SECURING YOUR DATA
The advantage of using a Smartcard with Lotus NotesR is that you use a Smartcard to lock your User ID. Without a Smartcard, you only need your User ID and your Lotus Notes password to access Lotus Notes. When using a Smartcard, you need your User ID, your Smartcard, and your Smartcard PIN to access Lotus Notes. Also, because you carry your Smartcard with you (just as you would carry a credit card with you), you are much less vulnerable to User ID theft.
Note: The term Smartcard includes cryptographic tokens. These are hardware devices that usually plug into a USB port, and have the same function as Smartcards.
For a list of supported Smartcard packages, see the Lotus Domino Support site.
Two ways to enable Smartcard login
There are two ways to enable Smartcard login. The preferred way secures the ID file using a private key from a personal Internet certificate stored on the Smartcard. Because this method supports the use of a Smartcard on which the Internet certificate and keys are preloaded, it does not require changes to a Smartcard, so allows the use of read-only Smartcards. It also enables users to easily secure multiple copies of their ID files with a Smartcard. The second way secures the ID file using a secret that is added to the Smartcard. This method does not offer the advantages of the preferred method, but is supported for compatibility with Domino release 6.
CAUTION: Do not enable Smartcard login without notifying your administrator first. Your administrator must verify that your person record does not have password expiration enabled before you can start using a Smartcard-enabled User ID.
If you synchronize your Microsoft WindowsR password with your Lotus Notes password or if you synchronize your Lotus Notes password with your IBM LotusR DominoR Web/Internet password password, you need to disable the synchronization before enabling Smartcard login with Lotus Notes.
CAUTION: Before using a Smartcard, you must work with your administrator to ensure your User ID is recoverable. For more information on recovering your User ID, see Recovering your User ID. If you run Lotus Notes from more than one computer, you must disable password checking before you enable use of a Smartcard.
Enabling Smartcard login by securing the ID file with an Internet certificate key (preferred)
Note: This procedure assumes that the Internet certificate that you will use to secure the ID file is stored on the Smartcard. If it is stored in the ID file instead, before performing this procedure you must a) enable Smartcard login by securing the ID file with a secret, and b) move the Internet keys to the Smartcard.
1. Make sure a Smartcard reader is installed on your computer and your administrator has set up recovery information for your User ID.
2. Insert your Smartcard in the Smartcard reader.
3. If the Internet certificate and keys you will use to secure your Smartcard have not been stored on your Smartcard, import the Internet certificate to your Smartcard, following your Smartcard vendor's directions.
4. From the menu, choose File > Security > UserSecurity.
5. Click Your Identity > Your Smartcard.
6. In the "Smartcard Configuration" dialog, enter or browse for (click the folder button) the entire path of the directory for the PKCS #11 Smartcard driver file in the "Smartcard driver file" field. (This file was added when you installed your Smartcard reader). For example, C:\Schlumberger\Smart Cards and Terminals\Common Files\SLBCK.DLL.
8. Click Your Identity > Your Certificates.
9. Select Your Internet Certificates and select the certificate to use to secure the ID file.
10. Click Other Actions > Lock ID File with Key on Smartcard
11. When prompted for each, enter your Lotus Notes password and your Smartcard PIN. Once you are prompted that Smartcard Login is enabled, you must use your Smartcard PIN the next time you login to Lotus Notes and thereafter.
12. When prompted, and if supported by your Smartcard, enter a descriptive name for your Smartcard in the Smartcard Login Labelfield under Your Smartcard configuration. For example, "Jason's Smartcard."
Note: Make sure to take your Smartcard with you whenever you leave your workstation. If you are using a PKCS#11 Version 2.01 or higher Smartcard driver set, removing your Smartcard from the Smartcard reader locks the Lotus Notes display until the Smartcard is put back into the Smartcard reader and you enter the correct PIN.
Note: If you have additional copies of your User ID, repeat these steps to Smartcard-enable each copy. Or, if you run Notes from only one computer at a time, copy the ID that you Smartcard-enabled in this procedure to each computer as you use it.
Enabling Smartcard login by securing the ID file with a secret stored on the Smartcard
3. From the menu, choose File > Security > UserSecurity. .
4. Click Your Identity > Your Smartcard.
5. In the Smartcard Configuration dialog, enter or browse for (click the folder button) the entire path of the directory for the PKCS #11 Smartcard driver file in the "Smartcard driver file" field. (This file was added when you installed your Smartcard reader). For example, C:\Schlumberger\Smart Cards and Terminals\Common Files\SLBCK.DLL.
