Skip to main content

SecureAuth Hard Token Decrypt Tool

Applies to Identity Platform 9.2 to 19.07

Use this guide to install and use the SecureAuth Hard Token Decrypt Tool, which decrypts HID hard OATH tokens to enable their use in Multi-Factor Authentication.

The SecureAuth Hard Token Decrypt Tool can decrypt batch or single HID hard tokens, in which administrators can provision user accounts, enabling users to use their HID hard tokens. By using the Account Management (Help Desk) realm, administrators can upload HID hard token OATH Seeds to user profiles for identity validation in other SecureAuth IdP realms for access to protected resources.

Prerequisites

Install SecureAuth Hard Token Decrypt tool

  1. Go to the Support Tools page and download the SecureAuth Hard Token Decrypt Tool and save it to any Windows computer.

  2. Run the SecureAuth-Decrypt-Seed-1.0.5.exe file to install and set up the tool.

  3. Click Next.

    44826937.png

  4. Select the location of the SecureAuth Decrypt Seed and click Next.

    The path is hardcoded; however, distinct drives can be selected.

    44826938.png

  5. Confirm the settings and click Install.

    44826939.png

  6. Wait for the installer to complete.

    44826940.png

  7. Once the installation is complete, click Finish.

    44826941.png

Decrypting HID hard tokens

The Decrypt Tool has the following decryption options:

  • Batch – Package of HID hard tokens, up to 25 at a time (use command-line tool)

  • Single – One HID hard token at a time (use command-line tool)

  • Online – Go to a website that enables single decryption of a HID hard token (no command-line tool)

Batch decryption of multiple HID hard tokens (command-line)

  1. Upload the HID token package (.pskc file) to the DecryptSeed folder.

    The batch command decrypts one package at a time.

  2. At the command prompt, cd to the \SecureAuth\DecryptSeed folder.

  3. Run the DecryptSeed command, using the following values:

    Code syntax:

    DecryptSeed.cmd /k <32 char Hex Key> /i <PSKC input file name> /o <CSV output file name>

    Code example:

    DecryptSeed.cmd /k 993E183A58C1287BE4E8FC3555C8438C /i 0654150_0000000794.pskc /o decryptedseeds.csv

    • Replace <32 char Hex Key> with the secret key of the HID package (for all tokens)

    • Replace <PSKC input file name> with the file name of the HID token package (.pskc)

    • Replace <CSV output file name> with the name of the existing or new output CSV file. Take note that if a file exists, the data is appended to the existing file.

  4. In the DecryptSeed folder, locate the CSV output, which contains the serial numbers for the HID hard tokens with the decrypted OATH Seed value. (Serial numbers are located on the back of each HID hard token.)

Single decryption of a HID hard token (command-line)

  1. Upload the HID hard token package (.pskc file) to the DecryptSeed folder.

  2. At the command prompt, cd to the \SecureAuth\DecryptSeed folder.

  3. Run the DecryptSeed command, using the following values:

    Code syntax:

    DecryptSeed.cmd /s <Cipher Value of Seed> /k <32 char Hex Key>

    Code example:

    DecryptSeed.cmd /s JYqUGPV7OEtnRULGzyVk5rU6V4reCOiwx8c+PkcTXFaIeFpCrSvJeq9rVNVGi88a /k 993E183A58C1287BE4E8FC3555C8438C

    • Replace <Cipher Value of Seed> with the cipher value of the single HID hard token, obtained from the HID token package file

    • Replace <32 char Hex Key> with the secret key of the HID package (for all tokens)

  4. In the command line, view the decrypted OATH Seed value.

Next steps

Provision and assign HID hard tokens to user profiles

In this section: