Cryptnox SA
EAN: 7649992538332
The Cryptnox FIDO2 + PIV + MIFARE 25-pack is the bulk procurement option for our flagship converged security card — 25 White PVC cards in one SKU, each combining FIDO2 passwordless / 2FA authentication, a PIV applet with on-card RSA-4096 for smart-card logon and document signing, and MIFARE DESFire EV2 4K for building access. FIDO Alliance Certified (FIDO2 v2.1 + CTAP Level 1), EAL6+ secure element. One converged credential per employee for enterprise rollouts. Platform note: Windows full FIDO2 + PIV smart-card logon; iPhone 7+ / iOS 13.3+ FIDO2 over NFC; Android external NFC keys mainly CTAP1 / U2F second-factor. Deploying a 25-pack? Per-service and per-platform support is documented in FIDO2 Card Compatibility — Services and Platforms.
CHF 596.62
Tax included. Shipping calculated at checkout.
Equip your workforce with a converged security credential at scale. This 25-card bulk pack puts three independent credentials on every printable white PVC card: FIDO2-certified phishing-resistant authentication (including passwordless / passkey sign-in where supported by the operating system, browser, and service), a PIV applet with on-card RSA-4096 for smart-card logon and document signing, and MIFARE DESFire EV2 4K for physical building access. All three applets run on a single EAL6+ secure element (NXP JCOP 4 on P71D321). One wallet-sized credential per employee replaces a separate FIDO2 authenticator, a PIV smart card, and an RFID office badge — provisioned, tracked and revoked as a single SKU. MIFARE DESFire EV2 4K compatibility with proprietary access-control systems is not universal — test a sample card with your readers and software before rolling out the batch.
A PIV (Personal Identity Verification) card is a smart card that stores a cryptographic identity — private keys and X.509 certificates held in a tamper-resistant secure element — used to prove who you are to computers, networks and applications. Defined by the U.S. government standard NIST FIPS 201 / SP 800-73, the PIV model is now widely adopted by enterprises for PIV-I (interoperable) credentialing. The Cryptnox card implements the NIST SP 800-73-4 PIV standard and generates its keys on-card — including RSA-4096 — so the private key never leaves the chip. Because the same card also carries FIDO2 and MIFARE, one PIV smart card can handle Windows / Active Directory smart-card logon, document signing and certificate-based VPN alongside passwordless web sign-in and physical building access.
For a converged card, deployment runs in parallel tracks:
Test web sign-in, smart-card logon and door access on a single sample card before issuing the rest of the batch.
Each component of this card is certified independently:
Supports deployments aligned with OMB M-22-09 (phishing-resistant MFA), NIST SP 800-63B, FIPS 201-3 (PIV), PCI DSS v4, NIS2, DORA and eIDAS.
Need a single card to evaluate first? The single Cryptnox FIDO2 + PIV + MIFARE card carries the same three applets. Need fewer applets in bulk? The FIDO2 + MIFARE 25-pack drops the PIV applet, and the FIDO2-only 25-pack covers passwordless 2FA on its own.
Explore our FIDO2 security key guide, see setup instructions for Microsoft and Google, or read our guide to passkeys and FIDO2. For orders larger than 25 units or custom branding, contact our enterprise sales team.
EAN: 7649992538332
Each part of the card is certified independently. Chip / platform certifications (NXP JCOP 4 on P71D321, Java Card platform):
Applet certifications (each certified separately):
Cryptography: FIDO2 attestation uses NIST P-256 (secp256r1) only; the PIV applet generates RSA-4096 / RSA-2048 / ECC P-256 / P-384 keys on-card, and private keys never leave the secure element.
