From c2f271398e5a6b6c1743d331fbd25cad6b190bd7 Mon Sep 17 00:00:00 2001 From: Mladen Milankovic Date: Fri, 4 Sep 2026 17:34:07 +0200 Subject: [PATCH] Move the reader articles to the cryptnox-readers repo The three reader articles (reader-compatibility, fido2-compatibility, click-to-tap) now live at docs.cryptnox.com/cryptnox-readers/. The Smart Card Readers card links the new site and its PDF; redirect stubs at the old root URLs forward readers and search engines; sitemap, robots and llms indexes updated. The README documentation table gains the missing sdk-esp32, sdk-arduino and sdk-cpp rows and the new readers repo. Co-Authored-By: Claude Fable 5 --- README.md | 12 + docs/source/_extra/click-to-tap.html | 13 + docs/source/_extra/fido2-compatibility.html | 13 + docs/source/_extra/llms.txt | 6 +- docs/source/_extra/reader-compatibility.html | 13 + docs/source/_extra/robots.txt | 1 + docs/source/_extra/sitemap-docs.xml | 5 +- docs/source/click-to-tap.rst | 122 ---- docs/source/fido2-compatibility.rst | 386 ----------- docs/source/index.rst | 4 +- docs/source/reader-compatibility.rst | 651 ------------------- 11 files changed, 58 insertions(+), 1168 deletions(-) create mode 100644 docs/source/_extra/click-to-tap.html create mode 100644 docs/source/_extra/fido2-compatibility.html create mode 100644 docs/source/_extra/reader-compatibility.html delete mode 100644 docs/source/click-to-tap.rst delete mode 100644 docs/source/fido2-compatibility.rst delete mode 100644 docs/source/reader-compatibility.rst diff --git a/README.md b/README.md index 5502ba1..7dc33d3 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,10 @@ This repository serves as the root of the Cryptnox documentation portal, availab | [**cryptnox-cli**](https://docs.cryptnox.com/cryptnox-cli/) | Command-line interface for managing smart card wallets | | [**cryptnox-id-cli**](https://docs.cryptnox.com/cryptnox-id-cli/) | Command-line interface for the Cryptnox ID card family (PIV, FIDO2, MIFARE DESFire, genuineness) | | [**cryptnox-sdk-py**](https://docs.cryptnox.com/cryptnox-sdk-py/) | Python SDK for managing smart card wallets via secure communication | +| [**cryptnox-sdk-esp32**](https://docs.cryptnox.com/cryptnox-sdk-esp32/) | ESP-IDF component bringing Cryptnox smartcard support to ESP32 firmware | +| [**cryptnox-sdk-arduino**](https://docs.cryptnox.com/cryptnox-sdk-arduino/) | Arduino library for Cryptnox smartcard support on any board | +| [**cryptnox-sdk-cpp**](https://docs.cryptnox.com/cryptnox-sdk-cpp/) | Portable C++ core at the heart of the Cryptnox embedded SDKs | +| [**cryptnox-readers**](https://docs.cryptnox.com/cryptnox-readers/) | Compatibility documentation for Cryptnox USB smart card readers (eID by country, FIDO2 services and platforms, Click-to-Tap) | --- @@ -33,6 +37,10 @@ docs.cryptnox.com/cryptnox-hardware-wallet/ → cryptnox/cryptnox-hardware-w docs.cryptnox.com/cryptnox-cli/ → cryptnox/cryptnox-cli docs.cryptnox.com/cryptnox-id-cli/ → cryptnox/cryptnox-id-cli docs.cryptnox.com/cryptnox-sdk-py/ → cryptnox/cryptnox-sdk-py +docs.cryptnox.com/cryptnox-sdk-esp32/ → cryptnox/cryptnox-sdk-esp32 +docs.cryptnox.com/cryptnox-sdk-arduino/ → cryptnox/cryptnox-sdk-arduino +docs.cryptnox.com/cryptnox-sdk-cpp/ → cryptnox/cryptnox-sdk-cpp +docs.cryptnox.com/cryptnox-readers/ → cryptnox/cryptnox-readers ``` --- @@ -43,6 +51,10 @@ docs.cryptnox.com/cryptnox-sdk-py/ → cryptnox/cryptnox-sdk-py - [cryptnox/cryptnox-cli](https://github.com/cryptnox/cryptnox-cli) - [cryptnox/cryptnox-id-cli](https://github.com/cryptnox/cryptnox-id-cli) - [cryptnox/cryptnox-sdk-py](https://github.com/cryptnox/cryptnox-sdk-py) +- [cryptnox/cryptnox-sdk-esp32](https://github.com/cryptnox/cryptnox-sdk-esp32) +- [cryptnox/cryptnox-sdk-arduino](https://github.com/cryptnox/cryptnox-sdk-arduino) +- [cryptnox/cryptnox-sdk-cpp](https://github.com/cryptnox/cryptnox-sdk-cpp) +- [cryptnox/cryptnox-readers](https://github.com/cryptnox/cryptnox-readers) --- diff --git a/docs/source/_extra/click-to-tap.html b/docs/source/_extra/click-to-tap.html new file mode 100644 index 0000000..8853e1a --- /dev/null +++ b/docs/source/_extra/click-to-tap.html @@ -0,0 +1,13 @@ + + + + +Moved — Cryptnox Docs + + + + + +

This page has moved to https://docs.cryptnox.com/cryptnox-readers/click-to-tap.html.

+ + diff --git a/docs/source/_extra/fido2-compatibility.html b/docs/source/_extra/fido2-compatibility.html new file mode 100644 index 0000000..fef791a --- /dev/null +++ b/docs/source/_extra/fido2-compatibility.html @@ -0,0 +1,13 @@ + + + + +Moved — Cryptnox Docs + + + + + +

This page has moved to https://docs.cryptnox.com/cryptnox-readers/fido2-compatibility.html.

