Signing/Encryption wizard

The Signing/Encryption wizard guides you through the signing/encryption operations. Additionally, it allows you to select Profiles to access your preferred settings for signing/encryption. It also allows you to attach Policies to the file, which is being signed/encrypted.

During the signing operation, the Signing Certificate Selection dialog box is displayed. This is followed by the Signing Preferences dialog box for selection of signing settings. Finally, the Signing Ceremony dialog box is displayed to provide legal strength to the signing operation.

During the encryption operation, only the Encryption Preferences dialog box is displayed for selection of encryption settings.


Selecting Profiles

A Profile is a named collection of settings for your signing/encryption preferences. Commonly used settings can be saved as profiles. They are an ease-of-use feature for the end user to automate the signing/encryption operation.

Profiles can be of two kinds:

  • User Profiles
  • System Profiles
User Profiles can be created by the user using the Profile Manager.

System Profiles are created by the Policy Administrator using the E-Lock Policy Manager.

The E-Lock Policy Manager needs to be installed separately.

By default, the Select Profile dialog box is not displayed. To display this dialog box, select the appropriate settings in the Basic Settings tab of the Configuration Manager.

The Select Profile dialog box displays only the User Profiles. A default System Profile, if defined, is always processed silently. If you choose to use a User Profile, it takes precedence over the default System Profile.
  • Select Profile
    This list box displays a list of all profiles valid for the current operation.

  • Profile Description
    This box displays the description of the selected profile and its settings.

  • Create Profiles...
    Click this button to create a new Profile using the Profile Manager.

  • Don't Use Profiles
    Click this button to proceed with the current operation without selecting a profile.

  • Next
    Click this button to continue with the current operation after selecting a profile.

  • Cancel
    Click this button to cancel the current operation.

  • Don't show this dialog box again
    Select this check box if you do not want the Select Profile dialog box to be displayed for the subsequent operations.

You can re-enable the display of the Select Profile dialog box by selecting the appropriate settings in the Basic Settings tab of the Configuration Manager.


Selecting Policies

A Policy is a named set of rules for security operations created by the Policy Administrator and distributed to users.

Policies attached to a document travel with the document throughout it's life cycle. Once attached to a document, a policy cannot be changed or removed.

Policies are created using the E-Lock Policy Manager, which has to be installed separately.

The Select Policies dialog box enables you to select a Document Policy to attach to a file during the signing/encryption operation.

A Document Policy can be attached to a document only the first time the document is signed/encrypted. A policy cannot be attached to the document once it has been signed/encrypted. If no Document Policy is defined, the Select Policy dialog box is not displayed.

By default, the Select Policy dialog box is not displayed. To display it, select the appropriate settings in the Basic Settings tab of the Configuration Manager. At least one Policy should be present on your machine for this dialog box to be displayed.

  • Select Policy
    This list box displays a list of the policies present on your machine.

  • Policy Description
    This box displays the description of the selected policy and the rules defined.

  • Don't Use Policies
    Click this button to proceed with the current operation without selecting a Policy.

  • Next
    Click this button to continue with the current operation after selecting a Policy.

  • Cancel
    This button cancels the current operation.

  • Don't show this dialog box again
    Select this check box if you do not want the Select Policy dialog box to be displayed for the subsequent operations.

You can re-enable the display of the Select Policy dialog box by selecting the appropriate settings in the Basic Settings tab of the Configuration Manager.


Entrust Profile Preferences

This dialog box allows you to can select your Entrust Profile preferences.

Following are the settings you can select:

  • Add INI
    Click this button to browse and add INI file names.

  • Add Profile
    Click this button to browse and add an Entrust Profile corresponding to the INI file selected. It is necessary to select the INI file before attempting to add a Profile. The selected Profile will be used in conjunction with the INI file for login.

  • Add Token
    Click this button to add an Entrust Profiles for hardware tokens.

  • Delete
    Click this button to delete an Entrust Profile in the list box.

  • Finish
    Click this button to confirm the selection of the Profile. This will display the Entrust Login dialog box.

  • Cancel
    Click this button to cancel the current operation.


Signing certificate selection

This dialog box allows you to select a digital certificate ( digital ID ) from a list of certificates present on your machine. If you have a single certificate, it is selected by default and this dialog box is not displayed.

  • Available certificates
    This lists all available certificates (digital IDs). Select the certificate you want to sign with.

  • View Digital ID
    This will display details of the selected certificate.

  • Next
    Click this to move to the next step of the Signing/Encryption Wizard.

  • Cancel
    This will cancel the current operation.

             After selecting the digital ID to use, if the certificate is password protected you will be prompted to enter the certificate password. If you are using Assured Office for Entrust you will be prompted to login for the Entrust Profile. If you are using Assured Office for Netscape, you will be prompted for the Communicator Database password. This password is specific to the Profile which is set as default in the Configuration Manager.

    If you are using smart card certificates, you are prompted to enter the smart card certificate access code.


Signing Preferences

This dialog box allows you to select your signing preferences.

Note

By default this dialog box is not displayed during the Signing process. To display it, select the appropriate settings in the Basic Settings tab of the Configuration Manager.

Following are the settings you can select:

  • Hash Algorithm
    Select the Hash Algorithm with which to sign the document.

  • Include time stamp
    Select this check box to include the time stamp within the signature block. By default the local system time is attached. If the file has an attached signing policy, which defines a validation operation to be triggered before signing, specifying OCSP as the validation mechanism, the time stamp included will be the sever time (Validation Authority).

  • Signature image

    • Include
      Select this check box if you want to attach a signature bitmap to the signature block. Selecting this option will enable the following options

      • From File(*.esg)
        Select this option if you have a stored .esg file. Enter the path of the file in the text box provided or click the Browse... button to select the file.

