topic Smartcard FDE pre-boot authentication in Endpoint

Smartcard FDE pre-boot authentication

Tom_Heesmans — Mon, 16 Jul 2018 08:31:05 GMT

Hi guys,

Does anyone have experience with using a smartcard to unlock the pre-boot of Sandblast FDE?

I've enabled the feature in the end-point console, when entering my smartcard it switches the login screen to enter my PIN. However when I enter the PIN it does not unlock.

The smartcard has a user certificate on it to authenticate on Windows, which is working fine.

I don't have that much experience with smartcards and CheckPoint so I was wondering if I need a specific certificate (like EFS) or that any of you have any experience using this.

I would also think that the driver is correct because it switches to the PIN and when I use another type of smartcard it does not switch, so cannot read the smartcard.

Any help would be appreciated!

Re: Smartcard FDE pre-boot authentication

PhoneBoy — Mon, 16 Jul 2018 14:14:06 GMT

In older versions (ones no longer supported), there was a bug with PINs of a certain length.

Not sure that's still relevant.

It's probably a good idea to involve the TAC in this.

Re: Smartcard FDE pre-boot authentication

Tom_Heesmans — Mon, 16 Jul 2018 14:18:36 GMT

Thanks for the response, this however is not an older version and the pin is only 4 digits in lenght for testing.

We'll probably need TAC but I have some great experiences with this community and was hoping for the small simple remark that will point is in the right direction. My guess is that this is something simple that we are overlooking.

Re: Smartcard FDE pre-boot authentication

PhoneBoy — Mon, 16 Jul 2018 15:32:18 GMT

I'll see if I can get an expert in this area to comment

Re: Smartcard FDE pre-boot authentication

KatiaCruz — Wed, 11 Nov 2020 03:46:19 GMT

@Tom_Heesmans, I just found your post and I'm wondering how you resolved the issue described.

After switching from password to smartcard authentication in the FDE preboot today, I get an "Invalid Logon" message in the client, and a "No Smartcard users configured" in the logs on the management. I did some testing and my scenario matches your description.

I know it has been a while, but I'll appreciate it if you can share anything you remember. 🙂

Re: Smartcard FDE pre-boot authentication

Tom_Heesmans — Wed, 11 Nov 2020 08:03:56 GMT

For us this eventually came down to an incompatible driver for the smartcard reader. It should have been compatible according to the documentation but after examination from dev-ops this was not the case. Our smartcard readers where from Thales (formaly Gemalto) and CheckPoint collaborated with them to integrate the correct driver. Everything is working as expected now.

Re: Smartcard FDE pre-boot authentication

KatiaCruz — Wed, 11 Nov 2020 17:22:07 GMT

Good to know, @Tom_Heesmans. I will double-check if the smartcard reader driver is the right one in my case. We ended up using a generic one from the list provided during configuration.

Thanks for your response!