+ + diff --git a/docs/source/_extra/llms.txt b/docs/source/_extra/llms.txt index 0570929..0b2df12 100644 --- a/docs/source/_extra/llms.txt +++ b/docs/source/_extra/llms.txt @@ -16,15 +16,15 @@ doubles as a FIDO2 security key. ## FIDO2 card compatibility by service and platform -- [FIDO2 Card Compatibility — Services and Platforms](https://docs.cryptnox.com/fido2-compatibility.html): which online services and operating systems work with a Cryptnox FIDO2 NFC security key card, as second-factor or passwordless sign-in. Two composing tables: PLATFORM (Windows full CTAP2; iOS NFC CTAP2; Android CTAP1/U2F ONLY over external NFC keys; macOS varies; Linux needs the open-source Cryptnox FIDO2 HID bridge) and SERVICE (Microsoft Entra ID, Google, AGOV, SwissID, login.gov, Apple, GitLab, Facebook, X, Cloudflare, Shopify, Binance, Coinbase, Bitfinex, Bank of America, Dropbox, NordVPN, Fastmail, GoDaddy, SSH). Explains why Microsoft over Android NFC fails even though card and service are both CTAP2-capable, why one card can register twice, and that these cards are MFA-first with PIN-based user verification, not fingerprint +- [FIDO2 Card Compatibility — Services and Platforms](https://docs.cryptnox.com/cryptnox-readers/fido2-compatibility.html): which online services and operating systems work with a Cryptnox FIDO2 NFC security key card, as second-factor or passwordless sign-in. Two composing tables: PLATFORM (Windows full CTAP2; iOS NFC CTAP2; Android CTAP1/U2F ONLY over external NFC keys; macOS varies; Linux needs the open-source Cryptnox FIDO2 HID bridge) and SERVICE (Microsoft Entra ID, Google, AGOV, SwissID, login.gov, Apple, GitLab, Facebook, X, Cloudflare, Shopify, Binance, Coinbase, Bitfinex, Bank of America, Dropbox, NordVPN, Fastmail, GoDaddy, SSH). Explains why Microsoft over Android NFC fails even though card and service are both CTAP2-capable, why one card can register twice, and that these cards are MFA-first with PIN-based user verification, not fingerprint ## Click-to-Tap: FIDO2 user presence on a desktop reader -- [Click-to-Tap — FIDO2 User Presence on a Desktop Reader](https://docs.cryptnox.com/click-to-tap.html): FIDO2/WebAuthn requires a user-presence check on every authentication. A USB security key has a touch button; a smart card in an ordinary contact reader has none, so the card must normally be pulled out of the slot and reinserted once per sign-in. The Cryptnox Click-to-Tap button drives a controlled extraction-and-reinsertion sequence at the protocol level, with no mechanical movement, so the card stays seated. Requires Cryptnox FIDO2 smart cards and Windows; on macOS and Linux the button has no effect and the device remains a standard CCID/PC-SC reader. Covers usage steps, troubleshooting (button does nothing, service never prompts, card not detected, FIDO2 on Linux needing the open-source Cryptnox FIDO2 HID bridge), and what Click-to-Tap is NOT: not a PIN replacement, not a security boundary, not a secure element, not applicable to eID/PIV/CAC cards. Protected by Austrian utility model GM 55114/2025, German utility model No. 202025108028.1 and US patent application No. 19/534.472 (pending) +- [Click-to-Tap — FIDO2 User Presence on a Desktop Reader](https://docs.cryptnox.com/cryptnox-readers/click-to-tap.html): FIDO2/WebAuthn requires a user-presence check on every authentication. A USB security key has a touch button; a smart card in an ordinary contact reader has none, so the card must normally be pulled out of the slot and reinserted once per sign-in. The Cryptnox Click-to-Tap button drives a controlled extraction-and-reinsertion sequence at the protocol level, with no mechanical movement, so the card stays seated. Requires Cryptnox FIDO2 smart cards and Windows; on macOS and Linux the button has no effect and the device remains a standard CCID/PC-SC reader. Covers usage steps, troubleshooting (button does nothing, service never prompts, card not detected, FIDO2 on Linux needing the open-source Cryptnox FIDO2 HID bridge), and what Click-to-Tap is NOT: not a PIN replacement, not a security boundary, not a secure element, not applicable to eID/PIV/CAC cards. Protected by Austrian utility model GM 55114/2025, German utility model No. 202025108028.1 and US patent application No. 19/534.472 (pending) ## Smart card reader compatibility by country -- [Smart Card Reader Compatibility by Country](https://docs.cryptnox.com/reader-compatibility.html): which national eID and professional smart cards work with Cryptnox USB contact and contactless readers, country by country, with the official government middleware required for each. Covers Belgium (Belgian eID), Czechia (eObcanka), Estonia (ID-kaart), Germany (Fahrerkarte, Personalausweis/AusweisApp), Hungary, Italy (TS-CNS, CIE), Latvia, Luxembourg, Netherlands (UZI-pas/SafeSign), Poland (e-dowod), Portugal (Cartao de Cidadao), Romania, Slovakia, Spain (DNIe), Sweden (SITHS), Finland (FINeID), UK/Ireland (tachograph, NHS Smartcard), UAE (Emirates ID), US/Canada (CAC/PIV), and ICAO 9303 travel documents. States explicitly what the readers cannot do: 125 kHz cards, iPhone/iPad, on-device PIN entry, and PIV/CAC login over contactless +- [Smart Card Reader Compatibility by Country](https://docs.cryptnox.com/cryptnox-readers/reader-compatibility.html): which national eID and professional smart cards work with Cryptnox USB contact and contactless readers, country by country, with the official government middleware required for each. Covers Belgium (Belgian eID), Czechia (eObcanka), Estonia (ID-kaart), Germany (Fahrerkarte, Personalausweis/AusweisApp), Hungary, Italy (TS-CNS, CIE), Latvia, Luxembourg, Netherlands (UZI-pas/SafeSign), Poland (e-dowod), Portugal (Cartao de Cidadao), Romania, Slovakia, Spain (DNIe), Sweden (SITHS), Finland (FINeID), UK/Ireland (tachograph, NHS Smartcard), UAE (Emirates ID), US/Canada (CAC/PIV), and ICAO 9303 travel documents. States explicitly what the readers cannot do: 125 kHz cards, iPhone/iPad, on-device PIN entry, and PIV/CAC login over contactless ## Blockchain address control attestation (proof a wallet address is yours) diff --git a/docs/source/_extra/reader-compatibility.html b/docs/source/_extra/reader-compatibility.html new file mode 100644 index 0000000..e5933e8 --- /dev/null +++ b/docs/source/_extra/reader-compatibility.html @@ -0,0 +1,13 @@ + + + + +Moved — Cryptnox Docs + + + + + +

This page has moved to https://docs.cryptnox.com/cryptnox-readers/reader-compatibility.html.

