Overview
The Cryptnox ID card carries three independent functions on one chip:
PIV — SP 800-73 identity credentials: PIN-protected keys and X.509 certificates for signing, authentication and encryption, usable by standard PIV tooling (yubico-piv-tool, OpenSC, OS smart-card stacks).
FIDO2 / CTAP 2.1 — passkeys over NFC for WebAuthn sign-in.
MIFARE DESFire — contactless applications: access control, closed-loop counters, and EV3 Secure Dynamic Messaging (self-authenticating NFC tags).
Cryptnox ID CLI (the cryptnox-id command) manages all three from one terminal.
A fourth applet, genuineness, is Cryptnox’s factory attestation: it proves the card is authentic. Unlike the three functions above it is inspected, never provisioned — see Genuineness guide.
Reachability at a glance
Function |
Interface |
Notes |
|---|---|---|
PIV |
contact (admin), contact/contactless (use) |
All personalization/administration is contact-only. |
FIDO2 |
contactless (NFC) |
Windows: requires an Administrator terminal. |
DESFire |
contactless (NFC) |
Requires a DESFire-capable reader (ACS ACR1252 verified). |
Genuineness |
contact |
Cryptnox attestation applet; read-only (Genuineness guide). |
The same physical card exposes different applets depending on the interface it is reached over. If PIV looks present but MIFARE does not, you are on a contact reader — and vice versa.
Readers
The Cryptnox card readers are the recommended choice and cover every function of the card. Any PC/SC reader also works for PIV and FIDO2; MIFARE DESFire additionally needs a reader that passes native DESFire APDUs — not all contactless readers do.
Reader |
Use |
Status |
|---|---|---|
Cryptnox Smartcard Reader (contact) |
PIV, FIDO2, genuineness |
Cryptnox — recommended |
Compact USB Mini Smartcard Reader (contact) |
PIV, FIDO2, genuineness |
Cryptnox — recommended |
DESFire, PIV/FIDO2 over NFC |
Cryptnox — recommended |
|
ACS ACR39U (contact) |
PIV, FIDO2, genuineness |
verified |
ACS ACR1252 (contactless) |
DESFire, PIV/FIDO2 over NFC |
verified (native DESFire OK) |
Feitian R502 (contactless) |
DESFire, PIV/FIDO2 over NFC |
observed working |
HID OMNIKEY 5422CL |
PIV / GlobalPlatform only |
DESFire not supported (frames unanswered) |
Reader names differ across units, operating systems and drivers, so the CLI
selects by name substring as well as index — see Getting started. A
Cryptnox reader may report a Cryptnox-branded name (“CryptnoxCR” contact,
“Cryptnox NFC” contactless) or the ACS model name of the underlying unit; run
readers to see yours — the no---reader default auto-selects both
families.
Platforms
The CLI is pure Python over PC/SC and runs on Windows, Linux and macOS. All three card functions are verified on real hardware on each. The one platform-specific behaviour is FIDO2 on Windows, which requires an Administrator terminal (Windows reserves the CTAP interface for its WebAuthn API); Linux and macOS have no such restriction. See Installation for per-OS setup.