Devices

This action enables you to reset the PIN in case it is forgotten or when reassigning a token to a new user.

To unblock the PIN for any connected token, click the Unblock PIN action link in the token's interface in the Devices view, or click the kebab menu button in the top-right corner of that token's interface. (You do not need to have the token selected to perform this action.)

To unblock the PIN:

1. Select the available authentication data to unblock the token:

   • Management Key

     A hexadecimal string of 32 characters (AES Advanced Encryption Standard. A symmetric key encryption algorithm established by the U.S. National Institute of Standards and Technology (NIST).-128 encryption) or 48 characters (TDES Triple Data Encryption Standard. An encryption algorithm that uses three separate keys for encryption, providing a higher level of security than its predecessor, the Data Encryption Standard (DES). encryption). For devices in their default state, the management key consists of all zeroes.

     Check the default checkbox to enter the default management key.

     

   • Unblock Code (PUK)

     If a PUK PIN Unblock Key. A code used to reset the personal identification number (PIN) in devices after they have been locked due to multiple incorrect PIN entries. has been configured, it can be used here for unblocking. If no PUK has been set up, this method is not available.

     

   • Challenge & Response

     A challenge Random number generated by the server API for authentication of a user in the asynchronous (challenge/response) mode. string is generated, which has to be encrypted by the administrator using the management key. The resulting output, known as the response, is then entered into the Response field. This method ensures that the management key does not need to be disclosed to the user.

     

2. Insert the new PIN and confirm by entering it into the Confirm PIN field.
3. Click Submit to change the PIN.

If you enter the wrong PIN too many times, your token will lock and a PUK PIN Unblock Key. A code used to reset the personal identification number (PIN) in devices after they have been locked due to multiple incorrect PIN entries. is required to unlock it.

If no PUK has been set for the token, you can configure one. You can also view, change, or delete an existing PUK if needed.

Configure a New PUK

1. Navigate to the Devices view and click the kebab menu button in the top-right corner of the token's interface. (You do not need to have the token selected to perform this action.)

2. Select Configure PUK.

   

3. Enter the PUK value (an 8-digit decimal or a 16-digit hexadecimal number) in the New PUK field or use the Generate button to generate a new hexadecimal PUK.

   

4. Click Set to set the new PUK.

View PUK

1. Navigate to the Devices view and click the kebab menu button in the top-right corner of the token's interface. (You do not need to have the token selected to perform this action.)

2. Select View PUK if available, or select Manage PUK and in the Select Action dropdown, select View PUK.

   

3. The current PUK will be displayed, allowing you to copy it.

Change PUK

1. Navigate to the Devices view and click the kebab menu button in the top-right corner of the token's interface. (You do not need to have the token selected to perform this action.)

2. Select Manage PUK.

   

3. In the Select Action dropdown, leave Configure PUK selected.

   

4. Enter the PUK value (an 8-digit decimal or a 16-digit hexadecimal number) in the New PUK field or use the Generate button to generate a new hexadecimal PUK.

5. Click Set to set the new PUK.

Delete PUK

1. Navigate to the Devices view and click the kebab menu button in the top-right corner of the token's interface. (You do not need to have the token selected to perform this action.)

2. Select Manage PUK.

   

3. In the Select Action dropdown, select Delete PUK and then click the Delete button.

   

To update the management key A cryptographic key used to control and manage secure operations on a token, such as configuring, updating, or modifying sensitive data. used by your device, navigate to the Devices view and click the kebab menu button in the top-right corner of the token's interface. (You do not need to have the token selected to perform this action.).

Follow these steps to change the management key:

1. Select the authentication method for authorizing the management key change (by PIN or by the management key).

   • If you are already authenticated to the device, you will not be prompted to authorize the key change in the last step.

   • If you selected to authenticate with PIN, see point 3.

