12 - 10

The available menu options are:

Encrypt Files with DESlock+

Decrypt Files with DESlock+

Process Files with DESlock+


DESlock+ Tools

DESlock+ Tools is a utility that integrates with most Windows applications to allow encryption and decryption of text within a window.

To use DESlock+ Tools in an application you should ensure it is enabled for that application. To do this choose the Tools, Settings menu from the DESlock+ System Tray icon. This will bring up the Settings window, where you can set hotkeys for encryption/decryption with DESlock+ tools, and also set which applications will display DESlock+ Tools options. Check those applications you wish to use DESlock+ tools with. The other button can be used to add applications to the list.

Figure 12 - 14

When a program has been included, the system menu will display a DESlock+ menu which enables the encryption or decryption of the current window contents.

Figure 12 - 15

If an application has not been included, DESlock+ Tools can still be used but it must be accessed through the DESlock+ System Tray icon.

Any selected text in the current window, or text in the clipboard, can be encrypted or decrypted with DESlock+ Tools.

DESlock+ Tools is compatible with the Outlook Plug-in, meaning it can be used to send or receive encrypted messages with another user using the Outlook Plug-in.


Offline encrypted folders

It is possible to protect a local cached copy of a non-encrypted network folder, in a similar manner to the standard Windows offline folder support. This is useful where network resources are required to be taken off site and the offline copy must remain secure.

To make an encrypted local copy available, right click on the network folder and choose Make local encrypted copy from the DESlock+ menu item.

Figure 12 - 16

Next, the folder synchronisation wizard will guide you through the synchronisation process. The initial time this is run, the user is prompted to choose an encryption key, to be used to encrypt the data locally, and also specify the local folder to store the synchronised data in.

Figure 12 - 17

When the folder has been synchronised the icon will change to reflect the status.

Figure 12 - 18

The synchronised folders are accessible via the 'DESlock+ Offline Folders' icon in My Computer or by browsing directly to the synchronised folder store, specified during the initial synchronisation phase.

Figure 12 - 19

Figure 12 - 20

The folder structure used is based on the path of the network folder. In this case the path was:

p:\tom's network folder\a network folder


DESlock+ Mount Manager

The DESlock+ Mount Manger is designed to allow a special type of DESlock+ encrypted file to be mounted by Windows and accessed as a normal volume or drive. Such an encrypted file is designed to be placed on any existing media, be it an existing local drive, a network drive, removable media. It can also be used in any location where standard DESlock+ folder encryption is not desired or is not suitable.

The DESlock+ Mount Manager program is accessible via the DESlock+ System Menu. This feature is only available on Windows 2000 or later.

Figure 13 - 1

Create a Mountable File

CD Autorun

Using Mountable Files

Encryption Key Caching


Creating a Mountable File

To create a mountable file, run the Mount Manager application. Click the Create button to create a new mountable file, or the Open button to open an existing mountable file.

Figure 13 - 2

If creating a new file, first enter a file name and location to store the file. Next, you must enter the attributes of the file (see Figure 13 - 3).

First choose to encrypt the Mountable File with an encryption key or a password. The Volume Size setting specifies the size of the drive that this file will provide. By default, this will be 10% of the available space on the hard disk the file is located; The minimum disk size is 10MB. This value cannot be modified once the file has been created so the drive provided will be of fixed size.

Figure 13 - 3

The Automatically Mount This Volume option directs DESlock+ to attempt to mount the drive when DESlock+ is activated and the correct encryption key is present.

The Automatically Unmount This Volume option directs DESlock+ to attempt to dismount the volume when DESlock+ is deactivated. Please note that this option is only available on Windows XP or later as Windows 2000 does not support dismounting of these mountable files.

By choosing the relevant option, the dismount can be deferred if DESlock+ detects that any of the files stored on the drive are still open or it can be forcibly dismount the drive even if files are still open. A warning (Figure 13 - 4) will be displayed immediately prior to the dismount operation allowing the user time to save their work onto the drive.

Figure 13 - 4

If files are open, the dismount can be cancelled by clicking the Leave Mounted button. This button will only have an affect if files are open. If no files are open on the encrypted drive, the dismount cannot be cancelled.

Once the drive options have been set, the Wizard will prompt for the encryption key to use to protect the volume or will require the user to enter the mount password, depending on the option previously selected. Once a suitable encryption key has been chosen or a password entered, the Wizard will show a summary screen.

Figure 13 - 5

If all details are correct, click Finish to create the file. The file will then be formatted as an NTFS volume.

Figure 13 - 6

The file will then appear in the Mount Manager and can be mounted. Click the Mount button to mount the file, it will be assigned the first available free drive letter.

Figure 13 - 7

When the file has been mounted, it will appear as a new drive in 'My Computer' and can be accessed in the same way as any other drive would be.

Figure 13 - 8

The Mount Manager application can also be used to format the drive at any time. Although the drive can be formatted by Windows, we recommend that you always use the Mount Manager to do this.

Once the entry appears in the Mount Manager, the file may be mounted and dismounted in future from the DESlock+ system tray menu.


CD Autorun

The CD Autorun button is used to create the autorun files for a CD. This allows a mountable file on a CD to be automatically mounted on insertion of the CD.

To create a CD Autorun for a mountable file, select the image from the list and click the CD Autorun button. This will create a folder on the machine with the same name as the currently selected mountable file, and in it place the autorun files.

You should then ensure the mountable file has been dismounted and copy it into this folder along with the autorun.exe and autorun.inf files. You can then burn the contents of this folder onto the root of a CD or DVD.

When the CD or DVD autoruns on a machine with DESlock+, it will automatically attempt to mount the file.


Using Mountable Files

DESlock+ mountable files provide a virtual drive on the PC on which the file has been mounted. The file itself can be stored on any location accessible by the PC, either on a local drive or on a network path.

Shared Access

If the file is stored on a network path, it can be mounted and dismounted as if it were a local file. However, because it is in a shared location, it is possible that another user could also access the file at the same time. If two users attempt to mount the file at the same time, then only one will be successful in mounting the file with read and write access to the drive. Any additional users who then mount the file only be able to access the drive with read access.

