Rutoken pin by default. Token PIN: password with special rules

Tokens, electronic keys for accessing important information, are becoming increasingly popular in Russia. A token is now not only a means of authentication in a computer operating system, but also a convenient device for storing and presenting personal information: encryption keys, certificates, licenses, identifications. Tokens are more reliable than the standard “login/password” pair due to the two-factor identification mechanism: that is, the user must not only have a storage medium (the token itself), but also know the PIN code.

There are three main form factors in which tokens are issued: USB token, smart card and key fob. PIN code protection is most often found in USB tokens, although recent models of USB tokens are available with the ability to install an RFID tag and with an LCD display for generating one-time passwords.

Let’s take a closer look at the principles of operation of tokens with a PIN code. A PIN code is a specially defined password that splits the authentication procedure into two stages: attaching a token to the computer and entering the PIN code itself.

The most popular token models on the modern Russian electronic market are Rutoken, eToken from the Aladdin company, and an electronic key from the Aktiv company. Let's look at the most frequently asked questions regarding PIN codes for tokens using the example of tokens from these manufacturers.

1. What is the default PIN?

The table below provides information about the default PIN codes for Rutoken and eToken tokens. The default password is different for different owner levels.

2. Do I need to change the default PIN? If yes, then at what point in working with the token?

3. What should I do if the PIN codes on the token are unknown and the default PIN code has already been reset?

The only way out is to completely clear (format) the token.

4. What should I do if the user's PIN is blocked?

You can unlock the user's PIN through the token control panel. To perform this operation, you must know the administrator PIN.

5. What should I do if the administrator PIN is blocked?

The administrator PIN cannot be unlocked. The only way out is to completely clear (format) the token.

6. What security measures have manufacturers taken to reduce the risk of password guessing?

The main points of the security policy for PIN codes of USB tokens of the Aladdin and Aktiv companies are presented in the table below. After analyzing the table data, we can conclude that eToken will presumably have a more secure PIN code. Rutoken, although it allows you to set a password of just one character, which is unsafe, in other respects it is not inferior to the product of the Aladdin company.

The importance of keeping the PIN code secret is known to all those who use tokens for personal purposes, store their electronic signature on it, and trust the electronic key with information of not only a personal nature, but also the details of their business projects. Tokens of the companies “Aladdin” and “Active” have pre-installed security properties and, together with a certain amount of caution that will be exercised by the user, reduce the risk of password guessing to a minimum.

Rutoken and eToken software products are presented in various configurations and form factors. The offered assortment will allow you to choose exactly the token model that best meets your requirements, be it

In order to check the readiness of the Rutoken key identifier for configuration for working with EGAIS, open the "Rutoken Control Panel" - the "Administration" tab - the "Information" button - and check the status opposite the "Microsoft Base Smart Card Crypto Provider" field:

• Supported

This status means that the Rutoken electronic identifier is already ready to be configured by the default crypto provider. Go to the second point of this instruction - “Changing the default crypto provider”

If the status is Supported, go to

If the status next to the "Microsoft Base Smart Card Crypto Provider" field is Activate or Not supported, go to point 2.

2. Enabling crypto provider support for Rutoken digital signature

To check the readiness of the Rutoken key identifier for configuration for working with EGAIS, open the "Rutoken Control Panel" - the "Administration" tab - the "Information" button - and check the status opposite the "Microsoft Base Smart Card Crypto Provider" field:

• Activate

If the User or Administrator has a non-default PIN, it will be required to be entered during activation.

Please note that if both PIN codes do not correspond to the default values, for activation you will need to enter the Administrator PIN code, then the User PIN code successively.

If one or both PINs are unknown, you will need to contact the company that provided you with the Key ID to obtain the PINs.

If it is not possible to find out the current PIN code values, the only option left is to format the Rutoken identifier to set new PIN code values. Please note that when formatting a key ID, all content is permanently deleted.

After the activation procedure, the status in the "Microsoft Base Smart Card Crypto Provider" field should change to "Supported"

To continue setting up the Rutoken key identifier, go to Step 2.

