Cryptnox SA
EAN: 7649992538271
The Cryptnox FIDO2 + PIV + MIFARE White PVC card converges three credentials onto one printable Swiss-engineered NFC smart card: FIDO2 passwordless / 2FA web authentication, a PIV PKI applet with RSA-4096 for smart-card logon and document signing, and MIFARE DESFire EV2 for physical building access. FIDO Alliance Certified (FIDO2 v2.1 + CTAP Level 1), EAL6+ secure element, blank white PVC face ready for in-house ID printing.
CHF 42.02
Tax included. Shipping calculated at checkout.
The Cryptnox FIDO2 + PIV + MIFARE White PVC card converges three independent credentials onto one printable, employee-personalizable card — a Swiss-engineered NFC smart card built on a single EAL6+ secure element (NXP JCOP 4 on P71D321). It combines FIDO2 web authentication, a PIV PKI applet with on-card RSA-4096, and MIFARE DESFire EV2 physical access control. One badge replaces a separate FIDO2 authenticator, a PIV smart card, and an RFID office badge.
The three applets are logically firewalled inside the secure element — each uses its own keys and memory space, so a compromise of one cannot reach the others.
The face of this card ships blank — ready for any standard PVC ID card printer (Zebra, Evolis, Fargo, Magicard, Matica). Print your company logo, employee photo, name, department, or QR code on each card, then issue one credential that covers web sign-in, PKI identity, and door access. Typical buyers are corporate IT and PKI teams converging logical and physical identity onto a single printable badge.
The card supports both NFC and contact (ISO 7816) interfaces. For FIDO2, tap on supported phones (iPhone 7+ on iOS 13.3+ supports FIDO2 over NFC; Android external NFC keys are mainly CTAP1 / U2F second-factor, not full FIDO2). PIV smart-card logon and signing use the contact interface through a standard USB CCID reader. For Windows desktop users, the Cryptnox dual-slot Smartcard Reader adds a dedicated “tap” button that electronically simulates card extraction and reinsertion (Windows only) — see our click-to-tap tutorial.
The blank White PVC surface is dimensioned to standard CR80 ID card printer specs. You can:
The PIV applet ships blank for customer personalization, with a decoupled PIV admin key so integrators can load keys, certificates and PINs without the issuer’s card-management key.
The PIV applet conforms to NIST FIPS 201-3 and SP 800-73-4, and works with the Windows native smart-card mini-driver (Base CSP), PKCS#11 middleware and OpenSC; it is suitable for PIV-I (interoperable) credentialing.
The MIFARE side is designed for standard DESFire EV2 deployments with open AES key programmability. Compatibility with proprietary access-control ecosystems is not universal — test a sample card end-to-end with your readers, access-control software and key diversification before bulk rollout. Some proprietary systems only accept cards with vendor-specific overlays.
For volumes of 500+ or pre-printed batches (1,000+ cards), get in touch via our contact form.
For setup walkthroughs and service-specific tutorials, browse our FIDO2 tutorials hub.
EAN: 7649992538271
Each part of the card is certified independently.
Chip / platform certifications (NXP JCOP 4 on P71D321, Java Card platform):
Applet certifications (each certified separately):
Cryptography: FIDO2 attestation uses NIST P-256 (secp256r1) only; the PIV applet generates RSA-4096 / RSA-2048 / ECC P-256 / P-384 keys on-card, and private keys never leave the secure element.
The PIV applet turns the card into a government-grade PKI smart card. Built on the NIST SP 800-73-4 PIV standard, it provides the four standard PIV key slots (9A authentication, 9C digital signature, 9D key management, 9E card authentication) and supports RSA-4096 as well as RSA-2048 and ECC P-256 / P-384. Keys are generated on-card, so the private key never leaves the secure element. That lets one card handle Windows / Active Directory smart-card logon (Kerberos PKINIT), S/MIME email signing and encryption, document and code signing, and certificate-based VPN or Wi-Fi (EAP-TLS). The card ships with the PIV applet installed but blank — your team personalizes the keys, certificates and PINs.
Both cards share the same FIDO2 web-authentication applet and MIFARE DESFire EV2 access-control applet on the same EAL6+ secure element. This version adds a third applet — PIV PKI with RSA-4096 — for smart-card logon, document signing and certificate-based VPN. If you only need passwordless / 2FA web sign-in plus building access, the FIDO2 + MIFARE White PVC card covers that. Choose this card when you also need a PKI identity — for example Windows domain logon or signing certificates — converged onto the same printable badge.
A YubiKey 5 also combines FIDO2 and PIV, so both can do passwordless sign-in and smart-card logon. The differences are form factor and scope: the Cryptnox card is a wallet-sized ISO 7810 ID-1 card with a blank white PVC face you can print on standard ID card printers (employee photo, logo, department, QR code), whereas the YubiKey is a fixed-branding keychain fob. The Cryptnox card also carries a MIFARE DESFire EV2 applet for physical door access on the same credential, which the YubiKey does not offer. If you need a single printable badge that unifies web 2FA, PKI identity and building access, this card converges all three.
The FIDO2 applet is personalized at the factory (attestation certificate and key, plus 36 blank resident-credential slots), so FIDO2 / passkey enrollment works out of the box. The PIV applet ships blank — no PINs or certificates until your PKI team personalizes it. To make integration easier, the PIV admin channel uses a dedicated, decoupled key (a separate GP Security Domain) rather than the issuer’s card-management key, so an integrator can load PIV keys, certificates and PINs without the master key; re-key it to a secret if you want gated PIV administration. The MIFARE applet ships with NXP factory-default AES keys to be diversified by your access-control integrator. For volume provisioning or pre-printed cards, use the Cryptnox contact form.
The FIDO2 applet works with any service supporting FIDO2, WebAuthn or legacy U2F — Google, Microsoft, Apple ID, GitHub, GitLab, AWS, Okta, Microsoft Entra ID, Google Workspace, login.gov, AGOV and SwissID, plus major banks and exchanges — as a phishing-resistant second factor, and for passwordless sign-in where the service supports it. The PIV applet conforms to NIST FIPS 201-3 / SP 800-73-4 and works with the Windows native smart-card mini-driver (Base CSP), PKCS#11 middleware and OpenSC, and is suitable for PIV-I (interoperable) credentialing.
OS and browser compatibility: Windows 10/11 has full FIDO2 / passkey support plus PIV smart-card logon via the native mini-driver. iOS supports FIDO2 over NFC natively (any iPhone 7+, iOS 13.3+). Android currently supports only CTAP1 / U2F (FIDO1) for external NFC keys — it works as a U2F second factor on most major services, but not for FIDO2 passwordless / passkey sign-in. macOS FIDO2-over-NFC support varies by version and browser; PIV is available via CryptoTokenKit or OpenSC. Linux browsers expect a HID interface — use the Cryptnox FIDO2 HID bridge for FIDO2, and OpenSC / PKCS#11 for PIV. Always test with your specific OS + browser + service before a production rollout.
