AmbiSecure PIV Nano-Card Applet
A PIV-compatible JavaCard applet on a nano-card (4FF) secure element. Four certificate slots, on-card key generation, RSA + ECC. Designed against the NIST SP 800-73 / FIPS 201 surface so workforce-identity stacks that expect PIV semantics — PKINIT, smart-card logon, certificate-based VPN — can run unchanged on a nano-card form factor.
The PIV applet model on the trust boundary you already deploy.
PIV semantics, nano-card form factor
Existing PIV middleware (PIVKey, OpenSC, Microsoft Smart Card BaseCSP) talks to the applet exactly as if it were on a contact card. The host doesn’t care that the silicon is in a nano-card (4FF) package rather than an ID-1 card.
Four standard slots
PIV Authentication, Card Authentication, Digital Signature, Key Management. RSA 2048 / 3072 and ECC P-256 / P-384 supported in each, per FIPS 201.
On-card key generation
Private keys are generated inside the secure element. They never leave. Public keys plus on-card attestation are emitted for the issuance CA to sign.
Physical + logical convergence
Pair with a separate physical-access credential (DESFire, MIFARE) on the same chip variant where the use case demands one card for door and computer.
Standards-aligned
Designed against NIST SP 800-73-4 command set and FIPS 201-3. AmbiSecure has not yet submitted this applet for formal certification — standards conformance is a design property, not a published certification claim.
Lifecycle-aware
Slot replay, key history retention, and CHUID generation match the PIV lifecycle expectations. Migrating from a contact card to a nano-card form factor is a personalisation change, not a stack change.
What is in the applet.
| Form factor | ISO/IEC 7810 4FF nano-card form factor, 12.3 × 8.8 × 0.67 mm. Solderable MFF2 module available for embedded deployments. |
|---|---|
| Interfaces | ISO/IEC 7816 contact (T=0 / T=1) via a contact reader bay; NFC where the host supports it. |
| Standard surface | NIST SP 800-73-4 PIV applet command set. Targets the FIPS 201-3 functional profile; not yet submitted for FIPS / CC evaluation. |
| Keys per slot | PIV Authentication, Card Authentication, Digital Signature, Key Management — RSA 2048 or 3072, ECC P-256 or P-384. |
| Crypto operations | Sign, verify, decrypt, key generation, PIN policy, key-history retention. |
| Operating system | JavaCard 3.x on a Common Criteria EAL6+ secure element. |
| Issuance | Loaded over GlobalPlatform SCP03. Issuance CA can be customer-operated or run through AmbiSecure personalisation. |
| Companion applets | FIDO2 nano-card applet, OpenPGP applet, DESFire applet can co-reside on the same chip variant subject to memory budget. |
Issuance through revocation.
PIV is a lifecycle, not a primitive. Here is what an issuance line looks like.
Enrolment
User identity proofing per the issuer’s authority. Out of scope for the silicon; in scope for the workflow design.
Personalisation
Applet load, slot key generation, CHUID write, attestation chain. Done in a controlled facility.
CA signing
Public keys exported from the card go to the issuance CA. Signed certificates injected back into the matching slots.
Issue
Card or SIM handed to the user. Credential active across the enterprise / agency identity surface.
Revoke
OCSP / CRL update at the CA. Slot status set to inactive at the next admin contact.
Where this fits in the bigger picture.
Solution: Government identity
Where a PIV-compatible applet fits in a national or workforce identity programme.
Solution: Workforce identity
Issuance, daily auth, recovery, off-boarding — on a PIV-shaped applet.
Blog: PIV vs USB vs embedded SE
Decision matrix for workforce identity hardware classes.
Blog: PKI credential issuance
The issuance and revocation pipeline behind a PIV deployment.
Service: ePassport Platform
The wider government identity engineering capability that pairs with PIV applets.
Product: PKCS Signature Suite
Cross-platform PKCS#11 middleware that consumes the PIV signing slot.
Pilot an embedded secure-element PIV applet.
Tell us your target issuance CA, certificate policy, and slot configuration. We can ship engineering samples and an issuance reference flow in 6–8 weeks.