Users with read access to the volume will be able to access files within and will see changes made to them, but will not see changes made to the file system, such as new files or folders being added. A user must dismount the drive and remount it to see any changes to the file system.

Windows File and Sharing

DESlock+ cannot be used to directly encrypt a folder that is shared with Windows file sharing, however a folder within a DESlock+ mountable file may be shared. Standard share permissions can be used on the folder meaning multiple users can share write access to the folder. While the share is active, the volume cannot be dismounted however.

Dismounting the volume

The volume cannot be dismounted under Windows 2000. This should be considered especially when attempting to use the mountable file in a shared environment.


Encryption Key Caching

Please be aware that the DESlock+ mountable file works differently than the standard encrypted folders in that the required encryption key is cached for the duration the drive is mounted.

This means that performance of the drive is faster than it would be with a normal encrypted folder.

However, it means that the drive may continue to be available even if DESlock+ is deactivated. The automatic dismount option can be used to attempt to dismount the drive on deactivation of DESlock+.

The encryption key is only required to mount the drive, but once mounted files can be accessed without using DESlock+ again. This means the files are accessible until the drive is dismounted.

Please be aware therefore, that once mounted unless the drive is dismounted any user can access the drive even if DESlock+ has been deactivated.


DESlock+ Archive

The DESlock+ Archive is a tool that allows a number of files to be combined in an archive, being stored compressed and encrypted.

The DESlock+ Archive options are available from the DESlock+ context menu, when clicking on a suitable file.

Figure 14 - 1

The available options allow the user to:

  • Add the file to an archive of the same name as the file, in the same folder.

  • Add the file to a new archive and then prompt to save it.

  • Add the file to an archive and then attach it to an email.

  • Add the file to a new existing DESlock+ archive in the same folder as the file.

When an archive is created for the first time, an encryption key must be chosen. This encryption key will be used to encrypt all files in the archive.

Figure 14 - 2

If the archive has been created with an encryption key from a DK5 DESkey that the intended recipient does not have, it is possible to include the encryption key based on a key request from the recipient's key. This request can be generated using the Key Transfer Wizard. The key update can then be created and attached using the Add key update using request file on the Action menu. Alternatively key updates can be dragged and dropped on the Archive window.

An encryption key from a Key-File cannot be added to a DESlock+ Archive.

If any encryption keys have been included with the archive, these will be available under the key transfer section.

Figure 14 - 3

To import the encryption key, right click on the key and choose Apply Transfer from the context menu

Figure 14 - 4

This will then launch the update phase of the key transfer utility. If the encryption key is not available in the currently active DESkey (i.e. it has not been imported), the files in the archive will remain inaccessible.

To extract files from a DESlock+ Archive, one can either drag the files out from the main window into the desired folder, or one may choose to extract the files using the context menu.

Figure 14 - 5


Outlook Plug-in

The DESlock+ Outlook Plug-in is designed to integrate with Microsoft (R) Outlook 98 or later to provide DESlock+ encryption of emails and email attachments. The Outlook Plug-in does not integrate with Outlook Express.

If Outlook is not being used, email messages and attachments can still be manually encrypted to retain security. Please refer to the DESlock+ Tools and Individual File Encryption documentation.

Outlook Integration

Encrypting a Message

Key Transfer


Outlook Integration

When installed the Outlook Plug-in will add a DESlock+ menu to the menu bar and a DESlock+ icon (Figure 15 - 1) to the toolbar of the main Outlook window (Figure 15 - 2).

Figure 15 - 1

Figure 15 - 2

In addition to the changes to the main Outlook window, each email message window has additional toolbar icons and DESlock+ menu (e.g. shown in Figure 15 - 3).

Figure 15 - 3

Email Options

Encrypting a message

Message Properties

DESlock+ Configuration


Encrypting a message

When encrypting a message, the user has two options. Either to encrypt the email and send it using either 'Encrypt on Send' or 'Encrypt and Send'. Or the user can encrypt the message and add additional text that can either be encrypted using a different encryption key or can be left in plain view.

In this example we shall choose to encrypt the message and edit it before sending. Below is the original message before clicking the 'Encrypt Now' button.

Figure 15 - 4

After choosing to encrypt the message, an encryption key must be selected or password must be chosen will be used for the encryption of the message (Figure 15 - 5). Any user of DESlock+ can decrypt a message encrypted using a password if they know the password. If an encryption key is used then the recipient must have a copy of that encryption key available to them.

Figure 15 - 5

If the message has attachments, the option to select a different encryption key to encrypt the attachments is given. If an alternate encryption key is required, uncheck Use same key for attachments and choose a second encryption key on the following screen (Figure 15 - 6). If a password was chosen above, this same password will also be used to encrypt attachments.

Figure 15 - 6

Below is the message after encryption. Please note that the message text has been encrypted along with the attachment. We can now add some plain text to be sent along with the encrypted message.

Figure 15 - 7

Below is the message as the recipient would see it.

Figure 15 - 8

Depending on the setting used, and assuming the recipient has the correct encryption key, the message can be decrypted in the email window or in the DESlock+ Message Viewer.


DESlock+ Message Viewer

The DESlock+ Message Viewer is a simple tool that enables an encrypted message to be viewed securely. When used, DESlock+ will decrypt an encrypted message to the viewer window rather than decrypting the original copy in the email.

The DESlock+ Message Viewer disables any editing of the email including copying the text using Windows clipboard.

Figure 15 - 10

Even after the message has been decrypted to the viewer, the original email will remain in the encrypted form. A decrypted copy of the email therefore cannot be forwarded if Force Viewer is selected when encrypting the message.


DESlock+ Configuration

Clicking the DESlock+ icon on the toolbar, or selecting Configuration from the DESlock+ menu, will display the configuration dialog (Figure 15 - 11) which allows control of the default operation of the DESlock+ Outlook Plug-in.

