Copyright: Copyright © RSA Secure, 1996
Citation: RSA Data Security, Inc


About RSA Data Security, Inc.

In 1977, Professors Ronald L. Rivest, Adi Shamir, and Leonard M. Adleman invented the RSA Public Key Cryptosystem‘ at the Massachusetts Institute of Technology. Five years later, they founded RSA Data Security, Inc.

RSA Data Security is dedicated to the development and refinement of privacy and authentication techniques. The company enjoys a reputation as an international leader in the field.

A few years ago, RSA was just a clever set of techniques. Now RSA cryptography is present in hundreds of products, including secure telephones, fax machines, modems, network operating systems, electronic mail utilities, work flow software, and channel-attached link encryptors.

RSA cryptography is now a standard in many systems, including:

Internet PEM, SSL, SHTTP, S/MIME and S/WAN

Cellular Digital Packet Data (CDPD)

Public Key Cryptographic Standards (PKCS)

CCITT, now the ITU

ISO

EDIFACT

CFONB

Clients using RSA technology include IBM, Netscape, Apple Computer, AT&T, Sun Microsystems, Digital Equipment, Microsoft, Lotus, Novell, Oracle, Merrill Lynch, Motorola, General Electric, Chemical Bank, the U.S. Department of Defense, and NASA.


Accessing RSA SecurPC

You can use any one of the following methods to access the RSA SecurPC menu items:

In Explorer, select a field or folder and click the right mouse button (or select an RSA SecurPC command from the File menu).

In any folder window, select a file or folder and then click the right mouse button (or select an RSA SecurPC command from the File menu).

In the "My Computer" window select a disk and click the right mouse button (or select an RSA SecurPC command from the File menu).

Click the Start menu with the right mouse button.


Automatic Decryption and Encryption

Decrypting Files on Startup

To have RSA SecurPC decrypt files on the AutoCrypt List each time you enter Windows, select the Decrypt files when Windows starts up check box option.

If you select this option, RSA SecurPC prompts you for the password whenever you start up Windows.

Enter the password and choose OK or press Enter to encrypt or decrypt files on the AutoCrypt List, or, choose Cancel to leave the files in their current state.

Encrypting Files on Shutdown

To have RSA SecurPC encrypt files on the AutoCrypt List when you shut down Windows, select RSA Encrypt and Shutdown from the Start menu.

If you select this option, the "Encrypt and Shut Down" dialog box appears. To encrypt files on the AutoCrypt list and shut down Windows, choose Yes.

RSA SecurPC prompts you for your password (unless your password is currently stored in memory). Enter the password and choose OK or press Enter to encrypt or decrypt files on the AutoCrypt List, or choose Cancel to leave the files in their current state.

NOTE: The “RSA Encrypt and Shut Down” dialog box may contain an option to “Close all programs and log on as a different user”. If you do not use a password to protect your logon to Windows 95, you will not normally see this option.


Backing Up the User Preferences File

The final step is to back up the RSA SecurPC userpref.!!! file.

Insert a disk into the drive. The userpref.!!! file is copied onto the disk.

This step is very important. The userpref.!!! file contains your secret key, protected by your password. If you lose the RSA SecurPC software from your hard disk, you can reinstall RSA SecurPC from disks and use the backup userpref.!!! file to decrypt any files you previously encrypted. If the userpref.!!! file is lost, the only other way to recover such files is to use the Emergency Access key.

Think of your userpref.!!! file as being as important as your computer system password or other major password. However, this time you have no System Administrator to ask to restore your password. You are the only one who has your password, so protect it carefully!  We suggest that you make a backup copy of the disk with the userpref.!!! file, containing your password and secret key, and store that backup copy in a safe place. In addition, we suggest writing the time and date on the disk and making a notation of the password you used with that disk -- in a separate, secure location, of course. This way, if your password is compromised or your userpref.!!! file is lost, you can regain access to your files.

This completes the setup of RSA SecurPC.

Refer to Accessing RSA SecurPC for quick tips on starting the software.


Changing the Password

You can change your password at any time, as often as you wish. The current password will always decrypt any file you ever encrypted with your copy of RSA SecurPC, no matter what the password was when you encrypted it.