+ + diff --git a/docs/source/_extra/robots.txt b/docs/source/_extra/robots.txt index 4c148af..7ac710f 100644 --- a/docs/source/_extra/robots.txt +++ b/docs/source/_extra/robots.txt @@ -7,3 +7,4 @@ Sitemap: https://docs.cryptnox.com/cryptnox-hardware-wallet/v2.0/sitemap.xml Sitemap: https://docs.cryptnox.com/cryptnox-hardware-wallet/v1.6/sitemap.xml Sitemap: https://docs.cryptnox.com/cryptnox-sdk-py/sitemap.xml Sitemap: https://docs.cryptnox.com/cryptnox-cli/sitemap.xml +Sitemap: https://docs.cryptnox.com/cryptnox-readers/sitemap.xml diff --git a/docs/source/_extra/sitemap-docs.xml b/docs/source/_extra/sitemap-docs.xml index 719d60b..5acd849 100644 --- a/docs/source/_extra/sitemap-docs.xml +++ b/docs/source/_extra/sitemap-docs.xml @@ -15,9 +15,8 @@ https://docs.cryptnox.com/cryptnox-sdk-arduino/cryptnox-sdk-arduino.pdf https://docs.cryptnox.com/cryptnox-sdk-cpp/ https://docs.cryptnox.com/cryptnox-sdk-cpp/cryptnox-sdk-cpp.pdf + https://docs.cryptnox.com/cryptnox-readers/ + https://docs.cryptnox.com/cryptnox-readers/cryptnox-readers.pdf https://docs.cryptnox.com/genindex.html - https://docs.cryptnox.com/reader-compatibility.html - https://docs.cryptnox.com/click-to-tap.html https://docs.cryptnox.com/address-control-attestation.html - https://docs.cryptnox.com/fido2-compatibility.html diff --git a/docs/source/click-to-tap.rst b/docs/source/click-to-tap.rst deleted file mode 100644 index 6b65713..0000000 --- a/docs/source/click-to-tap.rst +++ /dev/null @@ -1,122 +0,0 @@ -:description: What the Cryptnox Click-to-Tap button does, why FIDO2 sign-in on a desktop contact reader needs it, what it requires, and how to troubleshoot it. -:orphan: - -.. meta:: - :description: What the Cryptnox Click-to-Tap button does, why FIDO2 sign-in on a desktop contact reader needs it, what it requires, and how to troubleshoot it. - -============================================================ -Click-to-Tap: FIDO2 User Presence on a Desktop Reader -============================================================ - -*Last reviewed: 29 August 2026.* - -This page explains one button: what it is for, what it requires, and what it does not do. - -The problem it solves -===================== - -FIDO2 and WebAuthn require a **user-presence check** on every authentication. The -authenticator must prove that a human, and not software running unattended in the -background, approved the sign-in. It is a deliberate part of the standard, not an -implementation detail. - -A USB security key satisfies that check with a metal touch button. A smart card does not -have one. When the card sits in an ordinary contact reader, the only gesture left that the -host recognises as "a person did something" is **removing the card from the slot and -inserting it again** — once per sign-in. - -That is slow, it wears the card contacts and the reader connector, and the card is out of -the reader at exactly the moment the user is trying to work. - -How Click-to-Tap works -====================== - -Pressing the button drives the smart-card interface through a controlled -**extraction-and-reinsertion sequence at the protocol level**. There is no mechanical -movement: the card is never physically ejected. The host sees the card leave and return, -which is the event it was waiting for, and the card stays seated in the slot. - -The effect is the contactless "tap" gesture, delivered on a contact-mode card. - -Requirements -============ - -.. list-table:: - :header-rows: 1 - :widths: 26 74 - - * - Requirement - - Detail - * - Card - - **Cryptnox FIDO2 smart cards only.** The button drives a Cryptnox-specific - signalling sequence; it is not a generic CCID feature. - * - Operating system - - **Windows.** The button has no effect on macOS or Linux. - * - Reader - - The Cryptnox Click-to-Tap USB-C contact reader. The contactless reader has no - button and does not apply. - * - Software - - None for the button itself. The reader is a standard USB CCID / PC-SC device and - uses the smart-card stack already present in Windows. - -With any other card, or on any other operating system, the device remains a fully -functional standard CCID / PC-SC contact reader — you simply do not get the tap -simulation. - -Using it -======== - -1. Plug the reader into a USB port. The indicator confirms it has power. -2. Insert the Cryptnox FIDO2 card into the full-size slot, chip contacts down. -3. Sign in to a FIDO2 / WebAuthn service as usual and choose the security key. -4. When the prompt asks you to **tap your security key**, press the button on the reader. -5. The sign-in completes. Leave the card in the slot for the next one. - -Troubleshooting -=============== - -**The button does nothing.** -Check the three requirements above in order: it must be a Cryptnox FIDO2 card, on Windows, -in the Click-to-Tap reader. Any one of the three missing produces exactly this symptom, -with no error message. - -**The service never asks me to tap.** -Then there is nothing for the button to answer. Some services complete without a -user-presence prompt, and some browsers prompt only on first registration. The button is -only meaningful while a prompt is waiting. - -**The card is not detected at all.** -That is a reader or middleware question, not a Click-to-Tap question. Confirm the card is -seated with the contacts facing down and fully inserted. On Linux, install ``pcscd``, -``libccid`` and ``pcsc-tools``, then check that ``pcsc_scan`` sees the reader. - -**FIDO2 sign-in does not work on Linux.** -Browsers on Linux expect an HID FIDO interface, which a CCID reader does not present by -itself. Install the open-source `Cryptnox FIDO2 HID bridge -`__. Note that this enables FIDO2 -sign-in on Linux — it does not enable the Click-to-Tap button, which remains Windows-only. - -**I want to use the button with my eID, PIV or CAC card.** -Not possible, and not a defect. Click-to-Tap answers a FIDO2 prompt. Government cards -authenticate through their own middleware and are unaffected by it. See -:doc:`reader-compatibility` for what those cards need. - -What Click-to-Tap is not -======================== - -* **Not a replacement for the PIN.