Figure 15 - 11

Encrypting Messages

Automatically Encrypt Attachments

If selected, the Plug-in will default to encryption of email attachments when the message body is encrypted.

Obscure Subject (Encrypt and Send only)

If selected, the original subject field of an encrypted email is replaced with the text "A DESlock+ Encrypted Message". The original subject is encrypted and saved with the message and is only visible after decryption.

Force Recipient to Use Viewer

If selected the recipient of the message will be forced to use the DESlock+ message viewer to view the message, regardless of the recipients DESlock+ viewing options.

Decrypting Messages

Automatically Decrypt Message Text

If selected, any DESlock+ encrypted emails will automatically be decrypted when they are opened assuming the correct encryption key is stored within the active DESkey. If not selected, 'Decrypt Now' must be manually selected.

After Decrypting Messages

Select to either always store the message in encrypted format, even if it has been decrypted, or to store the message in decrypted format after it has been decrypted.

Warning Messages

Reset All

If any of the warning message boxes have been previously dismissed with 'do not ask me again', clicking this button will cause all messages to revert to their initial state so will be displayed until dismissed again.


Key Transfer

In addition to encrypting messages and attachments, the Outlook Plug-in also provides Key Transfer integration allowing the entire key transfer process to be performed from within Outlook. Please note this will only work with a DK5 DESkey as a Key-File does not support key transfers. Refer to the Key Transfer Wizard documentation on page 69 for a more detailed overview of the process.

Three additional menu options are available depending on the current stage of key transfer. The menu options are listed below in the order they are shown.

Request Key

Process Key Request

Process Key Update


Scratch Pad

The Scratch Pad (Figure 16 - 1) is a text editor that can be used to write and store information into a secure memory area of the currently active DK5 DESkey. Any data written to the DESkey using the Scratch Pad will be kept in the DESkey until it is deleted by the user. The Scratch Pad editor cannot be used with a DESlock+ Key-File.

Figure 16 - 1

If the Scratch Pad data has been modified and an attempt to close the scratch pad is made, the dialog box below (Figure 16 - 2) will be shown, allowing the user to save the modified data to the DESkey before exiting. If the scratch pad data does not need to be updated, scratch pad will be closed normally.

Figure 16 - 2

As a security feature, Scratch Pad data is secure and cannot be copied to the Windows clipboard unless the "Use Windows Clipboard" is selected in the Edit menu.


.topic 0x806e0405
Click this button to change the master password.

.topic 0x806e0403
Click this button to change the user password.

.topic 0x80c10463
Check this option to enable the user password to be changed after logging in with the current user password. This setting is always available after logging in with the Master password.

.topic 0x80c10464
Check this option to enable the password action to be to be changed after logging in with the current user password. This setting is always available after logging in with the Master password.

.topic 0x80c10465
Check this option to enable the DESkey name to be changed after logging in with the current user password. This setting is always available after logging in with the Master password.

.topic 0
Check this option to enable a new public key pair to be generated after logging in with the current user password. This setting is always available after logging in with the Master password.

.topic 0x80c10467
Check this option to allow encryption keys to be generated after logging in with the current user password. This setting is always available after logging in with the Master password.

.topic 0x80c10468
Check this option to enable encryption key to be added to the DESkey after logging in with the current user password. This setting is always available after logging in with the Master password.

HIDC_CPLADMINRIGHTSEX1
Check this option to allow the deletion of encrypted folders after logging in with the current user password. This setting is always available after logging in with the Master password.

HIDC_CPLADMINREMOVEABLEDRIVES
Check this option to allow romoveable drives such as a folder on a floopy disk to be encrypted without adding them to the inclusions list. This setting is always available after logging in with the Master password.

.topic 0x80710409
Launch key management utility.

.topic 0x8071040b
Launch key transfer utility.

.topic 0x80710425
Create new keys.

.topic 0x80c1045e
Enter the number of incorrect attempts at entering the password the DESkey will allow. The resulting action can be selected below.

.topic 0x806903f5
Check this box to enable the use of hot keys. To use hot keys, appropriate key strokes must be entered below.

.topic 0x806903f6
Enter a key press combination that will be used to activate (if already deactivated) or deactivate (if already activated) DESlock+.

.topic 0x806903f7
Enter a key press combination that will be used to close DESlock+ and remove the icon from the system tray.

.topic 0x80b90428
Check this box to enable the DESlock+ inactivity detection method selected below.

.topic 0x80710409
Launch key management utility.

.topic 0
Lists folders that can be encrypted.

.topic 0
Select to admimister the inclusions list.

.topic 0x80ba0435
Check this option to add http://www.deslock.com to your Internet Explorer favorites list.

.topic 0x80ba0437
Select from the list the default action when dlouble clicking on the tray icon when DESlock+ is active.

.topic 0x80c10460
Select this option to erase the entire DESkey key ring. All existing encryption keys will be deleted and cannot be recovered from the DESkey.

.topic 0x80c10461
Select this option to enter the time loop algorithm. This will lock the DESkey for an increasing period of time. The algorithm is described in the DESlock+ manual.

.topic 0x806e07dd
Select this option to erase the entire DESkey key ring. All existing encryption keys will be deleted and cannot be recovered from the DESkey.

.topic 0x806e07de
Select this option to enter the time loop algorithm. This will lock the DESkey for an increasing period of time. The algorithm is described in the DESlock+ manual.

.topic 0x806e07df
Select this option to lock out the password. This option is only available for the user password and when selected instructs the DESkey to ignore the password even when it is correct. The DESkey can only be unlocked after entering the correct Master password.

.topic 0x806e07e1
Enter the number of incorrect attempts at entering the password the DESkey will allow. The resulting action can be selected below.

.topic 0x806e07e2
Click the up/down buttons to increase/decrease the number of permissable incorrect passwords.

.topic 0x80b90431
DESlock+ polls for inactivity at this interval.  A bigger interval loads the CPU less.

.topic 0x80b90432
Click on the up/down butons to increase/decrease the poll interval.

