FIDO2, PIV and MIFARE DESFire on One Enterprise Smart Card

The new Cryptnox FIDO2 + PIV + MIFARE DESFire EV3 16K card puts phishing-resistant cloud authentication, certificate-based enterprise identity and contactless building access on a single printable employee badge — without merging the three security functions.

Published 19 August 2026  ·  Cryptnox SA, Geneva

Enterprise identity has traditionally been split across several credentials. An employee may carry a hardware security key for phishing-resistant MFA, a Personal Identity Verification (PIV) smart card for workstation or certificate-based authentication, and a separate RFID badge for entering the office.

The new Cryptnox FIDO2 + PIV + MIFARE DESFire EV3 16K card takes a converged approach: three independent security functions coexist on one printable, wallet-sized enterprise smart card. A FIDO2 PIV MIFARE smart card in this configuration serves as the employee’s security key, PIV credential and door badge at once.

FIDO2 handles modern web and cloud authentication. PIV provides certificate-based enterprise identity and Public Key Infrastructure (PKI) functionality. MIFARE DESFire EV3 16K provides the contactless credential space used for compatible physical-access systems. The result is one employee badge that can span online accounts, workstations and doors without turning the three security functions into one shared key system.

For the complete card range and configuration comparison, see the Cryptnox converged identity and access smart-card hub.

Why combine digital identity and physical access on one card?

From the employee's point of view, the distinction between logical and physical access is increasingly artificial. The same person may authenticate to Microsoft Entra ID, unlock a Windows workstation, establish a certificate-based VPN session and pass through controlled doors during the same working day.

The underlying technologies are different, however, and they should remain different. Convergence is valuable because it reduces the number of physical objects an organization issues and employees carry — not because it merges every credential into one secret.

On the Cryptnox card, these functions are implemented as separate applications with separate keys, memory and access conditions. One badge therefore does not mean one shared set of keys.

FIDO2 for phishing-resistant cloud and web authentication

FIDO2 is designed around public-key authentication rather than reusable passwords or one-time codes. During registration, a credential is created for the relying service; the private key remains protected by the authenticator while the service stores the corresponding public key. Because authentication is bound to the legitimate service origin, a look-alike phishing site cannot simply replay the credential.

The FIDO Alliance specifications define FIDO2 as the combination of WebAuthn and the Client to Authenticator Protocol (CTAP), supporting passwordless, second-factor and multi-factor experiences with compatible authenticators.

For enterprises, this makes the FIDO2 function suitable for Microsoft Entra ID, Microsoft 365, Google Workspace and other services that support FIDO2 or WebAuthn. Passwordless sign-in is available where the service and platform support it; elsewhere the same card can be used as a phishing-resistant second factor.

On this EV3 16K edition, the Cryptnox FIDO2 applet is FIDO Alliance Certified at Level 1 for FIDO2 CTAP2.1 and provides 64 resident-credential slots for discoverable credentials, with ES256 / NIST P-256 used on the FIDO2 side.

Technical implementation details are available in the Cryptnox FIDO2 card technical specifications.

PIV for smart-card logon, PKI and digital signatures

FIDO2 and PIV solve different identity problems. FIDO2 is optimized for modern web and identity-provider authentication, while PIV provides a certificate-based smart-card architecture for enterprise identity and PKI.

The PIV application on the Cryptnox card implements NIST SP 800-73-4 and supports the four standard PIV key slots: 9A for PIV authentication, 9C for digital signatures, 9D for key management and 9E for card authentication. It supports RSA-4096, RSA-2048, ECC P-256 and ECC P-384, with keys generated on-card so private key material does not need to leave the secure element (NXP JCOP 4.5 on P71D600).

This enables deployment scenarios such as Windows and Active Directory smart-card logon, certificate-based VPN and Wi-Fi access, S/MIME, document signing and code-signing workflows.

For the product's PIV implementation details, see the Cryptnox PIV smart-card technical specifications.

MIFARE DESFire EV3 16K for physical access

The third function brings the same employee badge into the physical-access environment. This edition uses MIFARE DESFire EV3 with 16 KB of memory for compatible access-control deployments.