** User presence and user verification are different - checks. The card's PIN policy is unchanged. -* **Not a security boundary.** The button is a convenience for a gesture the standard - requires; it neither adds nor removes cryptographic protection. -* **Not a secure element.** The reader holds no keys, stores nothing and signs nothing. - Every cryptographic operation happens on the card. -* **Not applicable to contactless cards**, which already tap physically. - -Provenance -========== - -The Click-to-Tap virtual-button signalling is Cryptnox-engineered firmware layered on the -standard USB CCID interface; the underlying reader hardware is a commodity component. The -button is protected by registered Austrian utility model **GM 55114/2025**, registered -German utility model **No. 202025108028.1**, and United States patent application -**No. 19/534.472** (pending). diff --git a/docs/source/fido2-compatibility.rst b/docs/source/fido2-compatibility.rst deleted file mode 100644 index e27dc56..0000000 --- a/docs/source/fido2-compatibility.rst +++ /dev/null @@ -1,386 +0,0 @@ -:description: Which services and operating systems work with a Cryptnox FIDO2 NFC card, as second-factor or passwordless sign-in, and where extra software is needed. - -:orphan: - -.. meta:: - :description: Which services and operating systems work with a Cryptnox FIDO2 NFC card, as second-factor or passwordless sign-in, and where extra software is needed. - -================================================= -FIDO2 Card Compatibility — Services and Platforms -================================================= - -*Last reviewed: 26 August 2026.* - -This page answers: **will a Cryptnox FIDO2 card sign me in to a given service, on the -device I actually use?** - -The answer is never a single yes or no, because FIDO2 compatibility has two independent -halves. Read your **platform** row, read your **service** row, and take the intersection. - -.. contents:: On this page - :local: - :depth: 1 - - -Table A — platform and transport -================================ - -This decides **which protocol is available at all**. It is a property of the operating -system and the connection, not of the service. - -.. list-table:: - :header-rows: 1 - :widths: 16 20 22 42 - - * - Platform - - Transport - - Protocol available - - Notes - * - **Windows 10/11** - - NFC reader or contact reader - - full FIDO2 / CTAP2 - - Broadest support. Works across all major browsers. - * - **iOS** - - NFC (hold card to top of phone) - - FIDO2 / CTAP2 - - iPhone 7 and later, iOS 13.3+. - * - **Android** - - NFC - - **CTAP1 / U2F only** - - Android does **not** support CTAP2 over external NFC security keys. Most services - keep U2F backward compatibility, so second-factor sign-in works — but see the - worked example below. - * - **macOS** - - NFC reader or contact reader - - varies - - Support differs by macOS version and browser. Test before relying on it. - * - **Linux** - - contact reader - - FIDO2 **via a bridge** - - Browsers expect a HID interface; CCID smart card readers do not present one. - Requires the open-source `Cryptnox FIDO2 HID bridge - `_, a small daemon that presents - the card to the browser as an HID-FIDO device. **This applies to every FIDO2 use on - Linux** — second factor, passwordless, everything. - -Table B — services -================== - -This decides **what the service accepts**. Nearly every service that supports security -keys uses them as a **second factor**; passwordless is a smaller, explicitly enabled set. - -.. list-table:: - :header-rows: 1 - :widths: 22 16 18 44 - - * - Service - - Second factor - - Passwordless - - Setup guide - * - **Microsoft** (Entra ID / Account) - - yes - - **yes** (Entra ID) - - `guide `__ · `overview `__ - * - **Google** - - yes - - **yes** (Advanced Protection) - - `guide `__ · `overview `__ - * - **AGOV** (Switzerland) - - yes - - **yes** - - `registration guide `__ - * - **SwissID** (Switzerland) - - yes - - — - - `registration guide `__ - * - **login.gov** (United States) - - yes - - **no** - - Always requires a password in addition to MFA — the key is a second factor, never - the only one. `overview `__ - * - **Apple** - - yes - - — - - `overview `__ - * - **GitLab** - - yes - - — - - `guide `__ - * - **Facebook** - - yes - - — - - `guide `__ - * - **X / Twitter** - - yes - - — - - `guide `__ - * - **Cloudflare** - - yes - - — - - `overview `__ - * - **Shopify** - - yes - - — - - `overview `__ - * - **Binance** - - yes - - — - - `overview `__ - * - **Coinbase** - - yes - - — - - `overview `__ - * - **Bitfinex** - - yes - - — - - `overview `__ - * - **Bank of America** - - yes - - — - - `overview `__ - * - **Dropbox** - - yes - - — - - `overview `__ - * - **NordVPN** - - yes - - — - - `overview `__ - * - **Fastmail** - - yes - - — - - `overview `__ - * - **GoDaddy** - - yes - - — - - `overview `__ - * - **SSH** - - yes - - — - - `guide `__ - -A dash under *Passwordless* means the service has not enabled FIDO2-only sign-in, or we -have not confirmed that it has — not that it is impossible. Test before relying on it. - - -The composition rule -==================== - -**Your answer is the intersection of your platform row and your service row.** Both must -allow what you are trying to do. - -The worked example is **Microsoft on Android**: - -* the card is CTAP2-capable ✅ -* Microsoft Entra ID is CTAP2-capable ✅ -* **the combination still fails** ❌ - -Android speaks only CTAP1/U2F over an external NFC key, and Microsoft requires CTAP2 with -user verification on every attempt — it does not accept U2F credentials. Use a reader on -Windows, or NFC on iPhone. - -That single case teaches the whole model: **capability is not the same as a usable path.** -A component being able to do something says nothing about whether the platform in front of -it will ask. - -Two related consequences worth stating plainly: - -* **One card can appear twice in an account.