The Bat! Professional

The Bat! Professional is an email client which offers secure authentication on POP3/SMTP servers using tokens and transparent, on-the-fly encryption of the message base, address books and configuration files.

On-The-Fly Encryption ID

The ID is a small record that is used as a key for transparent, on-the-fly encryption of The Bat! operations. Each ID consists of three components: a 128-bit encryption key, a distinctive User Name and a textual Description. The IDs are stored on tokens and retrieved from the tokens by The Bat! at start-up. The IDs may also be archived by the Security Officer in the Token Manager ID store file.

The Token Manager

The Bat! Token Manager is a tool with which the Security Officer can create new IDs, browse tokens for existing IDs, store IDs in the ID store file, copy IDs from the ID store file to a token and vice versa.

The Role of The Security Officer

The Security Officer uses the Token Manager to create IDs for each The Bat! user, e.g. for each person using the The Bat! software on a given computer. The IDs are initially created in the Token Manager ID store file. The Security Officer copies the IDs from the ID store file to the tokens and distributes the tokens to the users. As new users follow, the Security Officer creates new IDs in the ID store file and copies the IDs to fresh tokens, so each new user will receive a new token already containing his particular ID.

In some cases, a System Administrator can take the role of the Security Officer. If used in an environment with a single computer (e.g. home computer), the role of the Security Officer falls to the user.

Assigning the ID

During the first run since the istallation, The Bat! prompts the user to assign an ID from a token to the newly installed copy. Once installed, The Bat! is permanently tied to the User Name of a specific ID, and it is not possible to reassign another ID to the existing The Bat!. The 128-bit encryption key from the assigned ID is used for on-the-fly encryption of The Bat! operations.

Installing The Bat! with On-The-Fly Encryption

The Security Officer does not need to install each copy of The Bat! - all installation steps can be easily performed by the users. During the installation, a user assigns an ID to The Bat! and this ID will be used for all The Bat! operations. To assign an ID, the user should first select a token and then choose an ID stored on that token. After this assignment has been made, the installation continues.

Selecting a Token

Once the user runs the installer, a window appears that prompts the user to Select Token. The window displays a list of all inserted tokens.

In most cases, only one token is inserted, however, the window shows the serial number and the friendly name for each currently inserted token. It helps to more clearly identify the required token and avoid confusion when an inappropriate token has been inserted by accident.

Selecting an ID from a Token

When the user has selected a token from the list, The Bat! displays all of the IDs that were copied to the selected token by the Security Officer. The User Name and the Description of each ID are listed. Please note that the token must contain at least one ID.

Whichever ID is selected is then used to continue the installation. It is extremely important to understand that it is not possible to reassign another ID to the The Bat! after this point so double check carefully when selecting an ID.

Running The Bat!

When the user starts The Bat!, the program looks for the token that contains the assigned ID, reads the ID from the token, and uses the 128-bit encryption key from that ID for on-the-fly encryption of the message base, address books and configuration files. Make sure that the token is plugged in while working with The Bat!. Once the token is unplugged, The Bat! hides all its windows and prompts the user, asking whether they want to exit (loosing changes) or to plug the token back and continue working with The Bat!. The user may, however, use this feature as an emergency exit from The Bat!

The Token Manager ID Store

The Token Manager ID store file keeps the archive of The Bat! IDs. The reason that such an archive is needed is that an ID is the only key to the The Bat! information (message base, address books and configuration files). If the IDs had been stored only on tokens, and the token has been lost or broken, the entire The Bat! information will have been lost. The ID store file prevents such disasters.

The IDs in the ID store file are protected by a password, which is referred to as the Master Password. The ID store file is encrypted with a 128-bit symmetric key derived from the Master Password according to PKCS#12 password privacy mode.

It is very important to provide adequate security on the computer where the Token Manager is installed and the ID store file is kept. Also take proper steps to prevent unauthorized access to this computer and any invasion by viral infections, "spy"-software and other malicious programs which could affect the security of the ID store file or the Master Password.

To backup the ID store file, make sure that the Token Manager is not running and copy the TokenMgr.pfx file to a diskette or other media. Make sure that the copy is kept in a safe place. The Token Manager does not provide any special means of synchronizing the ID store file with the backup, so if you add new IDs to the database, simply overwrite the backup-copy of the TokenMgr.pfx file. The Security Officer can also backup the ID store file by copying all the IDs from the ID store file to a token by using the Copy ID to Token button when the Token Manager is running.

To restore the ID store file from the backup, make sure that the Token Manager is not running and simply copy the TokenMgr.pfx file from the backup media, overwriting the existing TokenMgr.pfx file. The Security Officer can also restore the IDs by copying IDs from one or many different tokens to the ID store file by using the Copy ID to Disk button when the Token Manager is running.

The Token Manager Master Password

The Token Manager Master Password is used to protect IDs in the Token Manager ID store file by encrypting the information with a 128-bit symmetric key derived from the Master Password. Please note that the Master Password does not apply to the IDs which are stored on the tokens, since a token has own means of protection: the PIN.

The Security Officer sets the Master Password when running the Token Manager for the first time.

Running The Token Manager

During the very first run of the Token Manager the Security Officer will need to enter a new Master Password and to confirm it by typing it again.

When running the Token Manager subsequently, the Security Officer will be prompted for the current Master Password.