.topic 0x80ba0436
Select this option to display a warning box before DESlock is closed allowing the operation to be cancelled. This warning will only be available for 10 seconds after which time DESlock+ will be closed.

.topic 0x80b90429
Select this option to disable DESlock+ on screen saver activation.

.topic 0x80ba0434
Check this option to display a splash screen when DESlock+ loads. This screen will display details of the registered user.

.topic 0x80c1045f
Click the up/down buttons to increase/decrease the number of permissable incorrect passwords.

.topic 0x80b9042b
Enter a polling period for the keyboard/mouse inactivity detection. This will determine the interval at which DESlock+ will check for keyboard or mouse input. Lower this setting if system speed is affected by this checking.

.topic 0x80b9042c
Click the up/down buttons to increase/decrease the timeout period.

.topic 0x80710407
Enter a new name to identify your DESkey. The name will not be set until Apply or OK has been clicked.

.topic 0x80b90433
Check this option to display a warning message if DESlock+ times out after screensaver activation or after the specified inactivity time if either are selected.

.topic 0x80b9042a
Select this option to disable DESlock+ after a period of no keyboard or mouse activity.

.topic 0
Click this to delete inclusions markers against folders that have been included but are not currently accessible.  The master account has to be active to enable this option.

.topic 0
Select this option to show folders that have been included and are currently accessible.

.topic 0
Select this option to show folders that have been included and are not currently accessible.

.topic 0x80ba0439
Select this options to use your default MAPI client to send keys from the Key Manager.

.topic 0x80ba0438
Select this option to disable sending keys from Key Manager or when you don't have a MAPI client.

.topic 0x80c00458
Select a DESkey from the list to store backup keys for this DESkey.

.topic 0x80c0045a
Select a DESkey from the list to store backup keys for this DESkey.

.topic 0
Click this to reassociate the above file types with DESlock+

.topic 0
List of file types that DESlock+ uses. Checked ones are already associated.

.topic 0x80ba043b
Always leave the encrypted file behind after decrypting.

.topic 0x80ba043a
Always delete the encrypted file after decrypting.

.topic 0x80ba043c
Always ask what to do after decryption.

.topic 0x80c0045b
A list of additional key that can be used as backup devices.

.topic 0x80ba043d
Launches DESlock+ but doesnt show the login box until you activate.

.topic 0x80ba07ec
Synchronise offline files immediately after logging in.

.topic 0x80ba07f0
Disable generic text encryption tool.

.topic 0x80ba043a
Delete the encrypted file, leaving only the decrypted content.

.topic 0x80ba043b
Leave the encrypted file behind.

.topic 0x80ba043c
Ask what to do with the encrypted file.

.topic 0x80b907ec
Show the login dialog after screensaver ends.


.topic 0x8106056a
This sets the default state of the Encrypt Attachments option in the Key Picker.

.topic 0x81060571
Replaces subject of message to disguise message content.
Only works when using Auto Encrypt or Encrypt and Send.

.topic 0x81060572
Decrypts message content when message is opened or viewed in preview pane. (If Force Viewer is used, this has no effect!)

.topic 0x8106056b
Reset the settings above to the defaults.

.topic 0x81060573
Make the recipient use the viewer. Stops user forwarding or replying with decrypted messages.

.topic 0
Save the message in the plain after decrypting.
This has no effect if the viewer was used.

.topic 0x810607f5
Cause all dismissable warnings to reappear.

.topic 0x810607f7
Leave messages as they were delivered.

.topic 0x810607f8
Saved messages decrypted, unless the viewer was required.


.topic 0x80ac03ff
Select to generate a new key.

.topic 0x80ac0402
Makes the selected key the new default key.

.topic 0x80ac0400
Deletes the key from the DESkey.

.topic 0x80ac0401
Rename the selected key.

.topic 0x80ac0404
Close the DESlock+ Key Manager.

.topic 0x80ac0406
List of available encryption keys.

.topic 0x80ac0403
Select to perform a backup or restore operation.

.topic 0x80a903f0
This is a list of possible backup DESkeys. You may choose as many as you wish.

.topic 0x80af0420
List of all available encryption keys.

.topic 0x80b00422
List of all available encryption keys.

.topic 0x80ae0417
This is a list of possible backup DESkeys you can send to. You may choose as many as you wish.

.topic 0x80ab03fc
This is a list of all the encyption keys that can be restored to the current DESkey.

.topic 0x80aa03f6
Enter current password here.

.topic 0x80aa03f7
Enter new password here.

.topic 0x80aa03f8
Confirm your new password here.

.topic 0x80aa03f9
To aid security, the characters you enter for the password do not appear on the screen. However, if you are sure that no one is watching, and you would like to see the characters of your password as you type, check the Show Typing checkbox.


.topic 0x80ad0416
List of available DESkeys.

.topic 0x80ad0418
To aid security, the characters you enter for the password do not appear on the screen. However, if you are sure that no one is watching, and you would like to see the characters of your password as you type, check the Show Typing checkbox.

.topic 0x80ad0419
Check this box to login as a Master. (requires Master password to be entered)

.topic 0x80ad0417
Enter password here.

.topic 0x80ad041c
Click Setup to launch the DESlock+ DESkey setup wizard for the selected DESkey.

.topic 0x80ad0001
Click OK to login to the selected DESkey. Check 'Perform master login' to login as a master.


.topic 0x80f70494
HIDC_ALGODESCRIPTION

.topic 0x80f70493
Select the algorithm the key will be used with from the drop down list. Details of each algorithm will be displayed below.

.topic 0x80d00429
Select the algorithm the key will be used with from the drop down list. Details of each algorithm will be displayed below.

.topic 0x80e70527
Check this option to allow the user to add encryption keys after activating DESlock+ with the user password. Uncheck this option to require the Master password to have been entered first in order to add encryption keys.

.topic 0x80e70526
Check this option to allow the user to change the DESkey name after activating DESlock+ with the user password. Uncheck this option to require the Master password to have been entered first in order to change the DESkey name.