** Registering the same card over CTAP1 on - Android and CTAP2 on desktop creates two separate credentials. That is expected. -* **Cryptnox FIDO2 is listed by Microsoft** for Entra ID attestation (AAGUIDs - ``9c835346-796b-4c27-8898-d6032f515cc5`` and - ``1d1b4e33-76a1-47fb-97a0-14b10d0933f1``, both NFC). Attestation eligibility is not the - same as passwordless support, and individual server implementations of CTAP1 vary. - - -What these cards cannot do -========================== - -* **Passwordless everywhere.** These are **MFA-first**: a hardware second factor on top of - a password. Passwordless works only where a service has explicitly enabled FIDO2-only - sign-in. login.gov is the clearest counter-example — it always requires a password. -* **CTAP2 over Android NFC.** Second-factor U2F works on most services; Microsoft does not. -* **Linux without the bridge.** A CCID reader alone will not satisfy a browser. -* **Fingerprint on the card.** FIDO2 user verification on these cards is **PIN-based**. -* **Migrate credentials between cards.** Each card holds its own keys. A replacement card - must be registered with each service again. -* **Act as a USB device.** These are NFC and contact smart cards, not USB tokens. - - -Common questions -================ - -**Does a FIDO2 security key card work with Android over NFC?** -Yes for second-factor sign-in on most services, because Android supports CTAP1/U2F over -external NFC keys and most services keep U2F backward compatibility. It does not work with -Microsoft, which requires CTAP2 with user verification. - -**Which services support passwordless sign-in with an external NFC card?** -A small set that has explicitly enabled FIDO2-only login — Microsoft Entra ID, Google -Advanced Protection and AGOV among them. Most services accept the key only as a second -factor on top of a password, and login.gov always requires one. - -**Why does my security key appear twice in my account settings?** -Because CTAP1 and CTAP2 registrations create separate credentials. Registering the same -card on an Android phone and on a desktop produces two entries. Both work. - -**What decides whether a given service and device combination works?** -Three things: the card's capability, the platform's protocol support, and what the service -accepts. In practice the platform is the usual blocker — most notably Android, which -speaks only CTAP1 over external NFC keys. - -**Do I need extra software?** -On Linux, yes — the open-source Cryptnox FIDO2 HID bridge, for every FIDO2 use. On Windows, -macOS and iOS, no. Setting or changing the card PIN uses the Cryptnox app. - - -Related -======= - -* `FIDO2 card technical specifications `__ -* `Using the card with Android `__ -* `Windows setup guide `__ -* `Setting the card PIN `__ -* `Managing credentials on the card `__ -* :doc:`Smart card reader compatibility by country ` - - -.. raw:: html - - diff --git a/docs/source/index.rst b/docs/source/index.rst index dbaafad..d4b71bc 100644 --- a/docs/source/index.rst +++ b/docs/source/index.rst @@ -189,9 +189,7 @@ smart cards to Windows, macOS and Linux over USB-C. Both readers support extende which is what national eID schemes and ICAO 9303 travel documents require for certificates and signatures larger than the 255/256-byte short-APDU limit. -* **Smart Card Reader Compatibility by Country** [`HTML `__] — national eID and professional card compatibility per country, with the official government middleware required for each -* **FIDO2 Card Compatibility — Services and Platforms** [`HTML `__] — which services and operating systems work with a Cryptnox FIDO2 NFC card, second-factor or passwordless, and where extra software is needed -* **Click-to-Tap — FIDO2 User Presence on a Desktop Reader** [`HTML `__] — what the Click-to-Tap button does, why FIDO2 sign-in on a contact reader needs it, its requirements, and troubleshooting +* **Smart Card Readers Documentation** [`HTML `__] [`PDF `__] ------------------------- diff --git a/docs/source/reader-compatibility.rst b/docs/source/reader-compatibility.rst deleted file mode 100644 index 760a301..0000000 --- a/docs/source/reader-compatibility.rst +++ /dev/null @@ -1,651 +0,0 @@ -:description: Which national eID and smart cards work with Cryptnox USB smart card readers, country by country, with the official government middleware required for each. -:orphan: - -.. meta:: - :description: Which national eID and smart cards work with Cryptnox USB smart card readers, country by country, with the official government middleware required for each. - -================================================== -Smart Card Reader Compatibility by Country -================================================== - -*Last reviewed: 27 August 2026.* - -This page answers one question, country by country: **will a Cryptnox USB smart card -reader read my national ID or professional card, and what software do I also need?** - -Two rules govern every row on this page. - -**1. The reader is necessary but not sufficient.** -Every national card scheme listed here also requires its own government middleware. A -reader that meets the published specification will still do nothing until that software -is installed. Where a scheme provides no freely installable software, this page says so. - -**2. Contact and contactless are different cards, not different modes.