        Note

                You can create graphical images of your handwritten signatures with the help of the e-Mark application. These images are stored with a .esg extension.

      • Live Signature
        Select this option if you want to create a graphical image of your handwritten signature. Click the Create... button. This will start the e-Mark application where you can create the image using either a mouse or a Wintab compliant digital tablet.

      Note

              If you have selected a Profile during the signing operation, the settings within the Profile are selected as default. These settings can be changed if required.

      Note

              If a signing Policy has been attached to the document, the settings defined within that Policy are selected as default and cannot be modified.

      Note

              If a signing Policy is attached to a document, its settings take precedence over settings within a selected Profile.

    • Next
      Click this button to move to the next step of the Signing/Encryption wizard.

      Note

              If the .esg file you select has been encrypted using a password protected certificate, you will be prompted to enter the certificate password.


Certificate policy evaluation

Certificate Policy Evaluation is performed whenever a certificate containing a security Policy is used for an operation.

Note

The is true only if the Certificate Policy attached to the certificate was created using the Policy Manager application of Assured Office 3.0.

This dialog box is displayed after the Signing Preferences dialog box if the certificate selected for signing has a security Policy attached to it.

  • Agree
    Click this button if you agree with the use of this certificate and the security Policy defined for it.

  • Disagree
    Click this button if you do not agree with the security Policy that is defined for the certificate.


Signing Ceremony

This dialog box displays a declaration to the effect that the signer has read and understood the contents of the file he is about to sign. The generic text of the declaration states

"I hereby declare that I have viewed and understood the contents of the file"

The file information that follows depends on the application from where the signing operation was initiated. It could be just the file path or could have more details viz Author, Title etc.

 The generic declaration text can be replaced by attaching a Policy to the document. In a policy you can define both the pre-text (text before the file information) and post-text (text after the file information).

The declaration may have legal significance. It is therefore advisable to read and understand the implications of this declaration text.

Signature Comment
You can enter any additional comments about the the signature in this text box. This will not form a part of the document but will be attached to the signature block.

Signature Block information
This is a part of the digital signature and is attached to the signed document.

  • Reason to sign
    You can enter a short reason for signing a file in this text box. The drop down list will display the recently entered reasons to sign.

            If the default System Profile or the Policy attached to the document has a predefined list of reasons to sign, this list box will display only the specified reasons.

  • Location
    You can enter the physical/geographical location from where you are signing.


Encryption Preferences

This dialog box allows you to select your encryption preferences.

Following are the settings you can select:

  • Crypto provider
    This is a list of all the Cryptographic providers installed on your computer for the security framework for which Assured Office is installed.

  • Encryption Algorithm
    Algorithm is the mathematical function used by the key to encrypt the data. You should select only the algorithm that is supported by the selected Crypto provider.

  • Key Length
    During encryption, a symmetric key is generated at runtime, which is used to encrypt the data. The public key of the recipient is then used to encrypt this symmetric key. One can define the length of the symmetric key. In general, the longer the key length, the more secure the key, however it takes a longer time to encrypt the file. Select a key length from the available options.

  • Add myself to the recipients
    If you encrypt a file, you cannot decrypt it unless you have specifically added yourself to the recipient list. When you add yourself, your digital certificate is used to encrypt the file so that you can decrypt it at a later date. If you lose your original file, then you can access the file by decrypting the .ats file that was created during encryption.

If you have more than one certificate, a dialog box with all your certificates is displayed. Select one for this operation.

  • Get from file
    In order to encrypt a file, you need to use the recipient's public key. This option allows you to import a person's digital certificate, which contains their public key. Once you have imported the certificate, that person appears in the Selected recipients list box.

  • Get from WAB
    If you have contacts with certificates in the Windows Address Book (WAB), then you can click this button to open the Address Book. Double click on the contact name from the Address Book to add them to the Selected recipients list.

If the person has multiple certificates, a dialog box with all the certificates is displayed. Select one certificate for the current operation.

For Entrust Users refer to Entrust Address Book help.

  • Delete Recipient
    Click this button to delete a particular recipient from the Selected recipients list box. Recipients which are enforced by a policy attached to the document cannot be deleted.

  • Delete All
    Click this button to delete all the recipients that you selected.

If you have checked the Add myself to the recipients check box, using the Delete All option will not remove your certificate from the list.
  • Encrypt
    Click this button to complete the encryption operation.

 You can encrypt a single file for multiple recipients.
  • Cancel
    Click this button to cancel the encryption operation.

Note

If you have selected a Profile during the encryption operation, the settings within the Profile are selected as default. These settings can be changed if required.

If a policy has been attached to the document then the settings defined within that policy are selected by default and cannot be modified.

Note

If an encryption Policy is attached to a document, its settings take precedence over settings within a selected Profile.


Entrust - Address Book Help

E-Lock Technologies

Address Book - Entrust

You can select the recipients for Encryption operation in the Address Book dialog.

Following are the settings you can select:

  • Look in
    Click this button to select the location of the search for the recipients. You can search on a Public Directory or a Personal Address Book (PAB).

  • Search For cn=
    This option is enabled only if the location selected for search is Public Directory. You can specify the common name as a filter for search here. You can give entire common name (say for e. g. John Smith) to search the certificates having exact common name as John Smith. A * can be entered to get all the entries or a xxx* where xxx are some letters to match the first name of.

    When you enter the search phrase you should not enter "cn=" as a part of the search phase. Do not enter the search phase in quotes.

  • Search
    This option is enable if the location selected for search is Public Directory. Click this button to start the search on Public Directory with the specified filter.