To change your password:

1.	Choose Password from the RSA Settings choice on the File menu, then choose Change Password. The Change Password dialog box appears.

2.	Type your current password and press Tab.

3.	Type the new password and press Tab.

4.	Type the new password again, then choose OK or press Enter.

Your new password is now in effect.

Since changing your password updates the RSA SecurPC userpref.!!! file, you will be prompted to back up that file again.

Store the backup of your RSA SecurPC userpref.!!! file in a safe place. If you lose the userpref.!!! file on your computer, copy the backup to the your RSA SecurPC home directory (which defaults to c:\RSASecurPC\User) to restore your user key and your password.

Without the userpref.!!! file, the only way to recover your encrypted files is with the Emergency Access key.

This step is very important. The userpref.!!! file contains your secret key, protected by your password. If you lose the RSA SecurPC software from your hard disk, you can reinstall RSA SecurPC from the original User Setup disk and use the backup userpref.!!! file to decrypt any files you previously encrypted. If the userpref.!!! file is lost, the only other way to recover such files is to use the Emergency Access key.

Think of your userpref.!!! file as being as important as your computer system password or other major password. However, this time you have no system administrator to ask to restore your password. You are the only one who has your password, so protect it carefully! We suggest that you make a backup copy of the disk with your userpref.!!! file, containing your password and secret key, and store that backup copy in a safe place.  In addition, we suggest writing the time and date on the disk and making a notation of the password you used with that disk -- in a separate, secure location, of course. This way, if your password is compromised or your userpref.!!! file is lost, you can regain access to your files.


Clearing your Password from Memory

After setting your password to remain active, you may want to render it inactive if, for example, you are about to leave your computer unattended for a while.

To clear your password from memory:

1.	Choose Password from the RSA Settings chfcoice on the File menu.

2.	Choose Clear Password from Memory.

The next time you choose the Encrypt, Decrypt, or AutoCrypt command, you must enter the password to proceed.


Contents
RSA SecurePC Help

Welcome to RSA SecurPC

What is RSA SecurPC?

User and Emergency Access Software

Cryptography of RSA SecurPC

Features of RSA SecurPC

About RSA Data Security, Inc.

Requirements for Using RSA SecurPC

Setting Up the User Software

Install the Emergency Access Software First

Specifying a User Name and Password

Backing Up the User Preferences File

Installing the User Software

Accessing RSA SecurPC

Using RSA SecurPC

Flexibility of RSA SecurPC

RSA SecurPC Menu Commands

RSA SecurPC Secret Key Protection

Encrypting Files

Encrypting Files

Encrypting Multiple Files

Encrypting the Files in an Entire Directory or Drive

Encrypting Files on Shutdown

Files you Cannot Encrypt

Decrypting Files

Decrypting Files

Decrypting and Launching a File

File Sharing

File Sharing

File Sharing Encryption

File Sharing Decryption

File Sharing - Creating a Self-extracting Encrypted File

Decrypting a Self-extracting Encrypted File

AutoCrypt Feature

What is AutoCrypt?

Displaying the AutoCrypt List

Removing Files or Directories from the AutoCrypt List

Automatic Decryption and Encryption

Working with Passwords

Keeping Your Password Active

Clearing your Password from Memory

Disabling Emergency Access

Changing the Password

Using the Same Password on Multiple Machines

Uninstalling the User Software

Uninstalling the User Software


Cryptography of RSA SecurPC

RSA SecurPC uses RC4, a cryptographic algorithm created by Professor Ronald L. Rivest of RSA Data Security in 1987.

RC4 is a fast stream cipher. It is widely licensed and has been examined in depth by several teams of independent cryptographers.  A recent report gives details of their findings. Here are some excerpts from that report:

“We felt that a cryptanalyst would have a particularly difficult task in trying to compromise RC4 by more subtle means than exhaustive key-search.”

“We also found that sequences generated using RC4 had a ‘good appearance’ when analyzed with a wide range of popular statistical tests.”

“In short, we found RC4 to be as secure as we had thought.”


