Symantec™ Encryption Desktop for Windows User's Guide
Total Page:16
File Type:pdf, Size:1020Kb
Symantec™ Encryption Desktop for Windows User's Guide 10.3 The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Version 10.3.2. Last updated: January 2014. Legal Notice Copyright (c) 2014 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, Norton Zone, PGP, Pretty Good Privacy, and the PGP logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Java is a registered trademark of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. This Symantec product may contain third party software for which Symantec is required to provide attribution to the third party ("Third Party Programs"). Some of the Third Party Programs are available under open source or free software licenses. The License Agreement accompanying the Licensed Software does not alter any rights or obligations you may have under those open source or free software licenses. For more information on the Third Party Programs, please see the Third Party Notice document for this Symantec product that may be available at http://www.symantec.com/about/profile/policies/eulas/, the Third Party Legal Notice Appendix that may be included with this Documentation and/or Third Party Legal Notice ReadMe File that may accompany this Symantec product. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED"AS IS"AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19 "Commercial Computer Software - Restricted Rights" and DFARS 227.7202, et seq. “Commercial Computer Software and Commercial Computer Software Documentation”, as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement. Symantec Corporation 350 Ellis Street Mountain View, CA 94043 Symantec Home Page (http://www.symantec.com) Contents About Symantec Encryption Desktop 10.3 for Windows 1 What's New in Symantec Encryption Desktop Version 10.3 for Windows 1 Using this Guide 3 “Managed” versus “Unmanaged” Users 3 Conventions Used in This Guide 4 Who Should Read This Document 5 About Symantec Encryption Desktop Licensing 5 Licensing Symantec Encryption Desktop for Windows 6 Checking License Details 6 If Your License has Expired 7 Technical Support 8 Contacting Technical Support 9 Licensing and registration 9 Customer service 9 Support agreement resources 10 Symantec Encryption Desktop Basics 11 Symantec Encryption Desktop Terminology 11 Product Components 11 Terms Used in Symantec Encryption Desktop 12 Conventional and Public Key Cryptography 13 Using Symantec Encryption Desktop for the First Time 14 Installing Symantec Encryption Desktop 17 Before You Install 17 System Requirements 17 Terminal Services Compatibility 19 Installing and Configuring Symantec Encryption Desktop 19 Installing the Software 20 Upgrading the Software 20 Licensing Symantec Encryption Desktop 22 Running the Setup Assistant 22 Uninstalling Symantec Encryption Desktop 22 Moving Your Symantec Encryption Desktop Installation from One Computer to Another 23 The Symantec Encryption Desktop User Interface 25 Accessing Symantec Encryption Desktop Features 25 The Symantec Encryption Desktop Main Screen 26 Using the PGP Tray Icon 27 Using Shortcut Menus in Windows Explorer 28 Using the Start Menu 30 Notifier alerts 30 Notifications on Windows 8/8.1 systems 30 Notifier for Messaging 30 Notifier for Disk features 32 ii Contents Enabling or Disabling Notifiers 33 Viewing the PGP Log 34 Working with PGP Keys 37 Viewing Keys 37 Creating a Keypair 38 Passwords and Passphrases 40 Protecting Your Private Key 40 Protecting Keys and Keyrings 41 Backing up Your Private Key 42 What if You Lose Your Key? 42 Distributing Your Public Key 42 Placing Your Public Key on a Keyserver 43 Including Your Public Key in an Email Message 44 Exporting Your Public Key to a File 44 Copying from a Smart Card Directly to Someone’s Keyring 45 Getting the Public Keys of Others 45 Getting Public Keys from a Keyserver 45 Getting Public Keys from Email Messages 46 Working with Keyservers 46 Using Master Keys 47 Adding Keys to the Master Key List 48 Deleting Keys from the Master Key List 48 Managing PGP Keys 49 Examining and Setting Key Properties 49 Working With Photographic IDs 50 