  • Add >>
    Click this button to add the selected recipient in the final recipient list.

  • Add All >>
    Click this button to add all the searched recipients in the final recipient list.

  • Remove
    Click this button to remove the selected recipient from the final recipient list.

  • OK
    Select this button to confirm the final recipient list selected.

  • Cancel
    Click this button to cancel the operation.


Verification- An Overview

E-Lock Technologies

Verification - An Overview

Verification of file is done in two phases. The Digital ID used to sign the document or file with, is verified followed by the verification of the data.

The Verification Result is shown as an aggregate of the verification of the data integrity, certificate expiry, certificate trust and the certificate revocation status. If Verification of all these is successful the overall result will be successful and a green check mark is displayed. A red cross will be displayed if any one check fails. If only the revocation status is unknown the overall result will be unknown and a blue question mark is displayed.

Assured Office has the unique functionality of displaying certificate validation results with respect to both the time frames - the status of the certificate at the time of signing and the status of the certificate at the time of verification.

If a particular certificate that was valid during the signing process expires or is revoked by the time the document is validated, the validation result with explicitly mention this.


Validation using Assured Office

Assured Office 4.0 allows you to validate certificates during the signing or encryption operation.

Validation of certificates during the signing process is done only if the Policy attached to the document defines this. If a Policy or System Profile is attached to the document, then during the signing operation, first the validation of the Policy signer's certificate is done using the default mechanism.

Certificate Validation is done in three phases.

  • First the validity of the certificate is checked, i.e. if the certificate has expired or not.
    • The certificate will be shown as expired if, the system time is not between the valid from and valid to period of the certificate

  • If the certificate is trusted by the user, then a certificate trust chain in built.
    • A certificate trust chain is built till a trusted certificate is found.

  • If a trust chain is built successfully, then the revocation status of the certificate is checked.
    • The mechanism used for checking the revocation of a certificate depends on whether a Validation Policy is present or not.

 Expiry and Trust of a certificate is checked irrespective of the presence of a Policy.

  • Revocation Check if a Policy or System Profile is not present - Default mechanism

    If an AIA extension is present in the certificate being validated then, the certificate is validated against the stored OCSP response. If no stored response is found, then using the AIA extension, the latest OCSP response is retrieved from the server. If the AIA extension is not found, the CRLDP extention of the certificate is used. Validation will be done against a cached CRL. If the cached CRL is not found, or has expired, then the using the CRLDP, a fresh CRL is cached to your local machine and validation result will be shown accordingly.

    During verification, if you click on the Validate Online button in the Verification Result dialog box, the default mechanism is online OCSP, if an AIA extension is present in the certificate. The OCSP response is retrieved from the AIA extension URL. If an AIA extension is not present and an CRLDP extension is present, online CRL mechanism is used. The URL of the CRL is taken from the CRLDP to download the latest CRL.

    In case of online validation, if the Prompt for online validation option in the Basic Settings tab of the Configuration Manger is selected, the E-Lock Certificate Validation dialog box is displayed and you have to choice either to continue with the online validation or work offline.

  • Revocation Check if a Policy or System Profile is present
    • OCSP mechanism
      If a System Profile or Policy that defines OCSP as the validation mechanism, depending on the validation condition the following is done:

      Always do Online Validation
      Online validation will be done irrespective of the presence of a stored OCSP response. If a validation warning has been defined, the E-Lock Certificate Validation dialog box is displayed and you have to choice either to continue with the online validation or work offline.

      Do online validation if required
      Online validation will be done only if a stored OCSP response cannot determine the revocation status of the certificate. The latest OCSP response is retrieved from the server and revocation status of the certificate is checked against this. If an online validation is done, the E-Lock Certificate Validation dialog box is displayed and you have to choice either to continue with the online validation or work offline. This dialog box will display the warning text, if any, specified within the Policy

              The validation URL is retrieved either using the AIA extension or the URL specified within the Policy or System Profile. The URL specified in the AIA extension of the certificate takes precedence over the URL specified in the Policy.

              The certificate of the Validation Authority (VA) should be a trusted certificate either in the Policy or System Profile defined or the locally stored trusted store. In case of a certificate Delegated VA certificate, you should trust the issuer of that certificate for the OCSP response to get verified correctly.

      Offline Validation
      Online validation is not done. The revocation status of the certificate will be checked against a stored OCSP response. If no stored response is found the revocation status of the certificate remains undetermined and a blue question mark is displayed against the certificate in the verification details dialog box.

    • CRL Mechanism
      If a System Profile or Policy that defines CRL as the validation mechanism, depending on the validation condition the following is done:

      Always do Online Validation
      Online validation will be done irrespective of the presence of a cached CRL. If a validation warning has been defined, the E-Lock Certificate Validation dialog box is displayed and you have to choice either to continue with the online validation or work offline.

      Do online validation if required
      Online validation will be done only if a cached CRL cannot determine the revocation status of the certificate. The latest CRL is retrieved from the server and revocation status of the certificate is checked against this. If an online validation is done, the E-Lock Certificate Validation dialog box is displayed and you have to choice either to continue with the online validation or work offline.

               The validation URL is retrieved either using the CRLDP extension or the URL specified within the Policy or System Profile. The URL specified in the CRLDP extension of the certificate takes precedence over the URL specified in the Policy.

      Offline Validation
      Online validation is not done. The revocation status of the certificate will be checked against a cached CRL. If a cached CRL is not found, the revocation status of the certificate remains undetermined and a blue question mark is displayed against the certificate in the verification details dialog box.

              The display of the E-Lock Certificate Validation dialog box can be disabled by selecting the appropriate settings in the Basic Settings tab of Configuration Manager.