Decrypting Files

With RSA SecurPC, it’s as easy to decrypt files as it is to encrypt them.

Suppose you want to decrypt four encrypted files:

capabil.!!!

cipher3.!!!

evalchrs.!!!

mktpln96.!!!

To decrypt these files:

1.	Select the encrypted files in Explorer and choose Decrypt from the File menu.

Remember, you can get to the RSA options in several ways:

By selecting a file in Explorer and then choosing File from the menu bar

By selecting a file in Explorer and pressing the right mouse button

By selecting a file through My Computer, then choosing File from the menu bar, or pressing the right mouse button

All methods produce the same result. Next, the names of the files to be decrypted appear and you are prompted for your password.

2.	Enter your password and choose OK or press Enter to decrypt the files.

If you have previously set the password to remain active, the password entry box does not appear.

During decryption, RSA SecurPC restores the selected files to their original state with the original file names.


Decrypting a Self-extracting Encrypted File

To decrypt a file that has been encrypted as a self-extracting file:

1.	Double-click on the file in Explorer or, from the Windows 95 Start menu, select Run.

From the Run dialog box, type in the path of the self-extracting encrypted file. A dialog box appears.

2.	Enter the sharable password used for encryption, and choose OK or press Enter.

If the correct password is entered, the encrypted information is decrypted and placed in the same directory as the self-extracting encrypted file. RSA SecurPC also shows you the name of the file that has been decrypted, because the name may have been changed after it was encrypted.


Decrypting and Launching a File

Windows 95 enables you to open a data file in its associated application by double-clicking on the file in Explorer or My Computer.  RSA SecurPC extends this capability to encrypted files.

To decrypt an encrypted file and open it within its associated application:

1.	Double-click the encrypted file.

2.	When the Decrypt dialog box appears, enter your password and choose OK or press Enter.

RSA SecurPC decrypts the file, then instructs Windows 95 to start the associated application and open the file.

Windows 95 uses a data file’s extension to determine the application in which to open the file. For example, double-clicking a file with the extension .doc opens the file in Microsoft Word.

If Windows 95 does not recognize the extension of your data files, select the file and choose Options from the View menu, then click the File Types tab to display options for associating that extension with the proper application.


Disabling Emergency Access

During the RSA SecurPC Emergency Access setup process, your organization’s Emergency Access administrator has the option of enabling users to disable Emergency Access to any file during encryption. If this option is available to you, it appears in the Emergency Access Information dialog box.

In the Encrypt dialog box, click on the More button in the Emergency Access section. This will display the Emergency Access Information dialog box with the disable option showing.

Choose the Disable emergency key access check box to activate this feature. You might want to do this when encrypting personal or extremely sensitive files. This option/checkbox will not appear if your Emergency Access administrator did not provide you with the option to disable Emergency Access.

WARNING: If you lose the password or the userpref.!!! file, you can never recover files you encrypt with the Emergency Access disabled.


Displaying the AutoCrypt List

1.	In Explorer, choose AutoCrypt from the RSA Settings option on the File menu. The Password dialog box appears for you to gain authorized access to the list.

2.	Enter your password and choose OK or press Enter. The AutoCrypt dialog box appears.

3.	Select a drive, then select one or more directories and/or files to place on the list.

4.	Choose the Add to List button to place the selected directories and files on the AutoCrypt List. You can also double-click on a file to add it to the list.

You can add files and directories from any location, including those located on network drives. As you choose them, their names appear on the AutoCrypt List.

TIP:  To immediately encrypt or decrypt files on the AutoCrypt List, clink Encrypt Now or Decrypt Now. You might want to do this before connecting to the Internet, for example.

5.	To save the AutoCrypt List, choose Done.


Encrypting Files

Suppose you want to encrypt a file, mktpln96.doc, kept in a directory named work under your Winword directory structure.

1.	Select the file and choose Encrypt.

Remember, you can get to the RSA options in several ways:

By selecting a file in Explorer and then choosing File from the menu bar

By selecting a file in Explorer and pressing the right mouse button

By selecting a file through My Computer, then choosing File from the menu bar, or pressing the right mouse button

All methods produce the same result. A dialog box appears with the name of the current directory, the file about to be encrypted, the user name, and the organization holding the emergency key if Emergency Access has been activated. The area at the bottom is for you to enter your password.