.topic 0x80e70524
Check this option to allow the user password to be changed after activating DESlock+ with the user password. Uncheck this option to require the Master password to have been entered first in order to change the user password.

.topic 0x80e70525
Check this option to allow the user to change user password options after activating DESlock+ with the user password. Uncheck this option to require the Master password to have been entered first in order to change user password options.

.topic 0x80e70528
Check this option to allow the user to create encryption keys after activating DESlock+ with the user password. Uncheck this option to require the Master password to have been entered first in order to create encryption keys.

.topic 0x80df04f9
To aid security, the characters you enter for the passphrase do not appear on the screen. However, if you are sure that no one is watching, and you would like to see the characters of your passphrase as you type, check the Show Typing checkbox.

.topic 0x80e9052a
To aid security, the characters you enter for the passphrase do not appear on the screen. However, if you are sure that no one is watching, and you would like to see the characters of your passphrase as you type, check the Show Typing checkbox.

.topic 0x80d0043e
If a default key is not required then clear this checkbox.

.topic 0x80d0043b
Enter a name to identify the key. This name must be at least 1 character long but no more than x characters long.

.topic 0x80d90518
Enter the maximum number of concurrent attempts the DESkey will allow the Master password to be entered incorrectly. Once the limit has been reached, the action specified below will take place.

.topic 0x80d9051d
Enter the maximum number of concurrent attempts the DESkey will allow the User password to be entered incorrectly. Once the limit has been reached, the action specified below will take place.

.topic 0x80e9052b
Enter the desired password first in this box. As the password is entered the Password Quality progress bar will advance to give an indication of the password quality or strength against attack. See the section on password quality in the manual for more information.

.topic 0x80e9052c
Enter the password a second time in this box to confirm it. The next button will be disabled until the password has been confirmed.

.topic 0x80d20449
Select this option close the wizard and not to activate the deskey.

.topic 0x80df04fa
The progress bar will increase as the password is entered. This will give an indication of how strong the password is and how secure it is against attack. See the section on password quailty in the manual for more information.

.topic 0x80e90529
The progress bar will increase as the password is entered. This will give an indication of how strong the password is and how secure it is against attack. See the section on password quailty in the manual for more information.

.topic 0x80d9051a
This will erase the entire key space resulting in the loss of all encryption keys stored within the DESkey. Once the correct master password is entered the DESkey can be used but will need keys re added before any encryption or decryption can take place.

.topic 0x80d9051b
This will cause the DESkey to enter the timeloop algorithm until the correct Master password is entered. The timeloop algortihm is described in the manual.

.topic 0x80d9051f
This will erase the entire key space resulting in the loss of all encryption keys stored within the DESkey. Once the correct user or master password is entered the DESkey can be used but will need keys re added before any encryption or decryption can take place.

.topic 0x80d90521
This will cause the DESkey to lock out the user account so even if the correct user password is entered the DESkey will reject it. The DESkey can only be used after first being unlocked by the correct master password.

.topic 0x80d90520
This will cause the DESkey to enter the timeloop algorithm until the correct user or master password is entered. The timeloop algortihm is described in the manual.

.topic 0x80da0443
This will launch the administration stage of the corporate setup. The corporate setup is designed for larger organisations where access to and operation of the DESkey can be restricted. The setup is intended to be run by the administrator who can preset various options within the DESkey and can specify the access level of the final user. Before use the DESkey must finally be configured by the user.

.topic 0x80da0442
This setup is designed for individuals to easily configure their own DESkey. This is ideally suited for small business and personal use where access to the DESkey does not need to be restricted by an administrator. The key can be setup and used immediately.

.topic 0x80d90518
Enter the maximum number of concurrent attempts the DESkey will allow the Master password to be entered incorrectly. Once the limit has been reached, the action specified below will take place.

.topic 0x80d9051d
Enter the maximum number of concurrent attempts the DESkey will allow the User password to be entered incorrectly. Once the limit has been reached, the action specified below will take place.

.topic 0x80e004fd
Enter a name to identify the DESkey. If the name is too long superfluos characters will be stripped off and ignored.

.topic 0x80df04f8
Enter the desired password first in this box. As the password is entered the Password Quality progress bar will advance to give an indication of the password quality or strength against attack. See the section on password quality in the manual for more information.

.topic 0x80df04f7
Enter the password a second time in this box to confirm it. The next button will be disabled until the password has been confirmed.

.topic 0x80dd0445
The advanced setup type will allow the user to configure DESkey options during the DESkey setup, thus using the DESlock+ admin control panel is not necessary.

.topic 0x80dd0444
This is the quickest setup type as default values will be used for certain configuration questions. These can later be changed using the DESlock+ admin control panel. See the DESlock+ manual for a complete list of the options and their defaults.

.topic 0x80d20448
Select this option to cause the wizard to activate the DESkey when it exits.

.topic 0x80cb0452
Select this option to cause the wizard to run the admin utility when it exits.

.topic 0x80cb0453
Select this option close the wizard and not run the admin utility.

.topic 0x80f9040e
This is a list of possible backup DESkeys. You may choose as many as you wish.

.topic 0x80f903ec
Browse for a folder location to store backups in.


.topic 0x80f40428
Check this box to make this encryption key the default key.

.topic 0x80f4043e
Enter a name to identify the encryption key.

.topic 0x80f70493
Select the algorithm the key will be used with from the drop down list. Details of each algorithm will be displayed below.

.topic 0x80f70494
Details of the selected encryption algorithm are displayed here.

.topic 0x80f9040e
This is a list of possible backup DESkeys. You may choose as many as you wish.

.topic 0x80f903ec
Browse for a folder location to store backups in.


.topic 0x80cf04a2
Select this option to issue one of the encryption keys within this DESkey. A request file containing the current public key of the destination DESkey must be present in order begin the issue process.

.topic 0x80cf04a1
Select this option to save the public key of this DESkey to a file. This file can then be used to protect the encryption key when it is transferred between DESkeys.

