AmbiSecure PIV Smart Card.
PIV-compatible JavaCard applet on a contact + contactless ISO/IEC 7810 ID-1 smart card. Drop-in replacement for legacy PKI tokens with a Windows / macOS smart-card login surface, PKCS#11 middleware, minidriver, and four certificate slots usable for authentication, digital signature, key management, and card authentication.
Four certificate slots, two interfaces, one card.
FIPS 201 functional surface
Four PIV certificate containers — authentication (9A), digital signature (9C), key management (9D), card authentication (9E). RSA 2048 / 3072 and ECC P-256 / P-384 supported per slot. Compatible with NIST SP 800-73 APDU semantics.
Contact & contactless
ISO/IEC 7816 (contact pad) plus ISO/IEC 14443 Type A / B (NFC). Same applet, two transports — tap for door / login readers, insert for high-throughput personalisation lines.
Windows + macOS smart-card logon
Drop-in for AD smart-card login, macOS smart-card pairing, Windows Hello for Business hybrid flows, and certificate-based VPN / 802.1X authentication. No bespoke middleware on managed endpoints.
PKCS#11 + minidriver
Cross-platform PKCS#11 module (Mozilla, Acrobat, OpenSC-compatible) and Windows minidriver (BaseCSP). Works with PuTTY-CAC for SSH agent forwarding, OpenVPN, and S/MIME signing in Outlook.
The four commands behind a smart-card logon.
"Compatible with SP 800-73" is only meaningful if the host middleware gets the bytes it expects. Stripped to its essentials, a Windows or macOS smart-card logon over the contact interface is the four commands below, and the card is judged on its answers to them. The trailing 00 on the first two commands is Le: the host expects data back.
| 1 · SELECT | 00 A4 04 00 0B A0 00 00 03 08 00 00 10 00 01 00 00 — select the PIV card application by AID; the card answers with its application property template |
|---|---|
| 2 · GET DATA | 00 CB 3F FF 05 5C 03 5F C1 05 00 — read the PIV Authentication certificate (data object 5FC105) so the host can match it to a directory account |
| 3 · VERIFY | 00 20 00 80 08 <PIN, padded with FF to 8 bytes> — present the PIV application PIN (key reference 80) |
| 4 · GENERAL AUTHENTICATE | 00 87 <algorithm> 9A … — sign the host's challenge with the private key in slot 9A (algorithm 05 = RSA 3072, 07 = RSA 2048, 11 = ECC P-256, 14 = ECC P-384; SP 800-78-5 keeps RSA 2048 for these keys only through 2030) |
The four slots map to fixed certificate objects: 9A → 5FC105 (PIV Authentication), 9C → 5FC10A (Digital Signature), 9D → 5FC10B (Key Management), 9E → 5FC101 (Card Authentication). Slot 9E is the one a door reader uses over the contactless interface: the Card Authentication key is defined so that it can be used without a PIN, which is what makes a tap-to-open flow possible on the same card that requires a PIN for logon. The PIV Authentication certificate and key, by contrast, are restricted on the contactless interface unless the card establishes a virtual contact interface (SP 800-73-4 access rules).
Card, chip, personalisation and audience.
Form factor
ISO/IEC 7810 ID-1 (85.60 x 53.98 mm), contact pad + contactless antenna. Standard credit-card thickness, wallet-friendly. Card body is durable plastic; survives normal wallet conditions and brief immersion.
Secure element
CC EAL6+ certified secure element from a partner silicon vendor. No extractable per-device master key, no remote backdoor channel, no AmbiSecure escrow of issuer credentials.
Personalisation
SCP03 loading under your issuer keys, HSM-backed custody, batch APDU personalisation. AID, branding, and post-issuance update policy controlled by the issuer. Anonymised case study available.
Audience
Workforce identity programmes, contractor / vendor smart cards, government PIV-I / PIV-C deployments, regulated industries (finance, healthcare, defence) needing hardware-backed certificate stores.
Other places this applet ships.
Pilot batch or production scope?
Talk to the engineers who load the applet, not a BDR.