              If a Policy specifies the warning text for validation, it will override the Configuration Manager settings and will always display the E-Lock Certificate Validation dialog box.


Verification Result

The Verification Result dialog box is displayed when you verify a signed file. If a file has multiple signatures then all the signatures are verified and the results displayed.

  • Signature details
    This list box displays the list of the verified signatures. The columns in the list are:

    • Signer
      The name of the person to whom the signing certificate belongs. On successful verification, a green check mark is displayed against it. If verification fails, a red cross is displayed. A blue cross is displayed if the status of any of the verification parameters is unknown.

    • Reason
      The reason for signing the file. This displays the Reason to sign as entered by the user during the Signing Ceremony.

    • Signing Time
      The time at which the file was signed. This is displayed only if the signer selected the Include Time Stamp into signature check box in the Signing Preferences dialog box.

    • Location
      The location at which the file was signed. This is displayed only if the signer entered this information in the Location option during the Signing Ceremony.

  • Signature Comment
    This displays any comments the signer has added in the Comments text box during the Signing Ceremony.

  • Signature Block
    This displays a complete block of the signing information which includes the signers name, the time, and place of signing. It also displays a graphical image of the signer's handwritten signature if this option was selected in the Signing Preferences dialog box.

The details displayed in the Signing Comments and the Signature Block depend on the selected Signer in the Signature details list box.

  • Verification Details...
    Click this button to view the verification details for the signer certificate selected in the Signature details list box.

  • Validate Certificate
    Click this button to validate the selected certificate.

  • Validate All Certificates
    Click this button to validate all the listed certificates.

  • Close
    This will exit the Verification Results dialog box.


Verification Details

E-Lock Technologies

Individual Verification Details

This dialog box displays the verification details of the signer certificate that was selected from the list box in the Verification Result dialog box.

Verification details are displayed in two parts - Verification of the data and verification of the certificate.

The Verification Details dialog box displays the following details:

  • Signature Verification Details
    This section displays the following details:

    • Content Verification
      If the verification of the contents of the document/file is successful, then it shows a green check mark against this option. If verification fails, i.e. data was altered after the document/file was signed, then it shows a red cross against this option.

      • Hash algorithm
        This displays the hash algorithm used while signing of the data.

    • Signer Certificate Expiry
      If the signer certificate has not expired then a green check is shown. If the certificate has expired, a red cross is displayed.

    • Signer Certificate Trust
      The verification process involves establishing a trust of the certificate chain beginning from the signer certificate right till the root certificate. If the trust is established, a green check is displayed. If the trust cannot be established, a red cross is displayed. In case where trust cannot be established for an intermediate certificate in the chain, a blue question mark is displayed.

  • Certificate Validation Result
    This shows the Validation results of signers’ certificate. Assured Office looks for the location of the CRL within the certificate, and caches the CRL from this location to your local machine. The certificate is validated against this CRL. For all subsequent validations, the certificate is validated against this cached CRL unless it has expired. In case the CRL has expired, the entire process of locating the CRL and retrieving a fresh CRL is repeated. If the location of the CRL is not found or if an expired CRL cannot be updated, a blue question mark is displayed. Clicking the Validate Certificate Online button will perform an online validation. A green check is displayed if certificate is valid and a red cross if the certificate is present in the CRL i.e. the certificate has expired or has been revoked.

            If the signer certificate includes information of the validation authority in the Authority Information Access field, Assured Office will try to connect to this validation authority using the OCSP mechanism and attempt an online validation of the certificate.

    If a Policy is present defining Validation Mechanism, the mechanism within the Policy will take precedence.

  • Certificate validation information
    The Certificate validation information displays textual information about the validation if certificate validation is performed. This includes the mechanism, which was used to perform the validation and the URL path of the server where the validation was performed. Click the Response Details button to view details of the validation.

  • Signer certificate
    This gives you the following options

    • View...
      Click this button to view the details of the signer certificate.

    • Policy...
      Click this button to view the certificate Policy attached to the signer certificate.

    • Save to File...
      Click this button to save the signer certificate on the system. You can use this saved certificate to encrypt files for the sender in future.

  • Close
    Exits the Verification Details dialog box.


Validation Response Details

When you perform online validation for a particular certificate you have the option to view the details of the validation response. The details displayed include:

  • Responder ID
    This displays the common name of the authority that signs the response.

  • Response Signing Time
    This displays the time at which the response was signed. This is true only in case the validation mechanism used was OCSP. This field is blank if validation mechanism was CRL.

  • Valid From
    All responses have a validity period. This displays the period from when the validation response is valid.

  • Valid To
    This displays to period to when the validation response is valid.

  • Revocation Time
    If the certificate being validated has been revoked the time of revocation is displayed here.

  • Revocation Reason
    This displays the reason for revocation of the certificate.

Save to file
Click this button to save the Validation response details. The file will be saved with a .OCSP or a .CRL extension depending on the validation mechanism used. If the file is saved with a .OCSP extension it will contain the DER encoding of the OCSP ResponseBytes.

Server Certificate
Click this button to view details of the certificate used by the server to sign the response.


Using smart card certificates

E-Lock Technologies

Using smart cards with Assured Office

Any smart cards or other hardware Crypto-devices supported by the underlying security frameworks work with Assured Office. However, there may be certain things which differ from one Crypto-device to the other. The Internet Explorer and Entrust versions of Assured Office should work directly with the smart card as long as the smart card drivers are installed for these platforms correctly. For Assured Office - Netscape to work with the smart card, you will have to register the PKCS#11 driver supplied by the card manufacturer with the Assured office product.