• Not supported

The "Not supported" status is displayed if an attempt is made to configure a Rutoken model that is not intended to work with EGAIS, for example or. Only the model is suitable for working with EGAIS

3. Change the default crypto provider

Open "Start" - ("Settings") - "Control Panel" - "Rutoken Control Panel" - "Settings" tab - in the "Crypto provider settings" item, click the "Settings..." button

In the "Crypto Provider Settings" window, for the electronic identifier Rutoken EDS 2.0 you need to select "Microsoft Base Smart Card Provider".

If your computer will generate an RSA key pair, set Microsoft Enhanced RSA and AES Cryptographic Provider in the lower field

To save changes, click "OK".

4. Setting up a workplace for working with the EGAIS portal.

Smart cards Rutoken and Rutoken Light are used as carriers of key information. Detailed information about these media can be found on the website of the Aktiv company, a developer of Russian authentication tools.

Rutoken Rutoken Light

Standard pin codes

12345678 - custom PIN code for Rutoken and Rutoken Light, set by the manufacturer.

When a window appears asking you to enter a PIN code, you must enter the value 12345678.

For the Rutoken carrier, if the standard PIN code (12345678) was independently changed using the “Rutoken Control Panel”, then in this window you should indicate the new PIN code assigned during the change. Information about the new PIN code is stored only by the subscriber and is not known to the special communications operator.

How to unlock Rutoken PIN code?

The PIN code is blocked after 10 incorrect entry attempts.

You can unlock Rutoken or Rutoken Light in 2 ways:

How to Unblock PIN via Rutoken control panel

1. Open the “Start” menu > “Control Panel” > “ Rutoken control panel" Go to the “Administration” tab and click on the “Enter PIN code” button, select the item “Administrator”, enter the standard PIN od - 87654321, click OK.

2. After entering the administrator PIN, the “Unblock” button will become available, you need to click on it, a message will appear about successful unlocking.

How to unlock a pin code viaCrypto Pro CSP

1. Open the Start menu > Control Panel > Crypto Pro CSP. Go to the “Hardware” tab and click on the “Configure media types” button.

2. Select Rutoken or Rutoken Lite and click on the “Properties” button. If such media are not in the list, you should update the support module. To do this, it is recommended to use the Diagnostics service.

3. Go to the “Information” tab and click the “Unblock PIN” button. If the Information tab is missing, you should update the support module. To do this, it is recommended to use the Diagnostics service.

The Unblock PIN button will be grayed out if the smart card is not locked. In this case, information about the remaining number of attempts to enter the PIN code will be displayed.

4. A message indicating successful unlocking will appear.

It is impossible to unlock the admin pin code without losing data.

Smart cards Rutoken (see Fig. 1) and Rutoken Lite (see Fig. 2) are used as carriers of key information. Detailed information about these media can be found on the website of the Aktiv company, a developer of Russian authentication tools.

Rice. 1. Rutoken Rice. 2. Rutoken Lite

Standard pin codes

12345678 - custom PIN code for Rutoken and Rutoken Lite, set by the manufacturer.

When a window appears asking you to enter a pin code (see Fig. 3), you must specify the value 12345678 . For ease of use, check the box Remember pin code.

Rice. 1. PIN code entry window

For Rutoken carrier! If the standard pin code (12345678) was independently changed using the Rutoken Control Panel, then in this window you should indicate the new pin code assigned during the change. Information about the new PIN code is stored only by the subscriber and is not known to the special communications operator.

How to unlock Rutoken pin code?

The PIN code is blocked after 10 incorrect entry attempts.

In order to unlock Rutoken or Rutoken Lite, you should:

1. Open menu Start / Control Panel / Crypto Pro CSP. Go to tab Equipment and press the button Configure media types(see Fig. 4).

Rice. 4. Setting up equipment in Crypto Pro CSP

2. Select Rutoken or Rutoken Lite and click on the button Properties(see Fig. 5).

If there are no such media in the list, then you should update the support module. To do this, it is recommended to use the service Diagnostics .

Rice. 5. Selecting a smart card

3. Go to tab Information and press the button Unblock PIN(see Fig. 6).

If tab Information is missing, you should update the support module. To do this, it is recommended to use the service Diagnostics .

Rice. 6. Unlocking Rutoken and Rutoken Lite

Button Unblock PIN will be inactive if the smart card is not locked. In this case, information about the remaining number of attempts to enter the PIN code will be displayed.

4. A message indicating successful unlocking will appear (see Figure 7).

Rice. 7. Unlock message

It is impossible to unlock the admin pin code without losing data.