Before or after you enter your password, you can choose to keep your password in memory for a specified length of time. It will be cleared from memory when that time expires or when you issue the command to “clear password” from memory. (To clear your password from memory, open the the File menu, select RSA Settings from the RSA choices, then Password, then Clear Password From Memory.)

2.	To encrypt the file, type your password and choose OK or press Enter.

RSA SecurPC changes the filename and adds an extension of .!!! (sometimes said aloud as “dot bang bang bang”) to show that it has been encrypted.

RSA SecurPC will not encrypt a file that has already been encrypted by RSA SecurPC. Refer to Files You Cannot Encrypt for more information.


Encrypting Files in an Entire Directory or Drive

Select the directory or drive in Explorer and choose Encrypt from the File menu as described above. All files in that directory or drive and all of its subdirectories will be encrypted.

Refer to Encrypting Files for more information on encrypting files.


Encrypting Files on Shutdown

To have RSA SecurPC encrypt files on the AutoCrypt List when you shut down Windows, select RSA Encrypt and Shutdown from the Start menu.

If you select this option, the Encrypt and Shut Down dialog box appears.

To encrypt files on the AutoCrypt list and shut down Windows, choose Yes.

RSA SecurPC prompts you for your password. Enter the password and choose OK or press Enter to encrypt or decrypt files on the AutoCrypt List, or choose Cancel to leave the files in their current state.

Refer to Automatic Decryption and Encryption for more information.


Encrypting Multiple Files

To select a series of adjacent files for encryption, click the first file name, then hold Shift and click the last filename in the series.

To select a number of nonadjacent files for encryption, hold Ctrl as you click each file name.

Then choose Encrypt from the File menu and follow the same steps as for a single file.

Refer to Encrypting Files for more information on encrypting files.


Features of RSA SecurPC

Powerful encryption technology: RSA SecurPC uses the RC4 symmetric cipher, a method of file encryption and decryption that is safe and fast.

Integration with Windows 95: RSA SecurPC attaches to Windows 95 through the Start menu, the File menu in My Computer, and the Explorer. For example, in Explorer, you encrypt and decrypt files by selecting them with the right mouse button and choosing the correct command.

File encryption and decryption: RSA SecurPC enables you to encrypt and decrypt one file, a group of files, all the files in a directory, or all of the files on a disk, by typing a password that activates your secret key. If you change your password, the new one will decrypt any file you previously encrypted.

File sharing: RSA SecurPC enables you to encrypt files with sharable passwords for secure file sharing. These encrypted files can be shared with any Windows 95, Windows 3.1, or Windows NT user, even if he or she does not have RSA SecurPC. In addition, these encrypted files can be shared with Macintosh users who do have the Macintosh version of RSA SecurPC.

Password retention: In order to encrypt and decrypt files without entering the password each time, RSA SecurPC enables you to keep the password active for the number of minutes you specify.

Automatic encryption and decryption: The RSA SecurPC AutoCrypt List shows the files and directories you want to automatically encrypt each time you exit Windows and decrypt each time you start Windows. You can also use this list to “Encrypt Now” when you want to protect your files without exiting Windows.

Emergency key decryption of files: RSA SecurPC provides the option of emergency keys for recovering the encrypted files of any user in the organization in an emergency, such as the loss of a user password or a user’s userpref.!!! file.

Emergency key splitting: For additional security and to protect user privacy, a company can split the emergency key into parts, each held by a different person (RSA refers to them as trustees), with a minimum threshold number of key parts required to decrypt user files. For example, if the company has eight trustees and a threshold of three, decrypting a user’s file would require that three of the eight trustees be present to activate the process.


File Sharing

RSA SecurPC 1.1 implements file sharing, and changes the RSA menu choices in the Windows 95 Explorer to add File Share as a choice after Encrypt and Decrypt.

Encrypt...	encrypts one or more selected files/folders.

