Cryptnox ID CLI

Command-line management for the Cryptnox multi-applet smart card: PIV (SP 800-73 identity credentials), FIDO2/CTAP 2.1 (passkeys), and MIFARE DESFire contactless — three independent functions on one physical card, driven by one tool: cryptnox-id.

📄 Download this documentation as PDF

General

• Overview
  • Reachability at a glance
  • Readers
  • Platforms
• Installation
  • Install
  • PC/SC per platform
  • Windows single-file executable
  • WSL2 (Windows Subsystem for Linux)
  • Next
• Getting started
  • Choosing a reader
  • Global options
  • One card operation at a time
  • Development keys
  • Next
• Interactive shell
  • Built-ins and keys
  • Global options carry in
  • Desktop shortcut (Windows)
  • Piped input
• Command syntax & conventions
  • Global options
  • Top-level commands
• JSON output
  • The contract
  • Result envelope
  • Error object
  • Snapshot reports
• Exit codes
• Troubleshooting
  • Reader and transport
  • Status words and errors
  • FIDO2
  • Genuineness
  • yubico-piv-tool interop
  • Getting a shareable diagnostic
• Factory & provisioning
  • Pre-personalization profiles
  • Factory commands
• License

PIV

• Quick start
  • Prerequisites
  • The one-command path
  • The steps, by hand
  • Verify with yubico-piv-tool
  • Interoperability matrix
  • If something fails
  • Next steps
• Windows logon & Remote Desktop
  • How it has to look
  • Step 0 — pre-personalize with the ms-logon profile (once per card)
  • Step 1 — get the certificate issued
  • Step 2 — verify Windows sees the card
  • Step 3 — log on
  • Scope and limits
  • Next steps
• SSH public-key authentication
  • How it has to look
  • Why it fails on cryptnox-default
  • Fixing it: give 9A the SIGN role
  • Prerequisites
  • Step 0 — find the PKCS#11 module path
  • Step 1 — get the SSH public key off the card
  • Step 2 — authorize it
  • Step 3 — load it into ssh-agent
  • Step 4 — connect
  • Troubleshooting
  • Next steps
• SSH user certificates
  • Prerequisites
  • Step 1 — export the card’s public key
  • Step 2 — the CA signs it
  • Step 3 — trust the CA on the server
  • Step 4 — connect with the certificate
  • Troubleshooting
  • Next steps
• TLS client authentication
  • How it has to look
  • Prerequisites
  • Firefox (NSS, cross-platform)
  • Windows / IIS (native store)
  • curl / OpenSSL (scripted clients)
  • Troubleshooting
  • Next steps
• macOS smart-card login
  • How it has to look
  • Prerequisites
  • Step 0 — fix macOS’s CCID driver
  • Step 1 — pair the certificate to the account
  • Step 2 — use it
  • Requiring the card (optional, higher risk)
  • Troubleshooting
  • Next steps
• PIV personalization
  • Quickstart (one shot)
  • Step 0 — factory: pre-personalize the applet structure
  • Step 1 — set the PIN and PUK
  • Step 2 — generate keys on the card
  • Step 2b — import an external private key
  • Step 3 — CSR and certificates (on-card signing)
  • Step 4 — data objects
  • Step 5 — validate and smoke-test
  • Step 6 — finalize (irreversible, factory)
  • Next steps
• Commands
  • Inspection
  • PIN
  • PUK
  • Admin channel
  • Certificates and objects
  • Attestation
  • Personalization (piv perso)
  • Notes

FIDO2

• Quick start
  • Credential management
  • authenticatorConfig policy
  • Reset
• Guide
  • Windows: run elevated
  • Read-only commands
  • Write operations
  • Credential management
  • authenticatorConfig policy
  • Scope
  • Next steps
• Commands
  • Inspection
  • PIN
  • Credentials
  • Configuration
  • Destructive

MIFARE DESFire

• Quick start
  • Prerequisites
  • Step 1 — create an application
  • Step 2 — set up the SDM file
  • Step 3 — read and verify
  • Scope and production notes
  • Next steps
• Guide
  • Inspect (read-only)
  • Applications and files
  • Authenticate, write, read
  • Delete (authenticated)
  • Value files
  • Record files
  • Keys
  • Secure Dynamic Messaging (SDM / SUN)
  • Format the PICC (destructive)
  • Scope
• Commands
  • Inspection
  • Applications
  • Keys
  • Files and data
  • Value and record files
  • Secure Dynamic Messaging (EV3)
  • Destructive

Genuineness

• Quick start
  • Next steps
• Guide
  • What is checked — and what deliberately is not
  • Trust anchors
  • Development cards
  • Inspection without the proof
  • Next steps
• Commands
  • Inspection
  • Verification