To register the smart card driver:
  1. Start your MS-DOS prompt.
  2. Change your current directory to the Windows\System directory for Windows 95/98 and the Windows\System32 directory for Windows NT/2000.
  3. At the prompt enter the command
    regdrv -v dll name and press Enter.

    This will register the smart card driver in your registry.

            To get the name of the driver dll go to the Communicator->Tools->Security Info option. This will display the Security Info dialog box. Select the Cryptographic Modules option. From the list displayed, select the smart card option that you have installed and click the View/Edit option. The Security Module File will display the name of the driver dll. Register this dll using the command given above.


Configuration Manager

The Configuration Manager allows you to customize preferences for certain features of Assured Office.

You can start the Configuration Manager by selecting the Start->Programs->E-Lock Assured Office->Configuration Manager.

You can also start the Configuration Manager from the different components of Assured Office.

The Configuration Manager has the following tabs:

  • Basic Settings
  • Office Settings (if MS Office Add-In component of Assured Office is installed)
  • Desktop Settings (if Desktop signing component of Assured Office is installed)
  • Entrust Settings (if Assured Office for Entrust is installed)
  • Netscape User Profile Settings (if Assured Office for Netscape is installed)


Configuration Manager - Basic Settings Tab

E-Lock Technologies

Basic Settings

The Signing/Encryption wizard shows a series of dialog boxes. The user can control their display during the signing/encryption process of a file, but only under certain conditions.

By default the Signing Preferences dialog box is not displayed during the signing process. You can change this behavior by changing the appropriate settings in the Basic Settings tab of the Configuration Manager.

The options in the Basic Settings tab include:

  • Do not show policy selection dialog
    By default, this option is selected. Clear this check box to display the 'Policy Selection' dialog box during the signing/encryption operation.

  • Do not show profile selection dialog
    By default this option is selected. Clear this check box to display the 'Profile Selection' dialog box during the signing/encryption operation.

  • Always show encryption preferences dialog
    By default this option is not selected. The Encryption Preferences dialog box is not shown by the Signing/Encryption wizard if all the preferences have been defined by a Policy/Profile. If you still want this dialog box to be displayed, select this check box.

  • Signing preferences dialog
    You have three options for the Signing Preferences dialog box.

    • Never Show
      By default, this option in selected and the Signing Preferences dialog box is not displayed during the signing operation.

    • Always Show
      Select this option if you want the Signing Preference dialog box to be displayed during the signing operation. Selecting this option will display this dialog box even if all the Signing Preferences have been defined by a Policy, Profile or System Profile attached to the file or document being signed.

    • Show if required
      Select this option if you want the Signing Preference dialog box to be displayed only if a Policy, Profile or System Profile is not selected or all the signing preferences are not defined within the Policy, Profile or System Profile.

  • Shredding of temporary files
    Assured Office creates a number of temporary files in the Windows Temp directory during the encryption operation. Select this check box to shred all the temporary files created by Assured Office after exiting the application.
    If you choose to delete the original file after the encryption operation, the original file will be shredded if this option is selected.

             Shredding involves deleting of files from the system in a manner that does not allow users to retrieve them.

  • List expired certificates
    Assured Office by default does not enumerate the expired certificates during the signing process. Select this check box to enumerate all certificates, including expired certificates.

  • Prompt for online certificate validation
    Select this check box if you want to be prompted each time before Assured Office performs an online validation.


Configuration Manager - Desktop Applications Tab

E-Lock Technologies

Desktop Applications

The Assured Office Desktop Add-In is a user-friendly component that integrates seamlessly with the Windows operating system. It allows you to sign, encrypt, verify, and decrypt files straight from your Windows Desktop or Windows Explorer simply by right clicking the selected file.

The Desktop Applications tab has the following options:
  • Enable Shell Extension
    Select this check box to enable the E-Lock Desktop Add-In.

  • Default Operation for an .ats
    When you encrypt a file using Assured Office it creates a .ats file. You can select a default operation to be selected when you double click a .ats file. You have the following options:

    • Decrypt/Verify
      Select this option to start the e-Sign application with the Decrypt/Verify as the default operation.

    • Sign
      Select this option to start the e-Sign application with Sign as the default operation.


Configuration Manager - Office Settings Tab

E-Lock Technologies

MS Office Settings

Assured Office allows you to insert your Signature Block within the document or file while signing. You can control the placement of the Signature Block within the document or file.
  • Automatic Verification of document/worksheet on open
    Check this option to verify a signed file when you open it.

             This feature is not supported by MS Word 97.

  • Insert Signature Block in document/worksheet while signing
    Select this check box to place the Signature Block within the document/worksheet while signing.

  • Signature Block placement
    You can select the placement of the Signature Block within the document/worksheet by selecting one of the options provided

    • At cursor
      Select this option to place the Signature Block at the cursor position in the document during the signing operation.

    • Search phrase
      Select this option to search for a particular phrase within the document to place the Signature Block. You have various options to to place the Signature Block in relation to the search phrase. Select the appropriate option from the drop down list.

      • Insert Before
      • Insert After
      • Insert Below
      • Insert Above
      • Replace Phrase

    • Occurrences
      Select the appropriate option from the drop down list to place the Signature Block at the selected occurrence of the specified phrase. You can choose to insert the Signature Block at the first, last, or at all occurrences of the specified phrase.


Configuration Manager - Netscape User Profile Settings Tab

E-Lock Technologies

Netscape User Profile Settings

This tab is displayed when you install Assured Office for Netscape.

Select a Netscape profile to be used as the default profile from the drop down list. This profile information will be used for accessing the user certificates during security operations.

During installation, if you do not select a default Profile and if there is only a single Netscape Profile present, this profile will be used as the default Profile. In case of multiple Profiles the first Profile in the list will be used as the default Profile.

