Initializing eToken

The eToken Initialization option restores an eToken to its initial state. It removes all objects stored on the eToken since manufacture, frees up available memory, and resets the eToken password, allowing administrators to initialize the eToken according to specific organizational requirements or security modes.

Initializing an eToken is useful, for example, after an employee has left a company. It completely removes the employee’s individual certificates and other personal data from the eToken, leaving it ready to be set up and used by another employee.

The following data is initialized:

The initialization process loads the Aladdin file system on the eToken.

Using customizable parameters, you can select specific parameters that will apply to certain eTokens. These parameters may be necessary if you wish to use the eToken for specific applications or if you require a specific user or administrator password on all the eTokens in the organization.

To initialize an eToken:

  1. Click Initialize eToken on the toolbar, or right-click the token name in the left pane and select Initialize eToken from the shortcut menu.

The eToken Initialization Parameters dialog box opens.

  1. Enter a name for the eToken in the eToken Name field. If no name is entered, the default name, “eToken”, is applied.

  2. Select Create User Password to initialize the token with an eToken user password. Otherwise, the token is initialized without an eToken password, and it will not be usable for eToken applications.

  3. Enter a new eToken user password in the Create User Password and Confirm fields.

  4. If you require an Administrator Password, select Create Administrator Password and enter a password in the Create Administrator Password and Confirm fields (minimum password length must be 4 characters).

  5. Enter a value between 1 and 15 in the Set maximum number of logon failures fields for the User Password and for the Administrator Password, if enabled.

This counter specifies the number of times the user or administrator can attempt to log on to the eToken with an incorrect password before the eToken is locked. The default setting for the maximum number of incorrect logon attempts is 15.

  1. If required, select Password must be changed on first logon.

  2. To configure advanced settings, click Advanced.

The eToken Advanced Settings dialog box opens.

  1. Complete the fields as follows:

3.65 Compatibility Mode

Select to maintain compatibility with eToken RTE 3.65

Save password policy on eToken

Select to keep password policy on the eToken device.

FIPS Mode

Select to enable FIPS support.
FIPS (Federal Information Processing Standards) is a US government approved set of standards designed to improve the utilization and management of computer and related telecommunication systems. The eToken PRO can be configured in FIPS mode.

Single factor log on

Default: disabled

When single factor logon is enabled, only the presence of the eToken is required to log on to applications. A password is not required.

Note: For security reasons, single factor logon is not applied to eToken Properties.

Load 2048-bit RSA key support

Select to enable 2048 bit RSA key support (on compatible token).

Load HMCA SHA1 support

Select to enable HMCA SHA1 support (on compatible token).

Private data caching mode

In PKI Client 4.5, public information stored on the eToken is cached to enhance performance. This option defines the way private information (excluding private keys on the eToken PRO/NG OTP / Smartcard) can be cached outside the eToken.

Select one of the following options:

Always (Default): always caches private information in the application memory. This enables fast performance as certain information is cached on the host machine but because of this, this option is less secure than if no cache is allowed.

While user is logged on: caches private data outside the eToken as long as the user is logged into the eToken. Once the user logs out, all the private data in the cache is erased.

Never: does not cache private data.

RSA key secondary authentication mode.

You can set an additional authentication password for an RSA key. If this option is used, then in addition to having the eToken and knowing the eToken's password, accessing the RSA key requires knowing the password set for that particular key

This option defines the policy for making use of this secondary authentication of RSA keys.

Always: every time an RSA key is generated, you are prompted to enter a secondary password for accessing this key. Clicking OK generates the key and uses the entered password as the secondary RSA password for that key. Clicking Cancel causes key generation to fail.

Always Prompt User: every time an RSA key is generated, a secondary password for accessing this key is requested. However, the user can choose to dismiss the prompt (by clicking Cancel) and key generation will continue without using a secondary password for the generated RSA key.

Prompt on application request: this enables applications that use secondary authentication for RSA keys to make use of this feature on the eToken (when creating the key in Crypto API with a user protected flag).

Never : secondary passwords are not be created for any RSA key and the authentication method uses only the eToken password to access the key.

Manually set number of reserved RSA keys.

Set the number of reserved RSA keys to reserve space in the eToken memory. This ensures that there will always be memory available for the keys.

Change Initialization Key

The initialization key protects against accidental initialization and requires a separate password to be entered before initialization can occur

  1. If required, click Change Initialization Key.

The eToken Initialization Key window opens.

  1. Complete the fields as follows:

Use Default Initialization Key

Select to use factory-set default.

Use Specified Initialization Key

Enter the password previously configured in the This Value field below.

Change Initialization Key to:

Default: Revert to default.

Random: If selected, it will never be possible to re-initialize the eToken.

This Value: Select a password.

  1. Click OK to return to the eToken Advanced Settings window, then click OK again to return to the eToken Initialization Parameters window.

  2. Click Start.

When the initialization process is complete, a confirmation message is displayed.

Note: The Initialization process resets the password to the initial password unless this is changed in the Create User Password field.