.topic 0x80cf04a3
Select this option to update this DESkey with a encryption key stored within an issue file.

.topic 0x80ea0459
Browse for the file to open.

.topic 0x80e904a5
Browse to the location to save the file.

.topic 0x80ea042f
Enter the location and filename of the file to open.

.topic 0x80e904a7
Enter the location and filename to save the file. If the file already exists in the specified location it will be overwritten.

.topic 0x80ed04c4
Enter a new value for the Terminator Code.

.topic 0x80ed04c0
Enter a new value for the Terminator Code.

.topic 0x80ea042f
Enter the location and filename.

.topic 0x80ed04c2
Clear this checkbox to leave the Terminator Code at its current value, alternatively check the box and set a new Terminator Code limit.

.topic 0x80d304bc
List of the available encryption keys. Select an encryption key.

.topic 0x80d504cc
List of the available encryption keys.  Select an empty slot.

.topic 0x80e803f3
Enter a name to identify the encryption key.

.topic 0x80f9040e
This is a list of possible backup DESkeys. You may choose as many as you wish.

.topic 0x80f903ec
Browse for a folder location to store backups in.


About DESlock+

The About Box will display product information.

Figure 4 - 6


Control Panel

This will launch the DESlock+ Control Panel.

See DESlock+ Control Panel


Deactivate

Clicking deactivate, or simply removing the DESkey, will force DESlock+ to deactivate itself. After Deactivation, DESlock+ will remain running and can be reactivated later.


Exit

Clicking Exit will disable and close DESlock+. This will unload DESlock+ and remove the icon from the system tray.


Help

Brings up the help and documentation.


Key Manager

The Encryption Key Manager dialog allows the user to create, delete and manage encryption keys.

See Encryption Key Manager


Key Transfer

The Key Transfer Wizard allows encryption keys to be transferred between DK5 DESkeys.

See Key Transfer Wizard


Key Transfer Database

The Key Transfer Database allows direct access to the key transfer database stored on this machine.

See Key Transfer Database.


Mount Manager

This will launch the DESlock+ Mount Manager and allow quick access to mount and dismount existing files.

See DESlock+ Mount Manager


Scratch Pad

Used to access a protected memory area within the DK5 DESkey which can be used to store sensitive information.

See Scratch Pad


Switch DESkey

If multiple DESkeys are inserted, an additional menu item will appear (Figure 4 - 7) so that the user can easily switch between them. The extra menu item will only be visible whilst multiple DK5 DESkeys are inserted and one of them has been activated.

Figure 4 - 7

Switching DESkeys will automatically deactivate DESlock+ and log out of the current active DESkey. The login box will then be shown so DESlock+ can be reactivated with the selected DESkey.

The current active DESkey will be displayed in the list but will be greyed out and cannot be selected.


Synchronize

Synchronises all offline folders.

See Offline encrypted folders


Tools

This will launch the DESlock+ text encryption tools.

See DESlock+ Tools


Current Version Limitations

  • Mounting virtual disks under Windows 2000 may sometimes cause the disk to appear in explorer with a different drive letter to that shown in DESlock+. This happens when a removable drive has been assigned a drive letter using the Windows disk management tool and the drive not being plugged in. This does not affect the use of the virtual disk, except for formatting via the DESlock+ Mount Manager.


Known Problems

  • Due to a known bug in VirusScan Enterprise 7.0, the install will not run if it is detected on your machine. If you use VSE 7.0, you will need to either remove version 7.0 or upgrade to version 7.1 or later before installing DESlock+.

  • Under Windows XP, you might encounter an application error in ikernel.exe at the end of the install. The following article contains more information

http://support.installshield.com/kb/view.asp?articleid=q108020

  • The Outlook plugin does not display any menu or button items when Microsoft Word is used as your e-mail editor under Outlook XP and Outlook 2003. DESlock+ requires that Word is not selected as your email editor. To do this, from the Outlook Tools menu, select Options and on the Mail Format tab, uncheck the "Use Word when editing e-mail messages" check box.

  • Outlook 2000 requires that Office 2000 SR-1/1a is installed This is available from the Microsoft Website

http://support.microsoft.com/default.aspx?scid=kb;EN-US;245025

  • Outlook 98 requires the Outlook 98 Security Update. This is available from the Microsoft Website

http://support.microsoft.com/support/kb/articles/Q262/6/17.asp

  • There is a known problem under Outlook 2003 when using the Send to OneNote from Outlook powertoy. This is under investigation, to avoid messages being saved in a decrypted state please disable the OneNote COM addin.


New Features, Enhancements and Important information

  • Under Windows 2000/XP and later, all deletions from encrypted folders are performed in a secure manner. That is, overwritten with cryptographically secure random data before being removed from the filesystem.

  • Deleting encrypted folders requires that the encryption key used to protect the folder is available. If the key is unavailable, the deletion will fail.

  • DESlock+ can not be used to encrypted folders which use NTFS native compression or encryption. Attempting to encrypt a compressed/encrypted folder or activating compression/encryption on a DESlock+ encrypted folder will fail.

  • DESlock+ no longer supports encryption of shared folders across networks.

  • DESlock+ now includes virtual disk support, meaning that you can create files that can be mounted and used like a harddrive. Note: This is not available under Windows 9x.

  • After upgrading DESlock+ from versions prior to 2.10, you will be informed that a file needed is missing and would you like to rebuild it. It is vital to the functioning of DESlock+ that you choose Yes to this. Failure to rebuild this file will restrict access to your encrypted data.

  • DESlock+ now has a software "token" or key-file than mimics some of the hardware features offered by DESlock+. This requires registration before the "token" can be used. Note: This is not available under Windows 9x.

Current Version Limitations

Known Problems


Welcome

Replace this sample help topic with your own help topic, or type Ctrl-T to add a new Help topic.


Decrypt files with DESlock+

If one or more files are selected, and they are all encrypted, this option will decrypt them.

Figure 12 - 12

After decryption, the original files can be deleted or left intact. The desired action can be changed in the DESlock+ Control Panel.