7. Click the Enable Smartcard Login under Using your Smartcard with Notes.
8. When prompted for each, enter your Lotus Notes password and your Smartcard PIN. Once you are prompted that Smartcard Login is enabled, you must use your Smartcard PIN the next time you login to Lotus Notes and thereafter.
9. When prompted, and if supported by your Smartcard, enter a descriptive name for your Smartcard in the Smartcard Login Label field under Your Smartcard configuration. For example, "Jason's Smartcard."
Note: If there are copies of your User ID file, replace them with the copy of the User ID file that you enabled for Smartcard login in this procedure.
Moving Internet keys to a Smartcard
You can store on your Smartcard any Internet public and private keys from personal Internet certificates that you may have (not from Internet certificate authority certificates). Storing your Internet keys on your Smartcard adds an extra level of protection for them than storing them in your User ID. Once a set of Internet keys is moved to a Smartcard, it is only possible to export the certificate itself, without including the private key, to a separate file.
Note that you may not be able to store some keys on a Smartcard, including 630-bit private keys.
The X.509 certificate associated with the Internet keys is also stored on the Smartcard. You can view this certificate and its associated keys in the User Security dialog box, when you click Your Certificates and select Your Internet Certificates in the drop-down list.
CAUTION: Once you place your Internet keys on your Smartcard, you cannot remove them. You can only recover keys that are placed on your Smartcard after User ID recovery has been enabled on your User ID. If the recovery information in your User ID changes after you have placed keys onto a Smartcard, you can no longer recover those keys directly. If you do not recover your Internet keys, data encrypted with the keys is no longer readable. Contact your administrator for further advice on whether your Internet keys can be recovered before continuing with this procedure.
1. Click File > Security > User Security. .
2. Enter your PIN when prompted.
3. Click Your Identity > Your Certificates.
4. Select Your Internet Certificates.
5. Select the Internet certificate that corresponds with the Internet keys you want to move to your Smartcard.
6. Click Other Actions > Move Private Key to Smartcard.
7. Click Yes when you receive the warning that you cannot reverse the action.
8. Enter your PIN to confirm.
9. You should receive confirmation that your key was stored successfully.
Using pre-loaded Internet certificates on a Smartcard
If your Smartcard was given to you with Internet certificates already stored on it, Lotus Notes supports the ability to find and use those certificates without having to import them into the Lotus Notes client. These certificates must conform to the "PKCS#11: Conformance Profile Specification" for RSA Asymmetric Client Signing. If they do not, you must manually import them into your ID file.
When Lotus Notes searches for Internet certificates to display in the User Security dialog box, or to use the certificates for decrypting Internet mail or for SSL client authentication, the Internet certificates loaded on your Smartcard will be available for use, along with the Internet certificates in your ID file.
When you sign Internet email, and you have Internet certificates in your Smartcard that are not already contained in your ID file, you will have the option of choosing a new signing certificate from those on the Smartcard, through a dialog box prompt. If no new certificates are found on your Smartcard, your default signing certificate will be used and you will not be prompted.
If you have copies of Internet certificates in your ID file and on your Smartcard, Lotus Notes will use the copy of the certificate in the ID file.
To import Internet certificates from a Smartcard
You can import Internet certificates and store them in the Lotus Notes ID file so that they can be found by, and used with, Lotus Notes.
Note: This option is only applicable to users who have enabled Smartcard login by securing the ID file with a secret.
1. Click File > Security > UserSecurity.
4. Click Get Certificates. A drop-down list appears, listing different ways of importing certificates into the ID file.
5. Select Import Internet Certificate from a Smartcard. This imports all available certificates from the current Smartcard.
To view Smartcard configuration details
You can view all of the configuration information for any Smartcard or cryptographic token you have configured to use with Lotus Notes.
1. Click File > Security > User Security.
3. Click Your Identity > Your Smartcard.
4. Click Configuration Details. The Smartcard Configuration dialog box appears.
5. (Optional) Click Select Slot. The Select Slot dialog box appears. In addition to information about the cryptographic token, it provides a list box of all of the slots in your PC that are being used by Smartcard or cryptographic token readers. Select a number from the list to view details about the Smartcard or token that is being used by that slot.
Related topics Changing passwords Using your password with other Notes-based programs Synchronizing your Notes and Domino Web/Internet password Switching User IDs Password checking Recovering your User ID How Notes uses public and private keys for encrypting and signing mail Accessing servers using certificates