NXP's DESFire EV3 family supports ISO/IEC 14443 Type A communication, AES-based security options and multi-application use. The 16 KB capacity gives an access-control integrator more room for applications and data than the older Cryptnox EV2 4K edition.

The MIFARE credential remains independent from the FIDO2 and PIV credentials. It ships for personalization by the organization's facilities team or access-control integrator, including key diversification appropriate to the target deployment.

For MIFARE-specific details, see the Cryptnox MIFARE DESFire product specifications.

One printable employee badge instead of multiple tokens

The value of a converged credential is not only technical. The EV3 16K card uses the standard ISO/IEC 7810 ID-1 / CR80 form factor and a blank white PVC face intended for standard ID-card printing.

An organization can add an employee photograph, company branding, name, department, visible ID number or QR code, then issue the card through the same physical badge workflow already familiar to employees and facilities teams.

Under the printed surface, the same object can serve as a FIDO2 security key, a PIV smart card and a MIFARE DESFire EV3 physical-access credential. That can reduce the operational burden of issuing separate objects while preserving separate credential lifecycles.

One card, three separately managed security functions

Combining several applications on one physical smart card naturally raises a security question: does one function gain access to the keys or secrets belonging to another?

The Cryptnox architecture keeps the FIDO2, PIV and MIFARE applications logically separated inside the secure element. Each application uses its own keys, memory and security mechanisms. The benefit is physical consolidation without intentionally collapsing the trust boundaries between online authentication, enterprise PKI and physical access.

Certification claims should also be kept separate:

• The card runs on the NXP JCOP 4.5 / P71D600 platform — a Common Criteria EAL6+ certified NXP secure controller and Java Card platform, each certified in its own evaluated configuration.
• The Cryptnox FIDO2 applet has its own FIDO Alliance certification.
• The PIV applet is built from the same codebase that was certified under FIPS 140-3 (NIST CMVP certificate #5280). It is not deployed in the configuration covered by that certificate, and Cryptnox does not claim any FIPS certification at this stage.

These component claims should not be rewritten as a single whole-card FIPS or Common Criteria certification.

NFC and contact interfaces for different workflows

A converged enterprise badge has to work across very different devices. The Cryptnox card supports both NFC (ISO/IEC 14443 Type A) and a contact smart-card interface (ISO 7816).

For desktop environments, the card can be inserted into a standard CCID-class smart-card reader. This is particularly relevant for PIV smart-card logon and certificate operations. On supported mobile platforms and services, FIDO2 authentication can be performed over NFC. MIFARE DESFire physical access is contactless by design.

Platform behavior is not identical everywhere:

• Windows 10/11 provides the strongest combined FIDO2 and PIV desktop environment for this product.
• iOS supports FIDO2 over NFC on compatible iPhones.
• Android external NFC security keys are primarily supported through CTAP1/U2F second-factor flows rather than full external-key CTAP2/passkey functionality.
• macOS behavior varies by version and browser, and Linux FIDO2 use through a CCID reader requires the Cryptnox HID bridge.

For setup guidance, use the Cryptnox FIDO2 tutorials and review the available Cryptnox smart-card readers.

Three ways to put door access and computer login on one employee card

Organisations that want one badge for the door and for the computer generally end up with one of three architectures. The Cryptnox EV3 16K card is designed so that all three fit in a single card body.

• A two-technology card. A contactless door credential (MIFARE DESFire) plus a separate smart-card chip for computer login, with photo and name printed on the same PVC body. This is the classic converged badge: the two functions are issued and managed by different teams.
• A PIV card. Certificate-based identity for Windows smart-card logon, VPN, e-mail signing and privileged access, added to the same badge. This is the model that government and regulated industries already run.
• A FIDO2-capable badge. The badge acts as a FIDO2 security key for phishing-resistant multi-factor sign-in to Microsoft Entra ID, Google Workspace and web applications, and for passwordless sign-in where the tenant enables it.