Please note that decryption will only occur if the correct encryption key is present in the currently active DESkey, or the correct password is entered.


Decryption

If a folder has already been encrypted, right click on the folder from Windows Explorer and choose 'Decrypt with DESlock+…' from the context menu if you want to decrypt the folder and all of its contents.

Figure 12 - 9


Encrypt files with DESlock+

If one or more files are selected, and they are all non encrypted, this option will encrypt them all. The user must choose either an encryption key to use for encryption, or must specify a password. If encrypting multiple files at the same time, the same encryption key will be used.

After encryption, the original files will remain intact and encrypted copies will be made in the same folder. The encrypted copies will have a DLP extension and the following icon.

Figure 12 - 11


Process files with DESlock+

If one or more files are selected, and they are a combination of encrypted and non-encrypted, this option will process them individually following the above rules. That is, if a particular file is non-encrypted it will be encrypted and conversely if it is encrypted it will be decrypted.

Figure 12 - 13

Individual File Encryption is compatible with the Outlook Plug-in, meaning it can be used to send or receive encrypted message attachments with another user using the Outlook Plug-in.


Step 1: Install the DESlock+ software

  1. Close any other software applications that are running.

2. Remove any inserted DESkeys.

3. Insert the CD into your CD-ROM drive.

4. If the CD does not 'autorun', click the Start button then choose Run and type:

x:\dlpsetup.exe

where x: is the drive letter associated with your CD-ROM drive.

5. Follow the on-screen prompts to install the software

Note: Once installation is complete, the computer will be restarted before DESlock+ can be used.

6. After rebooting, a new icon will be displayed in the system tray as shown in Figure 2 - 1.

Figure 2 - 1

Step 1b:

If you are only using a Key-File and do not have a DK5 DESkey then skip to Step 5.

Otherwise, Step 2: Install the 'Backup' DESkey


Step 2: Install the 'Backup' DESkey

Although it is a fully functional device, the 'Backup' DESkey is intended to be kept safely and only used to store encryption key backups. The process of creating an encryption key backup is covered in detail later in the manual but for now it is sufficient just to setup the key so it is ready to be used.

Insert the 'Backup' DESkey into a free type A USB port. The USB port can be on the PC or on a USB hub connected to the PC.

Figure 2 - 2

The hardware should immediately be detected and the DESlock+ login screen will be shown prompting the user to launch the key setup (Figure 2 - 3).

Figure 2 - 3

Under Windows XP the new hardware wizard will be displayed the first time the DESkey is inserted into a port and you should click the recommended option for an automatic install.

Figure 2 - 4

Step 3: Configure the 'Backup' DESkey


Step 3: Configure the 'Backup' DESkey

From the login screen, launch the key setup wizard. See the chapter entitled DESkey Setup Wizard on page 11 for more information on configuring a DESkey. In most cases the Typical Single User setup would be best for the Backup 'DESkey.' It is not necessary to log into the 'Backup' DESkey after configuring it.

Step 4: Install and Configure the 'User' DESkey


Step 4: Install and Configure the 'User' DESkey

Repeat steps 2 and 3 above using the 'User' DESkey instead of the 'Backup' DESkey.

After the 'User' DESkey has been configured, you may log into it. However, be aware that the Backup Configuration Wizard will run each time you activate the DESkey until it has been successfully completed.

Step 5: Configure the Key-File


Step 5: Configure the Key-File

If you are configuring a DESkey Key-File, the DESkey Setup Wizard may be launched from the DESlock+ Login Box. Refer to the DESkey Setup Wizard for more information.


Backup

This will allow any encryption key, with a non-zero Terminator Code, to be backed up.

To backup an encryption key, it must be transferred to another DESkey. The backup process is two-fold. First you must extract the encryption key, and then you must import it into the destination DESkey. The encryption key cannot be extracted directly, instead one must specify the DESkey to which the encryption key is destined. This is done when the key is extracted, and the extracted key can then only be imported into the specified DESkey.

Only after the encryption key has been added to another DESkey's key space has the key actually been backed up to the other DESkey.

To extract the encryption key, open the Key Manager, select the key and click 'Backup'.

Figure 8 - 3

From this list, you must check all of the DESkeys to which you would like to backup the encryption key. Creation of a backup for itself is mandatory so the current DESkey will always be listed and cannot be deselected. As will any of the DESkeys added as backup assignments in the control panel (see page 50 of the DESlock+ User Manual for information on making these assignments). Select any additional DESkeys you require from the list. Make sure the Backup DESkey is checked.

The list of available DESkeys is drawn from a database stored on the local machine. This database is described further on page 67.

If you wish to create backup files, which can be used on another machine, select the option and specify the folder to save the files into. These DESkey Update Files (DLU files) allow the encryption key to be imported using the Key Transfer Wizard. Refer the Key Transfer wizard update documentation, page 75 of the DESlock+ User Manual, for more information on importing encryption keys this way.

e.g. in this case it will create a folder called "My DESkey (0000007B)" and in that folder it will create a file called "My Key.dlu". If 'Backup DESkey' was selected then it would create another folder called "Backup DESkey (00000012)" in which it would store another file called "My Key.dlu".

Figure 8 - 4

Once the encryption key has been extracted, it must be imported into the destination DESkey to complete the backup process.

To do this, login to the destination/backup DESkey and re-open the key manager. Select an empty key slot and click the Restore button and select the encryption you wish to import.


Delete Key

If selected, the encryption key will be deleted from the DESkey. A copy will be stored in the Key Transfer Database in case it needs to be imported at a later date.

If the only copy of an encryption key is lost there is no way to recover data encrypted using this key. Important keys should be backed up to avoid loss of data.


Generate

This will launch the Key Generation Wizard in order to create a new key. This process is described on page 63.


Make Default

If the currently selected key is not the default, it can be made the default using this option. The default encryption key will always be highlighted and selected in the encryption key selection dialog box, when performing encryption.


Rename

Renaming a key allows the descriptive name given to an encryption key to be changed.


