﻿Aihood Witness -- IAEP user activation kit (Windows)

=======================================================



This is the kit you run to bind a PUFcse dongle to YOUR account and

generate your own personal signing key. Someone else (the "factory" step)

must have already provisioned this specific dongle before you got it --

if you run this against one that hasn't been, it will tell you so and

refuse to continue.



This kit carries no secrets -- unlike the factory kit, there is nothing

sensitive in this zip. Safe to keep, forward, or re-run at any time.



This kit has two commands, run in order -- double-click each one directly

in File Explorer (or run from a Command Prompt/PowerShell window if you

prefer):



    install.bat               one-time (or re-run-after-update) setup so

                               Chrome can find and launch the Mode 4

                               native host at all.

    Activate Dongle shortcut  binds THIS dongle to YOUR account.



install.bat opens a console window and waits for a keypress at the end

before closing, so you can read its output. The Activate Dongle shortcut

opens its own window directly -- no console involved -- and closes itself

when you're done.



They're separate because they don't share a lifecycle: install.bat only

needs re-running on a new machine, after reinstalling Windows, or when a

newer version of this kit ships an updated native host -- never because of

anything to do with a specific dongle. The Activate Dongle shortcut only

needs re-running per dongle (once each, normally) and never touches

anything install.bat set up. Re-running either one is always safe and

never disturbs the other.



What install.bat does

------------------------



Copies the bundled native host program to a permanent location on this

machine (%LOCALAPPDATA%\AihoodWitness -- not left pointing at wherever you

unzipped this kit; deleting or moving this folder later, once install.bat

has run, will NOT break Mode 4), and registers it with Chrome, Chromium,

and Microsoft Edge via the Windows registry so they can find and launch

it. Built for: windows-x64. This exact build only runs on that

architecture -- ask whoever sent you this kit for a different build if

your machine doesn't match.



What the Activate Dongle shortcut does

-----------------------------------------



1. Unlocks the dongle with its current PIN (the factory default unless

   someone already activated it before), then lets you set your own PIN

   only you will know.

2. Logs you in with your email (a one-time code sent to that address),

   proves the dongle is physically present, and gets your account bound

   to it by the Aihood Registry.

3. Generates your own personal signing key on the dongle itself -- the

   device issues its own certificate for that key, and this tool

   registers it with the Registry.



Nothing here modifies the dongle's underlying hardware identity (its DIK)

or its device certificate -- those were already finished by the factory

step, and this tool only ever reads them to prove the dongle is genuine.



A note on Windows SmartScreen

--------------------------------



Neither .exe in this kit is code-signed, so Windows may show "Windows

protected your PC" the first time you run install.bat or the Activate

Dongle shortcut. Click "More info", then "Run anyway" -- this is expected

for an unsigned/uncommon executable, not a sign anything is wrong.



Plug in the dongle first before using the Activate Dongle shortcut. It

auto-detects the device. Your PIN is always asked interactively (never as

a command-line flag, so it never lands in your command history). Safe to

re-run any time, including after an interrupted step (e.g. no network, a

missed button press, a wrong OTP code) -- every step checks the dongle's

and the Registry's own actual state and skips itself if already done.