Java Card Applet Development for Secure Identification
This is full-cycle JavaCard applet development across secure elements. Where the target is a SIM or eUICC specifically, see eUICC applet development and Java Card for SIM/eSIM.
AmbiSecure, the security business unit of Ambimat Electronics, develops Java Card applets for secure identification — the on-card software that turns a secure element into a credential a system can trust. You bring the specification, the chip and the keys; we deliver a CAP file, its source, a functional specification and the tests that prove it behaves. Typical work: PIV, FIDO2 authenticators, OpenPGP, eID, access credentials and bespoke closed-loop applications.
A standard applet is judged by the host software that selects it.
Windows, macOS and Linux PIV stacks, browsers speaking CTAP over NFC, and GnuPG do not know who wrote the applet. They send a SELECT for a fixed application identifier (AID) and expect the response format the standard defines. These are the AIDs our standard applet families answer to:
| PIV | A0 00 00 03 08 00 00 10 00 01 00 — NIST SP 800-73 card application; host middleware selects it before reading certificates or asking for a PIN |
|---|---|
| FIDO | A0 00 00 06 47 2F 00 01 — the FIDO AID that CTAP clients select over NFC before sending U2F or CTAP2 commands |
| OpenPGP | D2 76 00 01 24 01 … — OpenPGP card RID and application; the remaining bytes carry the version, manufacturer and card serial |
| Bespoke | Under your registered RID, or a proprietary AID in the ISO/IEC 7816-5 unregistered range (first nibble F), chosen at the design step so it never collides with an applet already on the card |
Getting an AID or a response format slightly wrong is a common reason a "working" applet fails in the field: the simulator passes, the customer's laptop does not. That is why the deliverables below include integration tests against a real chip, not only the JCVM simulator. Two of these families have shipped to customers inside AmbiSEC FIDO and PIV modules (see the AmbiSEC page for the shipped-volume note).
Standards
JavaCard 3.0, GlobalPlatform 2.3, JCOP 3.1; NIST SP 800-73-3 PIV (parts 1-4); ETSI GSM 11.11, 3GPP TS 31.102 and TS 31.121 for SIM-side work; FIDO U2F, FIDO2 CTAP, W3C WebAuthn; ISO/IEC 7816.
Toolchain
Eclipse with JCOP Tools, the JavaCardOS Development Kit, or the Oracle Java Card Development Kit — whichever your chip vendor supports.
Cryptography
RSA, ECC, AES, DES/3DES, SHA-2, HMAC, ECDSA; secure channels and secure messaging; applet countermeasures against fault and side-channel attacks.
How a JavaCard project actually runs.
From your spec to a CAP file your factory can load, with the documentation auditors expect.
Discover
Spec, target chip, certification target, host integration.
Design
Functional specification, AID layout, security model, APDU command set.
Develop
Applet code, testing GUI, unit tests, IDE-of-your-choice.
Validate
QA testing, functional specification documentation, security review.
Support
Integration support, post-implementation patches, certification dossiers.
The line items in a JavaCard engagement.
| Source code | Java source for the applet, tests, and supporting classes; CAP file build scripts |
|---|---|
| CAP file | Signed CAP file ready for SCP03 load by your personalisation line or by our Multi-Card Applet Loading Tool |
| Functional specification | APDU command set, AID layout, key derivation model, lifecycle states |
| Test suite | Unit tests inside the JCVM simulator; integration tests against a real chip |
| Test GUI | Operator-friendly tool to walk the applet through its functional flows |
| Documentation | Architectural overview, security model, integration notes, certification-friendly evidence |
Applet families we start from.
| FIDO | FIDO2 applet — U2F + CTAP2.1, resident credentials, on-card PIN. Powers the OnePass Card. |
|---|---|
| PIV | PIV applet — NIST SP 800-73 interface for legacy government and enterprise PKI integrations. |
| OpenPGP | OpenPGP card applet — RFC 4880 / OpenPGP card spec. Signing, decryption and authentication keys. |
| eID | National eID applets — credential issuance under customer roots. |
| Custom | Bespoke applets — closed-loop ticketing, secure messaging, application-specific protocols, designed to your spec. |
Targeting a SIM or eUICC rather than a general secure element? The eSIM-specific applet work is covered on the eSIM property: eUICC applet development.
Where this fits in the bigger picture.
Worked proof: our SCP03 / SCP02 secure-element provisioning case study shows a GlobalPlatform secure channel implemented end to end, and the sanitized public secure-channel repository lets your engineers read the pattern. It is implementation evidence for secure-element provisioning over a GlobalPlatform secure channel; it does not mean every Java Card project uses SCP03 — the channel and keyset follow your card's GlobalPlatform configuration. See also SCP03.
Product: JavaCard Applet Platform
Standard applet families to start from: FIDO, PIV, OpenPGP and bespoke.
Solution: JavaCard Applet Deployment
What happens after CAP delivery: loading, personalisation and in-field management.
Service: Tool-Chain Development
The personalisation tooling that surrounds applet delivery.
JavaCard applet development for enterprise identity
AID design, lifecycle, secure messaging, personalisation, and the mistakes to avoid.
Have a JavaCard applet to write?
Tell us your chip, your spec, and your certification target. We will scope the engagement and tell you what is reasonable.