Restore

This will allow previously deleted keys to be restored from the Key Transfer Database. Selecting this option will prompt the user to select a key to restore (Figure 8 - 5).

Figure 8 - 5

Please note that this list may not contain all of the encryption keys stored in the Key Transfer Database. Only encryption keys that can be restored to the currently active DESkey will be displayed.

Once an encryption key has been selected and an empty key slot has been chosen, the key will be restored.

To restore an encryption key from a file rather than the local Key Transfer Database use the update option of the Key Transfer Wizard as described on page 75.


Send To

This option is only available from the popup menu and allows an encryption key to be emailed to a DESkey defined in the Key Transfer Database. This option is only available if the option has been configured in the DESkey control panel (described on page 44). It is also only available for keys with a non-zero Terminator Code (described on page 41). The email address can be set in this dialog and once set will be saved.

Figure 8 - 2

The encryption key will be saved to a DESkey Update (DLU) file and emailed to the specified email address. The recipient of the email can then import the encryption key using the Key Transfer Wizard (described on page 69).


Corporate Setup

Admin Stage

User Stage


Email Options

Each Outlook email message window may contain the icons listed below which provide additional email options. The options are also available from the DESlock+ menu in the message window. The appropriate set of options depends on whether the user is the sender or recipient of an email. Some options may be unavailable depending on the mail format.

Sender Options

Icon | Meaning
 | Decrypt for Reply: When replying or forwarding a message, automatic decryption of the quoted message is disabled. Click this button to decrypt the previous message. This is only possible if the originator of the encrypted message has not chosen the Force Viewer option.
 | Encrypt and Send: Click this button to encrypt the body of the email, including any attachments, and immediately send the email in one action.
 | Encrypt on Send: Click this button to encrypt the email body before sending. The email body will not be encrypted until the email is sent.
 | Encrypt Now: Click this button to immediately encrypt the email body. The message can be further edited before being sent. Attachments will not be encrypted immediately but 'Encrypt Attachments' can still be used.
 | Force Viewer: Click this button to force the recipient of the email to use the DESlock+ Message Viewer (Figure 11 - 4), rather than allow the email to be decrypted in place.

Recipient Options

Icon | Meaning
 | Decrypt Now: Click this button to decrypt a DESlock+ encrypted message.
 | Decrypt All Attachments: Click this button to decrypt and save all attachments from the email to a user specified folder. The user must then 'browse' to an existing folder in which to save the files.
 | Encrypt This Message: Click this button to encrypt any plain text message. This can include any messages received from a user who is not using DESlock+.


Message Properties

Selecting Message Properties from the DESlock+ menu will show details of the encryption key used to encrypt any DESlock+ encrypted message. The encryption key serial number and algorithm type will always be displayed. If the encryption key exists within the active DESkey key space, the location (key slot) and key name will also be shown. If the email was encrypted using a password, the text "Uses Password" will be displayed in the Key Name box.

If the encryption key does not exist in the active DESkey key space the option to request the encryption key is given. If the button is clicked an encryption key request email will be generated when the properties dialog is closed. This email will be addressed to the encrypted message originator but this can be changed prior to sending the message if required. The request message can then be sent to the desired user and used by them in the key issue process.

Figure 15 - 9


Process Key Request

The recipient of the Request email should then choose Process Key Request from the DESlock+ menu of the message window. Selecting this will allow the creation of an issue file based upon the attached request file.

An encryption key to transfer must be selected in the same way they would using the Key Transfer Wizard.

When the encryption key has been specified the Plug-in will create a new email containing the issue file and save it to the 'drafts' folder in Outlook. The user issuing the key must open this email, address it and send it.


Process Key Update

When the user requesting the encryption key receives the update email, they should choose Process Key Update from the DESlock+ menu of the message window. This will allow the encryption key to be added to the DESkey key space.


Request Key

To request an encryption key, create a new email message from within Outlook. From the DESlock+ menu of the message window choose Request Key. The message can then be addressed and edited before being sent, at which point a request file will automatically be attached to the email.


3DES

3DES (Triple DES) is a variant form of the DES (Data Encryption Standard) algorithm, originally developed by IBM in 1974. 3DES uses 2 56-bit keys, giving an effective key length of 112 bits, and performs DES encryption on the data three times using these keys.


AES

AES (Advanced Encryption Standard) was developed as a new encryption standard to replace DES. Rijndael was accepted as the AES algorithm on October 2, 2000. The Rijndael algorithm was developed by Joan Daemen and Vincent Rijmen, Belgian cryptographers who gained PhDs at the computer security and industrial cryptography labs at Universiteit Leuven. DESlock+ only supports AES with a key length of 128-bits.


Asymmetric algorithms

Asymmetric algorithms, or public key algorithms, are those where two keys are needed: one used for encryption and one used for decryption. Also, the decryption key cannot be calculated given knowledge of the encryption key, at least not in any reasonable length of time.

The security lies in the fact that it is not viable to calculate the decryption key (the private key) from the encryption key (the public key). Therefore the public key can be widely distributed so anyone can encrypt data but only the person with knowledge of the private key can decrypt the data.


Blowfish

The Blowfish algorithm was developed in 1993 by Bruce Schneier, President of a consulting firm specialising in computer security, and author of Applied Cryptography. Blowfish is a 64-bit block cipher with a single 128-bit encryption key.


Symmetric algorithms

Symmetric algorithms are those where the same key is used for both encryption and decryption or where one key can be calculated given knowledge of the other. The security of these algorithms rests entirely within the key which means that if encrypted messages are to remain secret then the key must be kept secret. Generally the algorithm used is made available in the public domain so that it can be inspected and judged on its security.

Symmetric algorithms come in two different forms, a stream cipher and a block cipher.

Stream Cipher

Stream ciphers operate on data on a bit by bit (or byte by byte) basis. This means data can be encrypted as it is passed through the algorithm.

Block cipher

Block ciphers operate on data in blocks or a number of bits. These algorithms require a complete block to be available before it can be encrypted. Typically the block size is 64 bits.