Netscape profiles are different from the User Profiles created using the Assured Office Profile Manager to be used during security operations.


e-Mark Application

E-Lock Technologies

e-Mark Application - Overview

The e-Mark application enables you to create graphic images of your handwritten signature. You can either use a mouse or any Wintab compliant digital tablet to create your signature image. The captured image is saved with a .esg extension. You have the option to sign over a watermark of a .bmp image. The file can later be used to be added to the Signature Block during the signing operation.


Selecting Signture Image type

E-Lock Technologies

Selecting a Signature Image type

The e-Mark application enables you to create a simple signature image or sign over a watermark image. Step 1 of the e-Mark application has the following options:

  • Sign over watermark
    Select this option to create a signature over a watermark of a .bmp image. Enter the name of the .bmp file in the text box provided or click the Browse... button to select a .bmp file. The image selected here will be used as a watermark and you can create your signature over this image.

             When you select this option you will not be able to view this file when signing with Digital Signature tool in Adobe Acrobat.

  • Sign
    Select this option to create a signature image of your handwritten signature without a watermark image in the background.


Creating Signatures using the e-Mark Application

E-Lock Technologies

Creating Signatures

Step 2 of the e-Mark application displays the following options:

  • Device
    Select the device you want to use to sign from the drop down list. Changing the device once you sign, will clear the canvas.

Sign on the canvas that is provided.

  • Capture
    Click this button to capture the image you have created over the canvas.

A red bordered rectangle surrounds your signature. This delineates the maximum size of the signature bitmap that you can create.

Once the signature is captured various options are available to customize your signature bitmap.
  • Thickness
    You can increase or decrease the thickness of the strokes of your signature image. The units are in pixels and the range is from 1 to 15.

  • Color
    Click this button to change the color of the strokes of your signature image. This displays the color palette box where you can choose your preferred color.

  • Clear
    Click this button to clear the canvas area.

  • Scaling Factor
    Move the pointer on the slide rule to scale the signature bitmap to the desired size.

  • Units
    Select one of the options to display the scaling factor in the desired unit.

Once you have created and customized your signature you can do the following:
  • Next
    Once you have captured the signature the Next button will be displayed. Click this button to move to the next step of the e-Mark application.

  • Cancel
    Click this button to quit this application without creating a signature image.


Encrypting your signature image file

After creating the signature you have the option to either encrypt the signature image file or save the file without encrypting it. Step 3 of the e-Mark application displays the following options:

  • Public Key Encryption
    Select this option if you want to encrypt the signature image file before you save it. Selecting this option will display the Encryption Preferences dialog box. Select the appropriate setting from the Encryption preferences to encrypt and then save your signature image file.

  • No Encryption
    Select this option to save the signature image file without encrypting it.

All signature image files will be saved with a .esg extension.


e-Report application

The e-Report application allows you to create summarized reports on security operations performed on a file. It also includes details of the Policy attached to the file and the verification and validation status of the file. The dialog box displays the following options:

  • Enter name of signed files
    In this text box enter the name of the signed file or click the Browse... button to select the files. The e-Report application allows you to select multiple files. If you are selecting multiple files, use a comma as a separator.

  • Enter the name of folder/file where the signature report is to be saved
    In this text box enter the path and/or name of the signed file if you want to specify a target folder or file name to save the report. By default, the signature report will be saved in the same directory with the same file name. All reports will be saved with a .csv extension.

    If you specify multiple file names, a separate .csv file will be created for each selected file. If you specify a target filename, a single .csv file will be created for all the files. You cannot specify multiple target file names.

  • Generate following reports
    The e-Report application allows you to generate any one or all of the following reports

    • Document Policy Details
      Selecting this option will include the details of the Document Policy, if any, attached to the signed document. Details like the name of the Policy, rules included in the policy will be displayed.

    • Stored Certificate Validation Details
      Selecting this option will include details of the Stored Validation Response.

    • Signature Details
      Selecting this option will include details of the Signature within the signature report.

  • Save
    Click this button to save the signature report. The signature report file will be saved with a .csv extension.

  • Save and View
    Click this button to save and view the signature report. By default the .csv file will be opened with MS Excel. If you do not have Excel installed, the Open With dialog box is displayed. You will have to manually associate the .csv file to open with Notepad.

  • Exit
    Click this button to exit the e-Report application.


Select Digital ID Details

E-Lock Technologies

Select Digital ID

This option will display the details of the certificate you choose.

It displays three basic tabs

  • General Tab
  • Details Tab
  • Certification Path Tab


Digital ID Details - Genereal Tab

E-Lock Technologies

General Tab

The General Tab of the View Digital ID option displays details of the Certificate selected in the Select Digital ID to use list box. It displays the following details:

  • Issued To
    This displays the name of the individual or organization the certificate is issued to.

  • Issued By
    This displays the name of the Certificate Authority who issued the certificate.

  • Valid From - To -
    This displays the validity period of the certificate.

The last line in the Certificate Information box displays whether you have the private key associated with the certificate.


Digital ID Details - DetailsTab

E-Lock Technologies

Details Tab

  • Certificate Subject
    This displays the Certificate Subject Name.

  • Show
    This option displays the current list of all X509 fields or extensions. You can select to view all or any one of the following

    • Version 1 Fields Only
    • Extensions Only
    • Critical Extensions Only
    • Properties Only

    Depending on the option you select the window below will display the list of the X509 fields, extensions and associated properties found in the certificate. The lower pane displays the details of the Field you highlight.


Digital ID Details - Certificatation Path Tab

E-Lock Technologies

Certification Path Tab

  • Certification Path
    This pane displays the certification path for the certificate.

