1. Introduction
This manual serves as a guide to successfully carry out the installation process of the Bit4id Kit for the use of cryptographic cards and the procedure for accessing and using the management application. The Bit4id Kit consists of the following components:
- Bit4id Middleware: libraries that allow any Operating System application to operate with cryptographic cards.
- PKIManager-aoc: application for card management, which allows you to perform operations such as changing PIN or PUK, unblocking PIN, obtaining information about the card, importing or exporting certificates...
This manual will guide you in a simple way through the installation and use process of the Bit4id Kit.
1.1. Who is this document addressed to?
End users, who will use chip cards in MacOS environments.
2. Before you start
Make sure you have:
- A standard, PC/SC compatible card reader that is properly connected, installed, and configured. Follow the instructions provided by the reader manufacturer to verify proper installation and operation.
- The latest version of the Bit4id Kit . Link to download the latest version
- To be able to perform the installation, it is essential to have Administrator permissions . If you do not have them, the installation will be denied.
3. Installation
If necessary, you will need to download and install the drivers so that your computer recognizes the reader you have purchased. To do this, go to the official website of the reader manufacturer.
Follow the instructions provided by the reader manufacturer to verify its correct installation and operation.
If you purchase a bit4id reader, if your Mac OS version has the PCSC drivers installed by default, you will not need to download any drivers. Otherwise, you must download and install the reader drivers:
- Processors with Intel chip: https://cdn.bit4id.com/es/AOC/drivers/Bit4id_drivers_MacOS.zip .
- Processors with Apple chip: https://cdn.bit4id.com/es/AOC/drivers/Bit4id_drivers_MacOS.zip .
3.1. PKI Manager Installation Wizard
- Go to the folder where you downloaded the file and run it.
- Follow the installer steps.
- Once the PKI Manager installation is complete, restart the computer.
-
Once the restart is complete, open the application.
This is how it looks without any devices connected:
- With the application open, connect the reader to a USB port and then insert the card. You can also do this process by connecting the token to a USB port.
4. Problems during installation
You may have previous versions of the Card Management application (Bit4id PKI Manager) installed on your computer, so you will be asked to remove previous versions before running the installer. Remove these versions and run the installer again.
How to uninstall a previous version of PKI Manager?
- Open Finder
- Go to the Applications tab
- Select the application to uninstall with one click
- Go to File at the top of the screen.
- Click: Move to Trash
5. Settings in Firefox
ATTENTION: if you are using a version of Mac OS Big Sur or later you can skip this step, because in the new versions the libbit4xpki.dylib libraries are already incorporated into the system. If it does not recognize the certificates, continue.
To be able to use the certificates contained in the smart card in the Mozilla Firefox browser, it is necessary to manually incorporate some Bit4id Universal Middleware libraries.
The automated incorporation of security devices in Firefox was disabled since version 3.5 as a security measure.
- Open Mozilla Firefox, go to
→ Preferences( 
)
- In the section of
Privacy and Security, look for the certificates section and click on Security Devices
- Device Manager will open. Click Load.
- When this window opens, you need to find the PKCS#11 device driver. Click Browse… to search for it on your computer.
In the previous window, the following data must be entered:
- Module Name : Bit4id Universal Middleware
- Module file: /Applications/PKIManager-bit4id.app/Contents/Resources/etc/libbit4xpki.dylib
Then, click Accept. The module will be successfully incorporated, and the installation in Firefox will be complete.
6. Settings in Adobe Reader
ATTENTION: if you are using a version of Mac OS Big Sur or later, you can skip this step, because in the new versions the libbit4xpki.dylib library is already incorporated into the system. If it does not recognize the certificates, continue.
To be able to sign with the certificates contained in the smart card in Adobe Reader, it is necessary to manually incorporate some libraries from the Bit4id Universal Middleware.
- Open a PDF document with Adobe Reader. Then go to Tools → Certificates
- Select the Digitally Sign option.
- A pop-up window will open. Click "Set up digital ID"
- Select the first option (“ Use a signature creation device ”) and click Continue.
