Smart-card personalisation — the line, not just the card.
Personalisation is where issuer secrets meet pre-personalised cards under controlled conditions. The card is the cheap part; the line is the expensive part. AmbiSecure supplies the card and personalises it in-house, or engineers the line the issuer runs itself. Either way the issuing CA stays with the issuer.
What personalisation actually does
A pre-personalised card from the silicon vendor has a fresh secure element with default keys, no applets, no per-card identity. Personalisation is the supervised process that:
- Loads the issuer's applets (FIDO2, PIV, eID, transit) onto the card under SCP03 secure messaging (SCP02 only where a legacy customer deployment requires it).
- Diversifies issuer master keys into per-card derivative keys using AES-CMAC (NXP AN10922) or equivalent.
- Writes per-card identity (PAN, AAGUID + serial, eID number, transit fare media ID).
- Loads attestation cert chain rooted in the issuer's CA.
- Moves the card into its SECURED field state per the GlobalPlatform 2.3.1 lifecycle.
- Records the card's identity in an issuance manifest signed by the issuer's HSM.
Audit logging and physical-security controls for each line are agreed with the issuer per programme. None of these steps can be repeated on a card after it leaves the line.
The line
Pre-personalised cards
From silicon vendors, in batches with fresh default keys. Tamper-evident shipping.
Key custody
A hardware security module holds the issuer master keys; which HSM, and who holds it, is agreed per programme (where a programme requires FIPS 140-2 / 140-3 Level 3, that validation belongs to the HSM vendor). Diversification happens inside the HSM; per-card derivatives are exported only to the card under SCP03.
Per-card flow
SCP03 channel; applet load + register + personalise + lock. Throughput depends on chip and line, and is confirmed per engagement.
Manifest + cards
Each card paired with its row in a HSM-signed issuance manifest (UID, AID, AAGUID, serial). Cards graded out, packaged, dispatched.
What we ship
AmbiSecure personalises in-house
Cards personalised by AmbiSecure under the issuer’s keys and certificates. The issuing CA stays with the issuer.
Customer-controlled facility
For sovereign deployments. The customer runs the line under its own HSM; AmbiSecure supplies the applets, loader and line integration.
Split personalisation
Pre-personalisation in-house at AmbiSecure, then final personalisation (per-cardholder data) in the customer's in-country facility, as separate stages.
HSM-signed audit trail
Every card ships with a manifest entry the customer's RP can validate against attestation at registration time.
Standards we track
| Standard | Coverage |
|---|---|
| GlobalPlatform 2.3.1 + Amendment D (SCP03) | YES — applet load, register, personalise, lock under SCP03 secure channel. |
| FIPS 140-2 / 140-3 Level 3 | YES — where the programme requires it, issuer master keys are held in a hardware security module agreed per programme; FIPS 140-2 / 140-3 Level 3 validation belongs to the HSM vendor, not to AmbiSecure. |
| Common Criteria EAL6+ | YES — built on secure elements certified by their manufacturer to CC EAL6+. |
| FIDO Alliance attestation | YES — per-batch attestation cert installed at line; AAGUID + serial recorded in manifest. |
| eID issuance | YES — eIDAS-aligned issuance under customer roots; qualified credentials need a Qualified Trust Service Provider and a certified QSCD. |
Where this fits
OnePass Card
The AmbiSecure card, personalised in-house or on the issuer’s line.
JavaCard applet deployment
The full path around the line: key replacement, loading, lifecycle and in-field updates.
Government identity
Sovereign issuance under customer roots.
Closed-loop ticketing
DESFire personalisation with per-card diversification.
Pricing a personalisation line?
Tell us your volumes, your standards, your jurisdiction. We will price the line and quote the lead time.