The Cryptnox FIDO2 + PIV + MIFARE DESFire EV3 16K card carries all three: the DESFire EV3 application for the door, the PIV applet for PKI, and the FIDO2 authenticator for cloud and web sign-in, each with its own keys and its own lifecycle.

An existing DESFire door badge cannot be turned into a FIDO2 key

This is the point that trips up most projects. A DESFire-only badge is a physical-access credential: it stores access keys and files, but it has no authenticator application, no way to generate and protect the private key a FIDO2 credential needs, and no PIN or user-presence handling. FIDO2 requires a secure element running an authenticator that speaks CTAP2 and WebAuthn. The route is therefore not “upgrade the badges” but “re-issue converged cards”. Because the DESFire application on the Cryptnox card is a standard EV3 application, the physical-access side is provisioned the same way as any other DESFire EV3 credential.

Will it work with our door readers? A five-point checklist

“Supports MIFARE DESFire” is necessary but not sufficient. Before ordering, establish with your physical-access team:

1. Credential format. Whether your readers expect a vendor-specific secure-object format, a custom DESFire application defined by your integrator, or an open credential profile, and who holds the keys for it.
2. DESFire generation. Readers and encoding tools must accept EV3 cards. EV3 keeps the EV1 and EV2 command sets, but reader firmware has to recognise the generation.
3. Reader firmware. Older firmware may only read the card’s UID rather than the secured application, which silently downgrades security to a serial number.
4. Key management. Who diversifies and loads the DESFire keys, and whether encoding happens in-house or at your card bureau.
5. Pilot. Test a handful of cards on every reader model and every door controller before bulk issuance.

How employees use the badge for Microsoft 365 when the laptop has no NFC

Most business laptops and virtually all desktops have no NFC reader that a browser can use. For desk sign-in the card goes into a USB contact smart-card reader. On Windows, the Cryptnox Click-to-Tap reader completes the FIDO2 user-presence check with one press instead of removing and reinserting the card. Over NFC, a USB contactless reader or an NFC phone reads the same card. The Cryptnox smart-card readers page explains which reader fits which workflow, and Smart Card Reader Compatibility by Country lists the operating-system requirements.

Where a FIDO2 PIV MIFARE smart card makes sense

Consider an organization using Microsoft Entra ID for cloud authentication, certificate-based identity for Windows or VPN access, and MIFARE DESFire for office doors. Without convergence, the employee may need several separate credentials. With a converged smart card, the FIDO2 application can be registered with online services, the PIV application can be provisioned by the IT/PKI team, and the DESFire application can be personalized by the facilities or Physical Access Control System (PACS) integrator.

The employee carries one badge, while the organization continues to operate the underlying security functions independently. This model is relevant to financial institutions, government contractors, critical-infrastructure operators, healthcare organizations and other environments where strong logical authentication and controlled physical access coexist.

Provisioning remains under enterprise control

The three functions have different provisioning lifecycles. The FIDO2 applet is personalized for FIDO2 enrollment at issuance. The PIV application is provided for customer personalization with the organization's keys, certificates and PIN policy. The MIFARE DESFire EV3 application must be personalized and its default keys diversified by the access-control integrator before production use.

This separation is operationally useful: the cloud-identity team does not need to control building-access keys, and the facilities team does not need access to PIV certificate-management secrets.

For volume deployment, pre-printing or integration requirements, contact Cryptnox.

Which Cryptnox configuration should you choose?

The three-function EV3 16K card is intended for organizations that genuinely need online FIDO2 authentication, PIV enterprise identity and MIFARE-based physical access on the same badge.

• If the requirement is only phishing-resistant web authentication, a dedicated FIDO2 Security Key card is simpler.
• If employees need FIDO2 plus building access but no certificate-based PKI, a FIDO2 + MIFARE configuration removes the unnecessary PIV layer.
• If the organization needs FIDO2 and PIV but no building-access credential, the FIDO2 + PIV card provides the logical-identity combination.
• If cloud authentication, PKI identity and physical access must coexist on the same printable employee badge, choose the FIDO2 + PIV + MIFARE DESFire EV3 16K configuration.

Compare the available combinations on the Cryptnox converged identity and access smart-card page.