- Click "Manage Digital ID"
- A pop-up window will open. In the left side menu, make sure "PKCS#11 Modules and Tokens" is selected. Click "Attach Module"
- Another pop-up window will open. It asks you to enter the path to the PKCS11 library.
- Library Path: /Applications/PKIManager-bit4id.app/Contents/Resources/etc/libbit4xpki.dylib
- Verify that the bit4id PKCS#11 module has been created. Then restart Adobe Reader.
- Open Adobe and perform steps 1 and 2 again. It will show you the available certificates for the cryptographic device you have connected.
- Select the desired certificate and click Continue.
- Enter the PIN and click Sign.
7. Functionalities
The Bit4id PKI Manager application has multiple functionalities available from the main screen.
IMPORTANT: Bit4id PKI Manager comes by default with the user version. To have all its features, you must switch to the administrator version using the command: Command+A
7.1. Functionality tables
Basic functionalities:
Basic functionality table
| Function | Description |
|---|---|
| Unlock PIN | Function to unlock the card PIN. |
| Change PIN | Function to change the card PIN. |
| Change PUK | Function to change the card's PUK. |
| Login/Logout | Function to log in/out of the card. |
| Device information | Tab where we will find the description of the connected device and the card. |
| Certificates | Tab where we will find the user and CA certificates loaded on the card. |
To access the extra features you must click:
Extra features:
Extra features table
| Function | Description |
|---|---|
| Login/Logout | Log in/out of card content. |
| Refresh | Update the content of the token/card to see new certificates. |
| Change device name | Define the name under which the device appears. |
| Change PIN | Function to change the card PIN. |
| Unlock PIN | Function to unlock the card's PIN using its PUK. |
| Change PUK | Function to change the card's PUK. |
| Import certificate | Function to import a certificate to your card. |
| Erase device | Function to delete ALL certificates and keys from the card token. |
- Login
To access any functionality offered by the software, you must enter the card PIN.
- Change PIN
To change your PIN, enter your card PIN and your new PIN. The new PIN must be between 4 and 8 alphanumeric digits.
- Unlock PIN
To unblock the PIN, enter the card's PUK and the new PIN. The new PIN must be between 4 and 8 alphanumeric digits.
- Change PUK
Enter the old PUK of the card and the new PUK. The new PUK must be between 4 and 8 alphanumeric digits.
- Import
This option allows the import of certificates onto the card. The accepted formats for importing certificates onto the card are .p12 or .pfx as these formats include the private key of the certificate, essential for performing cryptographic operations.
To start the import, first select the certificate from its location, as shown in the following image:
Once the certificate is selected, press “Open”:
The system will ask you for the password of the PFX or P12 file (certificate and its private key) that you want to import, which contains your certificate and key pair. Insert it and complete the import options as you wish, where:
– Import certificates without associated key peer: allows you to import the entire certification hierarchy included in the PFX or P12 file. It is recommended that you DO NOT CHECK this option.
– Define CKA_ANDEU of PKCS#11: identifier that certain applications use when displaying the certificate. It is recommended to enter a useful identifying value, for example pedro_signature, pedro_access, pedro_encryption, etc.
And the certificate import will be complete:
In case you want to check that the certificate has been correctly saved, remember that you can review all the certificates stored on the card through the “View” option of Bit4id PKI Manager.
- Certificate details
Once the card PIN is entered, you can see the certificates included in it. In the pop-up window that the application displays, you can see information
- Card information
It offers detailed card information: model, serial number, manufacturer and label.
It is possible that support ( soporte@bit4id.com ) will request this information to know the type of card you are using.
8. Frequently asked questions
Can I combine numbers and letters for the card PIN number?
Yes, there is no problem, as long as the new PIN is between 4 and 8 digits.
Is there a maximum number of PIN entries in case I have any doubts and cannot remember my PIN number? When can the card be blocked?
If the PIN code is entered incorrectly more than 3 times, it is blocked. Follow the steps to unblock the PIN indicated in the previous point.
Is there a maximum number of PUK insertions to try to unblock the PIN? What happens if the card is blocked?
