Important notes, please read this first:
Cryptnox FIDO2 devices work natively out of the box with Android and iOS, with no management app required. They can be initialized and used directly through supported operating systems and browsers. When used with a compatible smartcard reader, they work fully on Windows, on macOS depending on website FIDO2 implementation, and on Linux via the HID bridge middleware.
The PIV applet ships blank: PIN, PUK, keys and certificates are issued from a desktop with the Cryptnox ID CLI described below, which also manages the FIDO2 PIN and the MIFARE DESFire application.
Cryptnox ID CLI (cryptnox-id) is our open-source card-management tool for Windows, macOS and Linux. One tool drives all three functions of the card: the PIV identity applet, the FIDO2 authenticator and the MIFARE DESFire contactless application. It works with any USB CCID smart card reader over the PC/SC layer built into Windows and macOS; on Linux install pcscd and libccid first. cryptnox-id info shows all three functions on one screen and cryptnox-id doctor checks the reader and setup.
Install (Python 3.10+): pip install cryptnox-id-cli on Windows, pipx install cryptnox-id-cli on macOS / Linux, then cryptnox-id --version.
The PIV applet ships blank. The CLI issues the PIN and PUK, generates keys, imports certificates, writes the CHUID and prepares the card for Windows smart-card logon, SSH and TLS client authentication. piv quickstart does the whole setup in one command.
Set or change the FIDO2 PIN, create and self-test credentials, list and delete the passkeys stored on the card, set the always-UV and minimum-PIN-length policy, and reset the authenticator. Works over a contact or a contactless reader. On Windows, run the fido commands from an Administrator terminal: the operating system reserves the FIDO applet for its own WebAuthn platform.
For the MIFARE variants: inspect the card, create applications and files, read and write data with authenticated EV2 secure messaging, rotate the AES keys, configure Secure Dynamic Messaging (SDM / SUN) for tamper-evident NFC tags, and format the card. All mifare commands need a contactless reader that passes native DESFire commands.
Also: prove that a card is genuine · Installation guide · Source code on GitHub · Package on PyPI · All Cryptnox documentation