2. If you selected to authenticate with the management key, enter the current management key in the provided Old Management Key field. If you are using the default key, select the default checkbox.
3. Enter the New Management Key you wish to set. For enhanced security, you can select:
   • Random AES Advanced Encryption Standard. A symmetric key encryption algorithm established by the U.S. National Institute of Standards and Technology (NIST). key to generate a new, random AES key.
   • Random TDES Triple Data Encryption Standard. An encryption algorithm that uses three separate keys for encryption, providing a higher level of security than its predecessor, the Data Encryption Standard (DES). key to generate a new, random TDES key.
4. Click Change Key to finalize the action.

To access Update PIN Policies, navigate to the Devices view and click the kebab menu button in the top-right corner of the token's interface.

This feature allows you to view and update the current PIN policies set for your token. These policies may vary depending on the device type and profile.

Pin Policy Options

• Min/Max PIN Length: Specify the minimum and maximum PIN length.

• PIN Format: Choose whether the PIN can include both letters and numbers (alphanumeric format) or numbers only (numeric format).

• Force PIN Change: When enabled, the token will not allow the user to perform any action until the PIN is changed. Whenever such a token is inserted, Crescendo Manager will display a warning requiring PIN change.

  

  Note: This PIN policy only affects Crescendo 4000 family devices. For the Crescendo 2300 family, setting the Force PIN Change policy will only result in a prompt being displayed and will not impact token usage.

• Challenge Type: Select between static or dynamic mode.

  • In static mode, the challenge is fixed (3031323334353637 (TDES Triple Data Encryption Standard. An encryption algorithm that uses three separate keys for encryption, providing a higher level of security than its predecessor, the Data Encryption Standard (DES).) or 303132333435363738393A3B3C3D3E3F (AES Advanced Encryption Standard. A symmetric key encryption algorithm established by the U.S. National Institute of Standards and Technology (NIST).).

  Note: The Static option has been deprecated since the introduction of the Crescendo 4000 family.

  • In dynamic mode, the challenge is generated randomly each time.

• Weak PIN A PIN in which the difference between each character or digit and the following one is a constant. For example, a PIN that is a sequence of the same number or character, or an increasing/decreasing sequence of numbers or characters (1234, 4321, 86420, ABCD, acegik, etc.) is a weak PIN. Control: If this policy is enabled, Crescendo Manager and other Crescendo family tools will not allow the user to select a PIN that is overly simple.

  Note: This policy is enforced by the software only; therefore, a weak PIN may still be set using, e.g., the APDU Access tool.

• FIDO Fast IDentity Online. A security standard used for online authentication, based on a cryptographic key pair unique to each online service. For more information, visit https://fidoalliance.org/how-fido-works/ Shared PIN: If this policy is enabled, any changes to the token PIN will also update the FIDO PIN, and vice versa. If disabled, the FIDO and token PINs remain separate.

  Note: This policy is available only for the Crescendo 4000 family and can only be set during the Personalize action.
  Note: If the FIDO Shared PIN policy is set to Disabled, the FIDO PIN can only be set or changed within Crescendo Manager using the APDU Access tool.
  Tip! To learn more about using Crescendo FIDO, visit the HID Crescendo FIDO webpage.

For enhanced performance, Crescendo Manager internally caches the state of the connected tokens (including token properties, certificates, keys, OTPs, etc.).

Additionally, since Crescendo Manager communicates with devices via Crescendo Minidrivers (one for the Crescendo 2300 family and one for the Crescendo 4000 family), these components also create cache externally to Crescendo Manager.

This action clears both the Minidriver and Crescendo Manager caches for the selected token. This is particularly useful in rare instances when the device's internal state (cache), as recorded by Crescendo Manager, becomes invalid due to external programs communicating with the device or because of an internal error. The Clear Cache functionality is designed to resolve such inconsistencies by reloading the device state.

To clear a token's caches:

1. Navigate to the Devices view and click the kebab menu button in the top-right corner of the token's interface.

2. Click Clear Cache.

3. The caches for the selected token will be cleared.