  • Certificate Status
    This pane displays details like expiry, trust and revocation status of the certificate.

  • Save to file...
    Click this button to save the Certificate selected from the Certificate Chain to a file. This option allows you to save the certificate with a .cer extension.


Profiles

A Profile is a named collection of settings for your signing/encryption preferences. Commonly used settings can be saved as profiles. They are an ease-of-use feature for the end user to automate the signing/encryption operation.

The user can define a new profile with the help of the Profile Manager.


Profile Manager

The Profile Manager displays the list of the existing profiles on the system. If the user selects a particular profile, the description attached to the profile will be displayed in the Profile Description box.

New Profile
Click this button to create a new Profile.

Edit Profile
To edit an existing Profile, select the Profile from the Profile list box and click this button.

Delete Profile
To delete an existing Profile, select the Profile from the list and click this button.


Creating Profiles

New Profiles can be created for Signing and/or Encryption. Profiles which are created should be signed by the person creating them. It is also possible to insert Policies into the Profiles.

  • Profile for Signing
  • Profile for Encryption


Profile for signing

The user can select the default settings to be used for a signing operation.

The following settings can be specified:

  • Crypto provider
    Select this check box to choose a crypto provider from the drop down list.

  • Hash algorithm
    Select this check box to choose a hash algorithm from the drop down list.

  • Signature image
    Select this check box to enforce the signature image settings. There are three options:

    • Use live
      Select this option to force users to create and insert live graphic image of their handwritten signatures in the Signature Block during the signing operation, using the e-Mark application.

    • Don't use
      Select this option to disallow users from inserting graphic images of their handwritten signatures in the Signature Block during the signing operation.

    • Use from file (*.esg)
      Select this option to allow users to select a stored .esg file for inserting into the Signature Block during the signing operation. A .esg file is a graphical image of the user's handwritten signature, created using the e-Mark application.

  • Time stamp
    Select this check box to enforce the time stamp settings in the Signature Block during the signing operation. There are two options:

    • Include
      Select this option to include the time stamp while signing.

    • Don't include
      Select this option to disallow the user from including the time stamp while signing.

  • Pre-Text
    Select this option to enter text to be displayed before the document information in the Declaration pane of the Signing Ceremony. This text can be a legal statement the organization wants to display before the user signs the document.

  • Post-Text
    Select this option to enter text to be displayed after the document information in the Declaration pane of the Signing Ceremony. This text can be a legal statement the organization wants to display before the user signs the document.

  • Reasons to sign
    Select this option to specify a reason for signing a particular document. There are pre-defined reasons in the drop down list. You can select any one of these or you can include one of your own. Selecting this option will enable two options:

    • Add
      Click this button to add the reason in the box alongside. You can select multiple reasons.

    • Remove
      Click this button to remove an already added reason by selecting it from the box alongside. You can select multiple reasons to remove using the Ctrl key.

Clear
This button allows you to clear all the selections made.

Insert Policy...
This button allows you to select a policy to insert into the profile that you are creating.

 Once you insert a Policy within the Profile, the Change Policy... button will be displayed. Click this button to change the Policy attached to the Profile.

Create
Click this button once you have selected the settings for the profile. This will take you to the Create dialog box where you can name and add a description for the profile that you are creating. Clicking on OK will complete the process.

All Profiles that are created have to be signed by the person who creates them.

Cancel
Click this button to return to the first screen of the Profile Manager.

 Example
Say, you want the default Crypto Provider to be Base and the Hash Algorithm to be SHA-1 Follow these steps:
  1. Check the check box for Crypto provider and select Microsoft Base Cryptographic Provider.
  2. Select the check box for Hash Algorithm and select SHA-1 from the list box.
  3. Click the Create button.


Profile for Encryption

The user can select the default settings to be used for an Encryption operation.

The following settings can be specified:

  • Crypto provider
    By default, a list of cryptographic providers for the security framework for which Assured Office has been installed will be displayed. Select this check box to choose a cryptographic provider from the drop down list.

  • Encryption algorithm
    Select this check box to choose an encryption algorithm from the drop down list.

  • Key length
    Select this check box to choose a key length from the drop down list.

  • Encrypt for following users
    To select users for whom the document should be encrypted, click the names listed under Certificate Subject-Names. You can select multiple users using the Ctrl key. When a particular user is selected, the certificate details of that user are displayed in the pane next to this box.

    • Certificate Subject-Names
      This lists all the certificates present on your machine. Select the certificates that you want to encrypt with. The details of the selected certificate are displayed in the adjacent pane.

Clear
This button allows you to clear all the selections made.

Insert Policy...
This button allows you to select a policy to insert into the profile that you are creating.

 Once you insert a Policy within the Profile, the Change Policy... button will be displayed. Click this button to change the Policy attached to the Profile.

Create
Click this button once you have selected the settings for the profile. This will take you to the Create dialog box where you can name and add a description for the profile that you are creating. Clicking on OK will complete the process.

All Profiles that are created have to be signed by the person who creates them.

Cancel
Click this button to return to the first screen of the Profile Manager.

 Example

Say, you want the default Crypto Provider to be Microsoft Base Cryptographic Provider and Encryption Algorithm to be 3DES Follow these steps :
  1. Check the check box for Crypto Provider and select Microsoft Base Cryptographic Provider.
  2. Check the check box for Encryption Algorithm, and select 3DES from the drop down list box.
  3. Click the Create button.


Inserting a Policy into a Profile

You can insert a policy within a profile. This will enforce the policy within the document when that profile is used. Policies are either created with the help of Policy Manager or can be imported.

To insert a policy into a profile click on the Insert Policy... button in the Profile Creation dialog box. The Inset Policy dialog box is displayed. This dialog box has the following options:

  • Policies
    This lists all the document based Policies present on your system.