** -A card with gold pads on the surface is a *contact* card and needs the contact reader. A -card read by holding it near the device is *contactless* and needs the contactless reader. -Some cards have both interfaces; many have only one. Getting this wrong is the single most -common cause of a reader "not working". - -.. contents:: Countries on this page - :local: - :depth: 1 - - -The two readers -=============== - -.. list-table:: - :header-rows: 1 - :widths: 22 39 39 - - * - - - Contact reader - - Contactless reader - * - Interface - - ISO/IEC 7816, Class A/B/C (5 V / 3 V / 1.8 V) - - ISO/IEC 14443 Type A **and** Type B, 13.56 MHz - * - Protocols - - T=0 and T=1 - - 106 / 212 / 424 / 848 kbps - * - Extended APDU - - Yes - - Yes - * - Stack - - PC/SC 2.0, USB-IF CCID, Microsoft WHQL - - PC/SC, USB 2.0 CCID - * - Card power - - up to 500 mA - - not applicable - * - Operating systems - - Windows, macOS, Linux — no driver installation - - Windows, macOS, Linux, Android via USB OTG - * - Connector - - USB-C, with a USB-A adapter supplied - - USB-C, with a USB-A adapter supplied - -**Extended APDU support is the specification that decides most of this page.** Certificates -and signatures on modern national cards routinely exceed the 255/256-byte short-APDU limit; -readers without extended APDU fail precisely there, and the failure looks like a broken -card rather than a broken reader. Both Cryptnox readers support it. - - -Click-to-Tap on the contact reader -================================== - -The contact reader carries a button the contactless reader does not: **Click-to-Tap**. It -solves one specific problem, and it has no bearing on any national-card verdict below. - -FIDO2 and WebAuthn require a *user-presence* check on every authentication — proof that a -person, and not software running in the background, approved the sign-in. A USB security -key has a metal touch button for exactly this. A smart card sitting in an ordinary contact -reader has nothing to touch, so the only gesture left is to pull the card out of the slot -and push it back in, once per sign-in. - -Click-to-Tap replaces that gesture. One press drives the smart-card interface through a -controlled extraction-and-reinsertion sequence at the protocol level, with no mechanical -movement of the card, so the card stays in the slot. - -.. list-table:: - :header-rows: 1 - :widths: 28 72 - - * - Requirement - - Detail - * - Cards - - Cryptnox FIDO2 smart cards only. With any other card the device behaves as a - standard CCID / PC-SC contact reader. - * - Operating system - - Windows. On macOS and Linux the button has no effect; the reader itself works - normally on all three. - * - National eID cards - - Not applicable. Click-to-Tap is a FIDO2 feature and does not change whether a - government card can be read — that is decided by the country tables below. - -The button is patented technology: registered Austrian utility model **GM55114/2025**, -registered German utility model **No. 202025108028.1**, and United States patent -application **No. 19/534.472** (pending). - -Full detail, usage steps and troubleshooting: :doc:`click-to-tap`. - - -How to read the verdicts -======================== - -.. list-table:: - :header-rows: 1 - :widths: 18 82 - - * - Verdict - - Meaning - * - **Works** - - Confirmed from the scheme's own published reader requirements *and* from users - reporting generic PC/SC readers in service. - * - **Likely** - - The interface and specification match, but community confirmation is thin or the - scheme itself warns that some readers fail. Test before deploying at scale. - * - **No** - - Interface mismatch, a mandatory homologation we do not hold, or the middleware - does not support this class of reader. - - -Europe -====== - -Belgium — Belgian eID ---------------------- - -**Works with the contact reader.** The Belgian eID is a contact card. Belgian users report -that generic budget readers of any age drive it, and readers well over a decade old remain -in service. The card also carries a contactless interface, but the desktop software path -is the contact one. - -*Middleware:* the free, open-source `eID Middleware and eID Viewer `_. - -Also covers the Kids-ID and the foreigner's card. - -Czechia — eObčanka ------------------- - -**Works with the contact reader.** The Czech Ministry of the Interior publishes a -standards-based specification rather than an approved-model list: ISO 7816, CCID, PC/SC, -with Microsoft WHQL and plug-and-play operation recommended for Windows. The Cryptnox -contact reader meets all of them. - -*Middleware:* `eObčanka klient `_ — the card -manager and identification tools. - -Estonia — ID-kaart ------------------- - -**Works with the contact reader.** Estonia's ID-card runs on the standard USB CCID driver. -The national ID authority notes that any reader capable of retrieving data from the card -can be used, while cautioning that it has only tested certain models itself. - -*Middleware:* `DigiDoc4 and the ID-software suite `_. - -Germany — Fahrerkarte and Personalausweis ------------------------------------------ - -These are two different cards with two different readers, and confusing them is the most -common German support case. - -.. list-table:: - :header-rows: 1 - :widths: 26 12 12 25 25 - - * - Card - - Contact - - NFC - - Middleware - - Verdict - * - **Fahrerkarte** (digital tachograph driver card) - - Yes - - No - - tachograph/DVR software, varies by vendor - - **Works** — contact reader - * - **Personalausweis** (nPA, eID function) - - No - - Yes - - `AusweisApp `_ - - **Works** — contactless reader - * - elektronische Gesundheitskarte (eGK) - - Yes - - partial - - gematik TI stack - - **No** — a gematik-approved terminal is mandatory - -The Personalausweis eID function requires **extended length** APDU support: its -certificates exceed 400 bytes and many inexpensive NFC readers cap at 261. AusweisApp -states that a reader may work even if it is not on the tested list. - -Hungary, Latvia, Romania, Slovakia ----------------------------------- - -All four issue contact eID cards that work with the contact reader: - -* Hungary — eSzemélyi · `eSzemélyi Kliens `_ -* Latvia — eID · `eParaksts `_ -* Romania — CEI · `CEI app `_ -* Slovakia — eID karta · `eID klient `_ - -Italy — TS-CNS and CIE ----------------------- - -**TS-CNS works with the contact reader.** The health/services card carries a contact chip -and is driven by a per-card driver plus a smart card manager from the official list. - -**CIE 3.0 is contactless only** — it has no contact pads. Italian sources caution that not -every contactless reader drives it reliably, so this is a *Likely*, not a *Works*. - -*Middleware:* `CIE Software `_. - -Luxembourg — eID ----------------- - -**Contactless reader only.