Managing User Names and Email Addresses on a Key 51 Importing Keys and X.509 Certificates 52 Using the Import Certificate Assistant 52 Importing X.509 Certificates Included in S/MIME Email Messages 54 Changing Your Passphrase 54 Deleting Keys, User IDs, and Signatures 54 Disabling and Enabling Public Keys 55 Verifying a Public Key 56 Signing a Public Key 57 Revoking Your Signature from a Public Key 58 Granting Trust for Key Validations 59 Working with Subkeys 59 Using Separate Subkeys 60 Viewing Subkeys 61 Creating New Subkeys 61 Specifying Key Usage for Subkeys 62 Revoking Subkeys 63 Removing Subkeys 63 Working with ADKs 63 Adding an ADK to a Keypair 63 Updating an ADK 64 Removing an ADK 64 Working with Revokers 65 Appointing a Designated Revoker 65 Contents iii Revoking a Key 65 Splitting and Rejoining Keys 66 Creating a Split Key 66 Rejoining Split Keys 67 If You Lost Your Key or Passphrase 69 Reconstructing Keys with Symantec Encryption Server 69 Creating Key Reconstruction Data 70 Reconstructing Your Key if You Lost Your Key or Passphrase 71 Protecting Your Keys 72 Securing Email Messages 73 How Symantec Encryption Desktop Secures Email Messages 73 Incoming Messages 74 Verifying Signatures on Incoming Messages 75 Understanding Annotations on Incoming Messages 76 Outgoing Messages 77 Securing Sent Items on IMAP Email Servers 77 Sending MAPI Email with Microsoft Outlook 77 Using the Sign and Encrypt Buttons in Microsoft Outlook 78 Using Offline Policy 79 Services and Policies 80 Viewing Services and Policies 81 Creating a New Messaging Service 82 Editing Messaging Service Properties 85 Disabling or Enabling a Service 85 Deleting a Service 86 Multiple Services 86 Troubleshooting PGP Messaging Services 86 Creating a New Security Policy 88 Regular Expressions in Policies 92 Security Policy Information and Examples 93 Working with the Security Policy List 97 Editing a Security Policy 97 Editing a Mailing List Policy 98 Deleting a Security Policy 101 Changing the Order of Policies in the List 102 Symantec Encryption Desktop and SSL 102 Key Modes 104 Determining Key Mode 105 Changing Key Mode 105 Encoding Formats 106 Viewing the PGP Log 106 Viewing Email with PGP Viewer 109 Overview of PGP Viewer 109 Compatible Email Clients 110 Opening an Encrypted Email Message or File 110 Copying Email Messages to Your Inbox 111 Exporting Email Messages 111 Specifying Additional Options 112 Specifying Options in PGP Viewer 112 iv Contents Security Features in PGP Viewer 113 Protecting Disks with Symantec Drive Encryption 115 About Symantec Drive Encryption 116 How does Symantec Drive Encryption Differ from PGP Virtual Disk? 117 Licensing Symantec Drive Encryption 117 Prepare Your Disk for Encryption 118 Supported Disk Types 119 Supported Keyboards 121 Supported Input Method Editors (IME) 123 Ensure Disk Health Before Encryption 123 How to Determine if Your Windows System is Running in UEFI Mode 123 Calculate the Encryption Duration 124 Maintain Power Throughout Encryption 124 Run a Pilot Test to Ensure Software Compatibility 125 Determining the Authentication Method for the Disk 125 Passphrase and Single Sign-On Authentication 126 Public Key Authentication 126 Token-Based Authentication 126 Trusted Platform Module (TPM) Authentication 127 Setting Encryption Options 128 Partition-Level Encryption 128 Preparing a Smart Card or Token to Use For Authentication 129 Using Symantec Drive Encryption Options 132 Encrypting a Disk or Partition 132 Supported Characters for Symantec Drive Encryption Passphrases 133 Encrypting the Disk 134 Encountering Disk Errors During Encryption 136 Using a Symantec Drive Encryption-Encrypted Disk 137 Authenticating at the PGP BootGuard Screen 137 Selecting Keyboard Layouts 142 Using Symantec Drive Encryption Single Sign-On 144 Prerequisites for Using Single Sign-On 145 Encrypting the Disk to Use Single Sign-On 145 Using the 'Fast Startup' Option with Single Sign-On on Windows 8/8.1 146 Multiple Users and Single Sign-On 146 Logging in with Single Sign-On 146 Changing Your Passphrase With Single Sign-On 147 Displaying the Windows Login dialog box 147 Maintaining the Security of Your Disk 148 Getting