Generate a TrueCrypt key and transfer to Security Token

TrueCrypt does not use the smarcard embedded crypto engine to generate a key.
You need to generate the key on computer and then transfer it to smartcard / security token.

Generate TrueCrypt key on computer

In the Tools menu, select Keyfile Generator:

Generate an SHA-512 key:

Save the key to your hard disc on computer.
You make use any file name and extension, for example key.txt.

Transfer TrueCrypt key to security token

In the Tools menu, select Manage Security Keyfiles:

Enter the PIN code of your smartcard:

Click the Import Keyfile to Token button:

Select the keyfile (key.txt in our case) and click OK.

Then choose a file name on smartcard:

After transfer, TrueCrypt is able to access the file on smartcard

Click the Validate button to finish the process.

Backup your keyfile

If the smartcard is damaged or lost, you will loose your key file.
At that point, you should backup your keyfile on a CD or DVD and keep it in a safe place.

After backup, you may consider erasing your keyfile from disc, as you no longer need it.
But you should always keep a backup.

Location of keyfile on smartcard

To understand how TrueCrypt handles keyfiles, let us dump the content of smartcard:

The keyfile is saved as object data on smartcard. It means that is only protected by PIN code and can be exported. Therefore, you should always choose a long PIN and PUK code.

For security reasons, the object data cannot be erased or replaced on smartcard. This allows to make sure an attacker does not replace or remove information on your smartcard.

The only way to remove object data is to erase the whole card.

Also you should know that object data is usually limited to 32K per file.