If the PUK code is entered incorrectly more than 3 times, it is blocked. For security reasons, the card is completely blocked.
9.Glossary
Certification Authority: is the trusted entity responsible for issuing and revoking electronic certificates used in electronic signatures. The Certification Authority, by itself or through the intervention of a Registration Authority, verifies the identity of the applicant for a certificate before issuing it or, in the case of certificates issued with the condition of being revoked, eliminates the revocation of the certificates by verifying this identity.
Expiration of the digital certificate: the digital certificate has a validity period that is stated on the certificate itself. It is generally 2 years, although the law allows a validity of up to 5 years. Once the certificate has expired, it will not be possible to use the services offered by the Administration that require an electronic signature, and any electronic signature made from that moment on will not be valid.
Digital certificate: document on computer media issued and signed by the Certification Authority, which guarantees the identity of its owner.
Recognized certificate: certificate issued by a Certification Service Provider that meets the requirements established in the Law regarding the verification of the identity and other circumstances of the applicants and the reliability and guarantees of the certification services they provide, in accordance with the provisions of Chapter II of Title II of Law 59/2003, of December 19, on Electronic Signatures.
Electronic signature: set of data, in electronic form, attached to other electronic data or functionally associated with them, used as a means to formally identify the author or authors of the document that contains it. There are 3 types of electronic signature: simple, advanced and recognized electronic signature.
Simple electronic signature: set of data, in electronic form, attached to other data.
Advanced electronic signature: electronic signature that allows the signer to be identified and any subsequent changes to the signed data to be detected, which is uniquely linked to the signer and to the data to which it refers and which has been created by means that the signer can maintain under their exclusive control.
Recognized electronic signature: an advanced electronic signature based on a recognized certificate and generated by a secure signature creation device is considered a recognized electronic signature. The recognized electronic signature will have the same value with respect to data recorded electronically as a handwritten signature in relation to data recorded on paper.
Hash function: it is an operation that is performed on a data set of any size, so that the result obtained is another data set of fixed size, regardless of the original size, and which has the property of being uniquely associated with the initial data, that is, it is impossible to find two different messages that generate the same result when applying the hash function.
Hash or Fingerprint: fixed-size result obtained after applying a hash function to a message and which meets the property of being uniquely associated with the initial data.
Integrity: integrity is the quality possessed by a document or file that has not been altered and that also allows verification that no manipulation has occurred in the original document.
Certificate Revocation Lists or Revoked Certificate Lists: list that contains exclusively the lists of revoked or suspended certificates (not expired ones).
Non-repudiation: the sender who electronically signs a document will not be able to deny that he sent the original message, since it is attributable to the sender through the private key that only he knows and which he is obliged to keep. Non-repudiation also allows you to verify who participated in a transaction.
Non-repudiation or non-repudiability is a security service closely related to authentication and which allows to prove the participation of the parties in a communication. The essential difference with authentication is that the former occurs between the parties establishing the communication and the non-repudiation service occurs against a third party.
Certification Service Provider or PSC: natural or legal person who issues electronic certificates or provides other services in relation to electronic signatures. See Certification Authority.
PIN: sequence of characters that allow access to certificates. Personal Identification Number, sometimes called PIN.
PUK: sequence of characters that allows the PIN to be changed or unblocked. Personal Unblocking Key.
Renewal: Renewal consists of requesting a new certificate using a valid certificate that is about to expire. In this way, before a certificate expires, renewal can be requested and this implies that a new valid certificate is issued.
Revocation: definitive cancellation of a digital certificate at the request of the subscriber, or on the initiative of the Certification Authority in case of doubt about the security of the keys. Revocation is an irreversible state. The revocation of a certificate can be requested after a suspension situation or at the will of the people authorized to request it. Similarly, in the case of a suspended certificate, if the maximum suspension period has passed, if the certificate has not been enabled, it becomes definitively revoked. When the certification body revokes or suspends a certificate, it must include it in the Certificate Revocation Lists (CRL), to make this fact public. These lists are public and must always be available.
Smart card: any card with integrated circuits that allow the execution of certain programmed logic.