Decrypt...	decrypts one or more selected files/folders.

File Share	encrypts or decrypts one or more selected files with a sharable password for secure file sharing.

File Sharing Encryption

You can encrypt a file with a sharable password.  Files encrypted in this way can then be decrypted by anyone with RSA SecurPC as long as he or she knows the password.  This is especially useful for sharing information among people in a secure manner. Note that this sharable password is different from your user password used for encrypting files for storage on your own machine.

CAUTION: Because this password is to be shared with others, it should be different from your user password.


File Sharing - Creating a Self-extracting Encrypted File

When encrypting using the sharable password, there is an option to create an encrypted file in the form of an executable. This executable is a stand-alone Windows application that has the encrypted information attached to it. This executable can then be sent to other Windows 95, Windows 3.1, or Windows NT users. Upon receiving this executable, a user can run it, enter the sharable password, decrypt the encrypted data, and extract the original file from the executable. This will allow users of RSA SecurPC to send encrypted data to people who do not have RSA SecurPC.

To create a self-extracting encrypted file:

1.	Select a file, choose File Share from the File menu, then choose Encrypt. Note that you can encrypt only one file at a time when choosing the “Encrypt as self-extracting Windows file (.exe)” option.

2.	The File Sharing – Encryption dialog box appears. This dialog box displays the name of the current directory, the file about to be encrypted, and two edit boxes for you to enter a sharable password.

CAUTION: Because this password is to be shared with others, it should be different from your user password.

3.	Type a sharable password, press Tab, and type the password again.

4.	Select the Encrypt as self-extracting option

RSA SecurPC changes the extension of the file to .exe to show that it has been encrypted as an executable file. For example, an employee evaluation might have the name EVALJOHN.DOC before encryption. To enhance confidentiality, you could rename the encrypted EVALJOHN.EXE to be ONE.EXE or anything else that would hide its purpose.

During encryption, a separate file is created to store the encrypted data for the original file. The original file will not be deleted unless the Delete original file(s) option is checked. Note that after encrypting a file as a self-extracting file, you may change the name of the new executable file without losing the original file name. Upon decryption, RSA SecurPC restores the file to its original name and displays that file name (EVALJOHN.DOC, in this example), so that the user knows what has been decrypted.


File Sharing Decryption

When someone sends you a file with the .s!! extension, this file can be easily decrypted with RSA SecurPC if you know the sharable password used to encrypt it.

Suppose you want to decrypt several files that have been encrypted with the same sharable password:

capabil.s!!

evalchrs.s!!

mktpln96.s!!

To decrypt those files:

1.	Select the encrypted files in Explorer, choose File Share from the File menu, then choose Decrypt.

2.	A dialog box appears with the names of the files that are to be decrypted.

3.	Enter the sharable password and choose OK or press Enter to decrypt the files.

During decryption, a separate file is created to store the decrypted data for each encrypted file. The original encrypted files will not be erased unless the Delete encrypted file(s) option is checked.


File Sharing Encryption

To encrypt files with a sharable password:

1.	Select the files, choose File Share from the File menu, then choose Encrypt.

2.	The File Sharing – Encryption dialog box appears. This dialog box displays the name of the current directory, the files about to be encrypted, and two edit boxes for you to enter a sharable password.

3.	Type a sharable password and press Tab.

4.	Type the password again, and choose OK or press Enter.

RSA SecurPC changes the filename and adds the extension of .s!! to show that the files have been encrypted with a sharable password. During encryption, a separate file is created to store the encrypted data for each file. The original files will not be erased unless the Delete original file(s) option is checked.

CAUTION: Because this password is to be shared with others, it should be different from your user password.


Files you Cannot Encrypt

There are some files that cannot be encrypted.  Doing so could disable DOS, Windows, application programs, or RSA SecurPC itself.

RSA SecurPC will not encrypt:

Files it has already encrypted

RSA SecurPC program files

Files with any of the following extensions: .bat, .bin, .cfg, .com, .dll, .drv, .exe, .fon, .fot, .grp, .ico, .ini, .ovl, .pif, .sys, .ttf, .vbx, .386

Files in the \Windows directory and its subdirectories. (Not encrypting these protects the wide range of configuration files with different names that are stored in these directories.)