  • Policy Description
    This will display the details of the Policy that you select.

  • Remove existing Policy
    Select this check box to remove the existing Policy, if any from the Policies box.

OK
Once you select the Policy to be inserted within the Profile, click this button to insert the Policy within the Profile.

Cancel
Click this button to return to the Profile creation dialog box without attaching a Policy to the Profile.

 When you insert a Policy within a Profile, the settings of the Policy take precedence over the settings defined in the Profile. For example, if the setting within a Profile for the Hash Algorithm is set to MD2 and the Hash Algorithm in the Policy is set to MD5, when you try to sign/encrypt a file with that Profile the Hash Algorithm that will be used will be MD5, which is the one specified in the Policy.


Policy/Profile Creation

This dialog box allows the user to enter the name and description for the Policy/Profile being created. This dialog box will be shown when the user clicks on the Create button on the Policy/Profile dialog screen.

The dialog box displayed has the following buttons:

  • Name
    Enter the name to be given to the Policy/Profile being created.

  • Description
    Enter a short description for the Policy/Profile being created. This will be shown whenever the user selects the Policy/Profile through a Policy/Profile list box. The purpose of this is to enable the user to easily identify this Policy/Profile.

  • OK
    Click this button to continue the creation of the Policy/Profile.

  • Cancel
    Exits the Policy/Profile creation process.


Signing a Policy/Profile

E-Lock Technologies

Select Digital ID to Sign Policy/System Profile

You can select a digital certificate to sign the Policy/System Profile. This dialog box displays the following options:

  • Select Digital ID
    This box displays a list of all your digital certificates and the respective Crypto provider. Select a Digital ID to sign the Profile.

  • Certificate details
    This box displays the details of the certificate selected in the Select Digital ID to use box.

  • OK
    Click this button to create the Profile. This Profile is enumerated along with the existing Profiles in the Profile Manager.

  • Cancel
    Click this button to exit the Profile creation process.

            The certificate that you choose here is used to sign the Profile that is created. This should not be confused with the certificate that you chose in the settings within the Profiles to sign or encrypt a document.


Exporting Crypto Information

The Export Crypto information finds all vendor specific cryptographic information for signing and generates a .reg (registry) file. This .reg file can be used to import the same information into the Policy Manager. This can be useful if the machine having Policy Manager does not have all the cryptographic information installed on it. In this case, the "Export cryptographic Information" exports this information into a registry file that can be imported from the Policy Manager. This will allow the Policy Authority to create policies containing cryptographic information not available on the Policy Manager machine.

To export the Crypto Information select the Export Crypto Information option from the File menu.

Exported Crypto Information files are stored with .reg extension. These files can then be imported from the Policy Manager.


Importing a Policy/Profile

Assured Office Profile Manager allows you to import Policies or Profiles created by other users. Click on the Import Policies/Profiles option in the File menu. Enter the name of the Policy or Profile you wish to import when prompted to do so. Click OK to complete the process.


Exporting a Profile

Assured Office Profile Manager allows you to export profiles created within the Profile Manager to be distributed, shared and used among other users. To export a Profile select the Export Profile option from the File menu.

  • Profiles
    This list box displays a list of the User Profiles created on the user machine. Select the Profile to be exported from this list and click on the >> button.

  • Profiles to be exported
    This list box displays a list of the User Profiles selected by the user to be exported.

  • Delete
    Clicking on this button will remove the selected profile from the Profiles to be exported list box.

  • Profile Description
    This displays the textual description of the settings within the selected profile in the Profile list box.
OK
This button will display the Save As dialog box. Enter a name for the exported Profile. Exported Profiles are saved as .plc files.

Cancel
Exits the Export Profile dialog box.


Configuratin Manager - Entrust Settings

E-Lock Technologies

Entrust Settings Tab

  • Allow working with multiple profiles
    This option allows end user to choose a key or certificate from a selection of multiple profiles, if they exist, for carrying out a given operation signing/encryption.

    An Entrust Profile consists of a pair of keys -- signing and encryption. In typical Entrust PKI deployments a user will have a single profile.

    Though Assured Office does not rule out multiple profiles, and hence multiple keys, for various different purposes in which case it becomes necessary to give a choice to select appropriate key for the given operation. Opting for this choice will always result in a UI allowing the user to choose from the available profiles. User can elect to use a single key/profile for all operations to avoid getting a UI every time and making a selection by un-checking this option. In which case, Assured Office will attempt to use an already logged-in profile, using the Entrust/Entelligence single sign-on feature, without prompting the user for profile information wherever possible.

  • Silent mode
    Selecting this option, in conjunction with single profile mode, will result in Assured Office operating in “silent” mode. As a result, the user will see minimal prompts for selecting profiles and Entrust INI file. In silent mode, Assured Office will utilize the Entrust/Entelligence single sign-on feature and use an already logged-in profile if any.

Assured Office, in certain cases, will default to and over-ride to single profile silent mode to avoid un-due prompting for profile information.

  • Default entrust INI file
    Entrust INI file is required in conjunction with a profile to login to a profile. This option allows the user to specify the default Entrust INI file that would be used in single profile and silent modes.

  • Default Profile
    Optionally the user can also specify a default Entrust profile that Assured Office will use in single and silent profile mode of operation. If the user is not already logged-in to the profile, he will be prompted to log-in for the first time.


Importing a Policy

Policies created and distributed by the Policy Administrator can be imported so that they can be Inserted within a Profile.

To import a Policy select Import Policies option from the File menu in the Profile Manager.

Policies that are imported are stored in the Policies folder of the install directory of Assured Office.