The PIV applet turns the card into a government-grade PIV smart card. Built on the NIST SP 800-73-4 PIV standard, it provides the four standard PIV key slots (9A authentication, 9C digital signature, 9D key management, 9E card authentication) and supports RSA-4096 as well as RSA-2048 and ECC P-256 / P-384. Keys are generated on-card, so the private key never leaves the secure element. That lets one card handle Windows / Active Directory smart-card logon (Kerberos PKINIT), S/MIME email signing and encryption, document and code signing, and certificate-based VPN or Wi-Fi (EAP-TLS). The card ships with the PIV applet installed but blank — your team personalizes the keys, certificates and PINs.
Both cards share the same FIDO2 web-authentication applet and MIFARE DESFire EV2 4K access-control applet on the same EAL6+ secure element. This version adds a third applet — PIV with RSA-4096 — for smart-card logon, document signing and certificate-based VPN. If you only need passwordless / 2FA web sign-in plus building access, the FIDO2 + MIFARE White PVC card covers that. Choose this card when you also need a PIV identity — for example Windows domain logon or signing certificates — converged onto the same printable badge.
A YubiKey 5 also combines FIDO2 and PIV, so both can do passwordless sign-in and smart-card logon. The differences are form factor and scope: the Cryptnox card is a wallet-sized ISO 7810 ID-1 card with a blank white PVC face you can print on standard ID card printers (employee photo, logo, department, QR code), whereas the YubiKey is a fixed-branding keychain fob. The Cryptnox card also carries a MIFARE DESFire EV2 4K applet for physical door access on the same credential, which the YubiKey does not offer. If you need a single printable badge that unifies web 2FA, PIV identity and building access, this card converges all three.
The FIDO2 applet is personalized at the factory (attestation certificate and key, plus 36 blank resident-credential slots), so FIDO2 / passkey enrollment works out of the box. The PIV applet ships blank — no PINs or certificates until your IT team personalizes it. To make integration easier, the PIV admin channel uses a dedicated, decoupled key (a separate GP Security Domain) rather than the issuer’s card-management key, so an integrator can load PIV keys, certificates and PINs without the master key. That PIV admin key ships as the published GlobalPlatform test key, so rotate it to your own secret before you issue cards: until you do, anyone holding the card can administer the PIV application, including setting a new PIN. A per-card Cryptnox factory keyset in the same domain supports genuineness checks and recovery, and can be removed if your policy requires sole custody. Cryptnox support provides the rotation procedure. The MIFARE applet ships with NXP factory-default AES keys to be diversified by your access-control integrator. For volume provisioning or pre-printed cards, use the Cryptnox contact form.
The FIDO2 applet works with any service supporting FIDO2, WebAuthn or legacy U2F — Google, Microsoft, Apple ID, GitHub, GitLab, AWS, Okta, Microsoft Entra ID, Google Workspace, login.gov, AGOV and SwissID, plus major banks and exchanges — as a phishing-resistant second factor, and for passwordless sign-in where the service supports it. The PIV applet conforms to NIST FIPS 201-3 / SP 800-73-4 and works with the Windows native smart-card mini-driver (Base CSP), PKCS#11 middleware and OpenSC, and is suitable for PIV-I (interoperable) credentialing.
OS and browser compatibility: Windows 10/11 has full FIDO2 / passkey support plus PIV smart-card logon via the native mini-driver. iOS supports FIDO2 over NFC natively (any iPhone 7+, iOS 13.3+). Android currently supports only CTAP1 / U2F (FIDO1) for external NFC keys — it works as a U2F second factor on most major services, but not for FIDO2 passwordless / passkey sign-in. macOS FIDO2-over-NFC support varies by version and browser; PIV is available via CryptoTokenKit or OpenSC. Linux browsers expect a HID interface — use the Cryptnox FIDO2 HID bridge for FIDO2, and OpenSC / PKCS#11 for PIV. Always test with your specific OS + browser + service before a production rollout.
Up to 8 per website (relying party) by default, out of the card’s 36 passkey slots in total. This matters mostly for users with several accounts on the same service, typically Microsoft Entra ID. Cards without the per-website limit are available on special request — please contact us.