Read-only, hidden, and system files


Flexibility of RSA SecurPC

RSA SecurPC enables you to encrypt and decrypt almost any kind of file in any drive or directory. In two steps you can encrypt one file, groups of files, all files in a directory, or an entire disk volume. It will not, however, encrypt read-only, hidden, system or any of the basic file types that enable your computer to run.


Install the Emergency Access Software First!

The RSA SecurPC software is on two disks:

User software for the encryption and decryption of files

Emergency Access software for the configuration and use of an emergency key

To enable emergency key access to encrypted files, install and set up the Emergency Access software before you copy and distribute the user software in accordance with the terms of your license. Refer to your System Administrator for more information on installing the emergency key access.


Installing the User Software

To Install the RSA SecurPC User Software

1.	Insert the “User Setup” disk into the drive.

2.	From the Windows 95 Control Panel, choose Add/Remove Programs.

The Add/Remove Programs Properties sheet appears.

3.	Click Install.

4.	Follow the installation program instructions to complete the installation.

NOTE: You can also choose Run from the Start menu and run a:\setup. The result will be the same.

CAUTION: This version of RSA SecurPC is not designed to run under Windows 3.1 or Windows NT. Before changing to either operating system, you should decrypt any files you have encrypted with RSA SecurPC and uninstall RSA SecurPC (as explained in Chapter 6, Uninstalling RSA SecurPC). There are separate versions of RSA SecurPC for Windows 3.1/Windows for Workgroups 3.x and the Macintosh, and another version for Windows NT.

5.	Choose OK or press Enter.

6.	The next step is the setup of the user name and password, which begins with the generation of a “seed” that will be used for random number generation during the setup process.

A dialog box appears prompting you to enter key strokes and/or move the mouse during this process. A “*” will appear for each keystroke. Move your mouse and press any keys you wish until the process is complete. At that point you will set up your user name and password.

7.	When installation ends, a dialog box appears indicating the installation of the RSA SecurPC user software is complete.

NOTE: If you have a previous version RSA SecurPC installed on your computer, RSA SecurPC will detect it and give you the option of replacing or retaining your existing secret key, password, and AutoCrypt list. We recommend keeping your existing configuration. However, if you choose to create a new configuration, be sure to first decrypt all of your files that were encrypted with the Windows 3.1 version!

Refer to Specifying a User Name and Password for the next installation steps.


Keeping Your Password Active

To avoid having to enter your password each time you use an RSA SecurPC function:

1.	Display the Encrypt or Decrypt dialog box by choosing the appropriate menu item from the File menu in Explorer.

2.	Click the Keep password in memory check box.

3.	Set the number of minutes for the password to remain active.

4.	Type your password and choose OK or press Enter.

As long as the password remains active, the password portion of the Encrypt and Decrypt dialog boxes does not appear when you encrypt and decrypt files.

You need not type your password again until the activity time has expired or you clear the password from memory.


RSA SecurPC Menu Commands

After you have set up the user software, you can use the right mouse button to view the RSA menu options in Explorer. Note that the options are integrated with the other Explorer file or folder/directory options.

RSA SecurPC menu options

Here is an overview of the RSA SecurPC menu options.

Encrypt...	encrypts one or more selected files or folders.

Decrypt...	decrypts one or more selected files or folders.

File Share	displays the File Share submenu that lists the following options:

Encrypt	encrypts one or more selected files or folders with a sharable password for secure file sharing.

Decrypt	decrypts one or more selected files or folders with a sharable password for secure file sharing.

RSA Settings	displays the RSA Settings submenu that lists the following options:

AutoCrypt	displays the AutoCrypt list, where you select files or folders for RSA SecurPC to automatically encrypt when you choose the RSA Encrypt and Shut Down option from the Start menu, and/or automatically decrypt when you start Windows 95.

Password	enables you to change your password or clear it from active memory.

RSA Help	provides information on RSA SecurPC features, procedures, menu options, and dialog boxes.