** The Luxembourg government's own guidance specifies a -contactless reader for the national eID. - -*Middleware:* `LuxTrust Middleware `_. - -Netherlands — UZI-pas and ZORG-ID ---------------------------------- - -**Contact reader, with an important limit.** The Cryptnox contact reader meets the UZI -register's published reader specification — PC/SC, extended APDU support, and more than -60 mA of card power. - -.. warning:: - - **UZI passes using 4096-bit RSA keys are a separate case.** SafeSign, the UZI - middleware, keys its maximum APDU size to a list of reader names and applies a - 255/256-byte default to any reader not on that list. A 4096-bit RSA signature is 512 - bytes and cannot be returned under that default. Cryptnox readers are **not currently - on that list**, so a UZI pass carrying a 4096-bit key will not complete a signature - until they are added. This is a software list, not a hardware limit — the reader - itself supports extended APDU. Check the UZI register's approved-reader list and your - own software's supported-reader list before ordering. - -*Middleware:* `SafeSign `_. - -The Netherlands has no citizen contact card — DigiD is a phone and app scheme. The Belgian -eID is widely used on Dutch desktops and is covered above. - -Poland — e-dowód ----------------- - -**Contactless reader.** The Polish e-dowód's electronic layer is contactless; there is no -contact chip to read. The reader meets the MSWiA technical requirements: ISO 14443 Type A -and B, extended APDU, PC/SC. - -*Middleware:* the free e-dowód software or the eDO App. - -Poland's tachograph driver card is a contact card and **works with the contact reader**. - -Portugal — Cartão de Cidadão ----------------------------- - -**Works with the contact reader.** Generic readers drive the card; note that some public -service applications are reported to be fussy — that is the application, not the reader. -The contactless interface is restricted to authorities. - -*Middleware:* `Autenticação.gov `_. - -Spain — DNIe ------------- - -**Works with the contact reader.** - -**Not with a desktop contactless reader.** The DNIe chip is dual-interface, but the desktop -software path is not: OpenSC's DNIe driver recognises the contact ATRs only and does not -work over a contactless reader, and the official NFC route (DNIeRemote / DNIeSmartConnect) -uses a *mobile phone* as the reader rather than a USB one. - -*Middleware:* `DNIe software `_. - -Sweden — SITHS --------------- - -**Contact reader, employer-supplied software.** On the hardware side the requirement is -simply PC/SC compatibility, which the contact reader meets. - -.. note:: - - SITHS middleware is **not a free public download**. Net iD requires a commercial - licence, and Inera replaced it with SITHS eID in 2024. In practice the software reaches - the user through their employer. Do not plan on installing it independently. - -Finland's FINeID is a contact card and works with the contact reader, using -`mPollux DigiSign `_ from DVV — note that -DVV has stated this client is available only until the end of 2026. - -Switzerland — health insurance card, SwissPass and the e-ID ------------------------------------------------------------ - -Switzerland produces more wrong expectations than any other country on this page, because -most of what a Swiss resident carries is **not** a PKI smart card. - -.. list-table:: - :header-rows: 1 - :widths: 30 14 14 42 - - * - Card - - Contact - - NFC - - Verdict - * - **Versichertenkarte / VeKa** (health insurance card) - - Yes - - No - - **Works** — contact reader; professional software - * - **SwissPass** (SBB) - - No - - Yes - - Contactless reader, UID only — no certificate to authenticate with - * - **Identity card** (Identitätskarte) - - No chip - - No chip - - **No reader applies** — see the 2026 note below - * - **SuisseID** - - withdrawn - - — - - Discontinued; successor SwissID is an online account, not a card - * - **e-ID** (swiyu wallet) - - — - - — - - Phone app; no card, and no NFC planned at launch - -The **Versichertenkarte** is the one genuine Swiss contact smart card. Its chip follows -`eCH-0064 `_ -and ISO/IEC 7816-4, and it carries insurance data plus optional emergency data. Note the -market: it is read by **medical practice software**, not by a free public download, so this -is a professional use case rather than a consumer one. - -**SwissPass** is a transport credential with ISO/IEC 14443 RFID tags. A contactless reader -sees its UID; there is no certificate on it, so it cannot be used to sign or log in. - -**The Swiss identity card has no chip at all today.** A biometric identity card is planned -for **2 November 2026**, and it will carry a chip of the same family as the biometric -passport — ICAO 9303, **contactless** — while a chip-free card remains on offer. Until then -no reader, of either kind, does anything with a Swiss ID card. - -**The federal e-ID is not a card.** It lives in the state -`swiyu wallet app `_, its introduction has slipped to around -the end of 2026, and NFC is not part of the launch design. No reader is involved. - -United Kingdom and Ireland --------------------------- - -Neither country issues a national eID card. The **digital tachograph driver card** is a -contact card and **works with the contact reader**, as does the **NHS Smartcard** in the UK, -which is a contact smart card issued to health service staff and driven through the -employer's identity agent software. - -Countries where a desktop reader is the wrong tool --------------------------------------------------- - -Published here because knowing what *not* to buy saves more time than another compatible -row: - -.. list-table:: - :header-rows: 1 - :widths: 22 78 - - * - Country - - Why a USB reader is not the route - * - Austria - - The Bürgerkarte was decommissioned in December 2023. ID Austria replaced it and - authenticates by phone or FIDO2 token — no card reader is involved. - * - Bulgaria, Cyprus, Slovenia - - The national schemes are mobile-first by design and steer citizens to a phone app. - * - France - - Carte Vitale and CPS require homologated terminals, which is a certification we do - not hold. The tachograph card is unaffected and works. - * - Greece - - The Greek ID chip is contactless RFID, not a contact chip. - - -Outside Europe -============== - -United States and Canada — CAC and PIV --------------------------------------- - -**Works with the contact reader.