About RSA	displays copyright information and a brief history of RSA Data Security, Inc.


RSA SecurPC Secret Key Protection

Your RSA SecurPC secret key is normally stored encrypted in a file on your disk, userpref.!!!. This file contains your encrypted secret key and the current password that you are using with it. You gain access to the userpref.!!! file by entering your password when prompted for it by RSA SecurPC. However, if you wish to have further protection over the secret key, you can choose to remove it from your hard disk and use it from your backup floppy disk copy. Your userpref.!!! file is copied onto floppy disk whenever you change your password, as long as you respond to RSA SecurPC’s prompts to back up your userpref.!!! file. The userpref.!!! file is referred to by RSA SecurPC whenever you do an encryption or decryption operation, thus making this a crucial file for which you should maintain backup copies. If the file on your hard disk is corrupted or deleted, you can always restore from your backup copy on floppy disk. Always do these backups, safeguard these disks, and remember the password you chose.

If you wish to increase your security by removing the userpref.!!! file from your hard disk, thus using the userpref.!!! file only from a floppy disk, RSA SecurPC is designed to handle this. Whenever you perform an encryption or decryption operation, RSA SecurPC will look for the userpref.!!! file in your RSA SecurPC home directory (which defaults to C:\RSASecurPC\User). If it is not found there, RSA SecurPC will inform you that the userpref.!!! file is “corrupted or missing,” and will prompt you to insert a disk containing the userpref.!!! file into the disk drive. Once it has read the file, you can eject the disk. This might be referred to as a “poor man's security token” since it has some of the attributes of secure tokens, although the cost is certainly far less and the “token” (a floppy disk) is far more ubiquitous.

NOTE:  If you choose this method of storing your userpref.!!! on a floppy disk alone, RSA SecurPC will prompt you for the disk only when you are performing an RSA SecurPC operation and your password is required. One of these times is upon exiting Windows, at which time RSA SecurPC encrypts the files on your AutoCrypt list and saves the list. As always, if you wish to skip encrypting these files, you can choose Cancel or press Esc to leave Windows immediately.


Removing Files or Directories from the AutoCrypt List

1.	Select the files or directories to be removed from the AutoCrypt List and click the Remove from List button.

2.	When you are finished, choose Done.

Refer to Displaying the AutoCrypt List for more information.


Requirements for Using RSA SecurPC

Minimum Configuration

386 microprocessor

4 MB of RAM

VGA 640 x 480 resolution

Microsoft Windows 95

CAUTION: This version of RSA SecurPC is not designed to run under Windows 3.1 or Windows NT. Before changing to either operating system, you should decrypt any files you have encrypted with RSA SecurPC and uninstall RSA SecurPC (as explained in Chapter 6, Uninstalling RSA SecurPC). There are separate versions of RSA SecurPC for Windows 3.1/Windows for Workgroups 3.x, and the Macintosh, and another version for Windows NT.

Recommended Configuration

486 / 33 MHz microprocessor or better

8 or more MB of RAM

Two-button mouse


Specifying a User Name and Password

You personalize your copy of RSA SecurPC by specifying your user name and the password that you will use to encrypt and decrypt files.

Take some care in devising a password that you will remember but that no one else will discover or guess.  We suggest the following guidelines for developing a robust password:

Use at least 10 characters.

Use various uppercase and lowercase letters, spaces, numbers, punctuation, and symbols in the password.

Avoid using any character more than twice.

To prevent a potential invader from discovering the password through a dictionary search, avoid words listed in the dictionary.

Avoid using personal information that a potential invader could guess or find -- the name of your spouse, child, or parent; your home or work street name, number, or city; your birthday, telephone number, social security number, etc.

Choose a password you can commit to memory. Do not reveal it to anyone. If you write it down, store the paper in a secure, locked place, and tell its location (without giving access) to only one or two trusted persons.

The User Setup program

A dialog box asks for your name and a password.

1.	Type your name in the first text box and press Tab.

2.	Type the password you will use and press Tab again.

3.	Retype the password to confirm it.

4.	Choose OK or press Enter.

Refer to Backing Up the User Preferences File for the next installation steps.