** DoD CAC and federal PIV cards are contact cards for -logical access, and the contact reader drives them. - -.. warning:: - - **A contactless reader cannot be used to log in with a PIV or CAC card.** Under - NIST SP 800-73, the card's PIN cannot be verified over the plain contactless interface - — only over the contact interface or a Virtual Contact Interface, and establishing a - VCI requires secure-messaging key establishment plus a pairing code. Without a PIN - there is no authentication. The contactless interface exposes the card's physical - access control credential only. Any product advertising contactless CAC login is - describing its *contact* slot. - -United Arab Emirates — Emirates ID ----------------------------------- - -**Works with either reader.** The Emirates identity authority's own developer -documentation states that any PC/SC reader, contact or contactless, may be used. Note that -the practical audience is organisational — registration desks, telecoms, banks, healthcare -— because the consumer route is the UAEICP phone app. - -*Middleware:* `EIDA SDK Toolkit `_. - - -Travel documents — ICAO 9303 -============================ - -EU Regulation 2019/1157 requires member state ID cards to follow **ICAO Doc 9303**, the -same specification as passports. The contactless reader reads ICAO 9303 electronic -machine-readable travel document chips over ISO 14443 Type A and B, with extended APDU — -which matters, because ePassport data groups routinely exceed the short-APDU limit and -readers without extended APDU fail on them. - -What that does **not** mean: - -* The chip is password-protected. Access keys are derived from the **MRZ** (document - number, date of birth, expiry date) or from the **CAN** printed on the document. -* It requires **MRTD reading software**, which Cryptnox does not supply. -* It yields document data and the facial image only. **Fingerprints are protected by - Extended Access Control and are available to authorities only.** -* It is not the eID authentication or signature function, which is a different applet. - - -What these readers cannot do -============================ - -* **125 kHz cards** — EM4100, HID Prox and similar low-frequency badges. The contactless - reader is 13.56 MHz only. -* **iPhone and iPad** — neither reader works with them. -* **Contact and contactless at the same time** — these are two separate products. -* **PIN entry on the reader** — neither has a keypad, so schemes that mandate on-device - PIN entry are out of scope. -* **Click-to-Tap with a government card** — the button answers the FIDO2 user-presence - prompt for Cryptnox FIDO2 cards on Windows. It has no effect on eID, PIV or CAC sign-in. -* **Guarantee the government's software.** We can state that the reader meets a scheme's - published requirements. We cannot promise how a given public-service application behaves. - - -Common questions -================ - -**What kind of card reader do I need for the Belgian eID?** -A contact smart card reader with PC/SC support, plus the free eID Middleware from -eid.belgium.be. Generic readers work; there is no approved-model requirement. - -**Which USB card readers work with the Czech eObčanka?** -Any reader meeting the Ministry of the Interior's published specification — ISO 7816, -CCID, PC/SC, ideally WHQL-certified and plug-and-play. There is no approved-model list. - -**Does the Click-to-Tap button work with my national eID card?** -No. Click-to-Tap answers the FIDO2 user-presence prompt, and only for Cryptnox FIDO2 smart -cards on Windows. National eID, PIV and CAC cards are unaffected by it: whether they work -depends on their interface and their own middleware, exactly as set out above. - -**Why does my reader work in one country but not another?** -Three things have to line up: the card's interface (contact or contactless), the reader's -specification (PC/SC, extended APDU, voltage class), and the national middleware. In -practice the middleware is the most common blocker — it may support only one interface, be -restricted to an approved list of reader names, or not be publicly downloadable at all. - -**Do I need extended APDU support?** -For the German Personalausweis, ICAO 9303 travel documents, and any scheme using 3072- or -4096-bit RSA keys, yes. Certificates and signatures at those sizes exceed the 255/256-byte -short-APDU limit, and a reader without extended APDU fails on them. - -**Does one reader cover several countries?** -For contact cards, largely yes — Belgium, Czechia, Estonia, Slovakia, Hungary, Latvia, -Romania, Portugal, Spain, Finland and the UK/Irish tachograph card all run on a -standards-compliant PC/SC contact reader. The middleware differs per country; the hardware -does not. - - -Related -======= - -* :doc:`FIDO2 card compatibility — services and platforms ` — which - online services and operating systems work with a Cryptnox FIDO2 card, as a second - factor or passwordless, and where extra software is needed. - - -Sources -======= - -Every verdict on this page is drawn from the scheme's own published reader requirements -and, where available, from user reports of generic readers in service. Government -middleware pages are linked inline above. Standards referenced: ISO/IEC 7816, ISO/IEC -14443, ICAO Doc 9303, NIST SP 800-73, EU Regulation 2019/1157. - - -.. raw:: html - -