Uninstalling the User Software

To preserve the option of restoring your unique version of RSA SecurPC, save the userpref.!!! file before you run the User uninstallation program.

CAUTION:  If your userpref.!!! file is destroyed or lost, and the Emergency Access emerpref.!!! file has been destroyed or lost, there is no way to recover your files encrypted with RSA SecurPC.

To Uninstall RSA SecurPC From a User’s Computer

1.	Quit RSA SecurPC if it is open.

2.	Exit Windows 95 Explorer if it is running.

As with most Windows 95 programs, we recommend that you exit all other applications prior to uninstalling RSA SecurPC.

3.	From the Control Panel, choose Add/Remove Programs.

The Add/Remove Programs Properties sheet appears.

4.	Choose RSA SecurPC from the program list, then click Add/Remove.

A confirmation dialog box appears.

5.	Choose Yes or press Enter to continue.

Windows restarts. If you are on a network, you may be prompted for your network User Name and Password.

After restarting, another confirmation dialog box appears.

6.	Choose Yes or press Enter to continue.

Windows 95 removes RSA SecurPC User software from the hard drive.

RSA SecurPC displays a message confirming the uninstallation of the RSA SecurPC user software.

7.	Choose OK or press Enter.

NOTE: You can also use the Start menu Run command to run the RSA Uninstall program (for instance, type C:\RSASecurPC\User\Uninstall.exe) to remove RSA SecurPC from the hard drive.


User and Emergency Access Software

RSA SecurPC consists of two parts:

User software for encrypting and decrypting files with randomly generated RC4™ keys (a new one for each file) protected by the user’s password and secret key

Emergency Access software for the setup and use of an emergency key

The emergency key provides a way for the organization to recover a user’s encrypted files if the user password or userpref.!!! file is lost or unavailable.

We recommend beginning installation with the Emergency Access software. Although you can install the User software without using the Emergency Access software to add the emergency key, if the user’s password or userpref.!!! file is lost, files encrypted with such software cannot be decrypted. Refer to your system administrator for more information on installing the Emergency Access software.


Using the Same Password on Multiple Machines

You can use the same password and RSA SecurPC key on more than one computer (your desktop and your laptop, for example), enabling you to encrypt and decrypt files on them interchangeably if they have the same userpref.!!! file.

If you choose to do this, there are several steps you should take:

1.	Install RSA SecurPC on both computers.

2.	Choose one computer to have the “master” userpref.!!! file. Copy that file, which is in the c:\RSASecurPC\User directory, onto a disk.

3.	On the second computer, decrypt all files that were previously encrypted with RSA SecurPC.

4.	Take the copy that you just made of the RSA SecurPC userpref.!!! file from the first computer and use it to overwrite the RSA SecurPC userpref.!!! file on the other computer. RSA SecurPC on both machines will then have the same secret key and will encrypt and decrypt files with the same user password. If Emergency Access was enabled, files encrypted on either machine can be decrypted with the Emergency Access key.

Another possible use of this feature is a workgroup that chooses to have interchangeable access to the same files without explicitly creating sharable passwords for file sharing. Since each user can then create a new password for activation of the secret key, files on that user’s local machine are still private. However, files on the network that are accessible by other members of the workgroup will appear as locally encrypted files, and will be accessible by those members of the workgroup.


What is AutoCrypt?

The AutoCrypt feature enables you to list files or directories for RSA SecurPC to automatically encrypt when you shut down Windows 95 and decrypt when you start Windows 95.


What is RSA SecurPC?

RSA SecurPC is a utility that attaches to the Microsoft Windows 95 Explorer that enables you to ensure the privacy of files you store on hard drives, disks, or a network server. It also enables you to share encrypted files with other Windows users, even if they do not use RSA SecurPC. This manual is for the Windows 95 version only. RSA SecurPC is also available in versions for Windows 3.1/Windows for Workgroups 3.x, for the Macintosh, and for Windows NT.

NOTE: RSA SecurPC also attaches itself to the Windows 95 Start menu, the My Computer window, and the File menu for a selected file or directory.