Skip to content

Smart card · Free JavaCard applet

GIDS Smart Card

Turn a low-cost JavaCard into a PKI smart card that Windows reads and writes with its own driver — and that Linux and macOS use through OpenSC.

Download View on GitHub

Free and open source · GIDS Applet 1.3 · Initialization Tool 2.0

Overview

The Generic Identity Device Specification (GIDS) is a smart card standard defined by Microsoft. Its driver ships with every Windows since Windows 7 SP1, and unlike the PIV driver, it is a read and write driver: Windows itself generates keys on the card, writes certificates, changes and unblocks the PIN. Nothing to install on the computers.

GIDS Applet is a free, open-source JavaCard applet that implements this specification. Load it on any compatible JavaCard, initialize the card once, and it becomes a PKI smart card for Windows logon, certificates, signature and encryption — and, through OpenSC, for Linux and macOS.

No driver, read and write
Key generation, certificate enrollment and PFX import with the GIDS minidriver built into Windows. The card is recognized as “Identity Device (Microsoft Generic Profile)”.
PIN managed by Windows
Change the PIN with Ctrl+Alt+Del. A blocked PIN is unblocked on the same screen, with a challenge/response computed from the card's admin key.
Linux and macOS
OpenSC supports GIDS natively: Ubuntu logon with the card (SSSD), PKCS#11 for SSH, browsers and OpenSSL, key generation and PIN change.
One card, both worlds
A key generated by Windows is used by SSH on Linux, a key generated on Linux is listed by Windows — tested on the same card.
Smart card logon
Domain logon with Active Directory (PKINIT), local accounts with EIDAuthenticate, unlock and Remote Desktop.
Free and open source
The applet is on GitHub. The Initialization Tool is open source too, signed, about 80 KB, with no installation.
From a JavaCard to a GIDS card

No vendor card, no vendor driver: a JavaCard of a few euros and free tools.

  1. GlobalPlatformPro lists what the card holds
  2. Erase: deleting the applet erases its keys and PIN
  3. Install GIDS Applet
  4. Initialize: PIN, admin key, file system
  5. The card is ready for Windows, Linux and macOS
See it in action on Windows

A real JavaCard with GIDS Applet, on Windows 11 with no driver installed:

  1. Initialize the card with the GIDS Initialization Tool and keep the admin key
  2. Windows generates an RSA 2048 key on the card and writes the certificate
  3. The certificate is checked and tested with the PIN
  4. Lock the session and sign in with the card
  5. Change the PIN with Ctrl+Alt+Del

Local account logon by EIDAuthenticate; domain accounts use the logon built into Active Directory.

In an Active Directory domain

The user enrolls the card alone, with the Windows tools:

  1. certmgr.msc › Request New Certificate
  2. Pick the Smartcard Logon template
  3. Type the PIN: the key is generated on the card
  4. Lock the session and sign in to the domain with the card

No middleware on the workstations, no card management system: the domain CA and the driver built into Windows. Step by step.

Why GIDS

Windows ships two generic smart card drivers: PIV and GIDS. Both work without installation, but only GIDS lets Windows write to the card. A PIV card has to be provisioned with the vendor's tools; a GIDS card is provisioned by Windows itself.

GIDS cardPIV card, Windows driverCard with a vendor minidriver
Driver on WindowsBuilt inBuilt inTo install on every computer
Use certificates (logon, signature)YesYesYes
Generate a key, enroll, import a PFX from WindowsYesNo — read-only driverYes
Change the PIN with Ctrl+Alt+DelYesYesDepends on the vendor
Unblock the PIN from WindowsYes, challenge/response with the admin keyNo — PUK with vendor toolsDepends on the vendor
Linux and macOSOpenSCOpenSCVendor PKCS#11 library
CardAny JavaCard 2.2.1+, free appletPIV card or appletThe vendor's card
Screenshots
Initialization Tool Detects the card waiting for its initialization, sets the PIN, a random admin key and the file system.
Dark mode The tool follows the Windows app mode.
Windows asks for the PIN Key generation on the card through the built-in minidriver: the standard Windows Security prompt.
Key and certificate on the card Generated by Windows, written by Windows: no vendor tool involved.
Smart card logon The card and its PIN on the Windows 11 sign-in screen.
Change the PIN Ctrl+Alt+Del, Change a password: old PIN, new PIN, confirmation.
Unblock the PIN The integrated unblock screen shows a challenge; the response comes from the admin key.
Unblocked The card is unblocked and has a new PIN, without leaving Windows.
On Linux and macOS, with OpenSC

The same card, set up on Windows, on Ubuntu 24.04:

  1. Sign in to the desktop with the card and its PIN (GDM and SSSD)
  2. OpenSC reads the certificate created by Windows
  3. SSH with the key of the card
  4. Change the PIN from Linux

OpenSC recognizes GIDS cards natively: no configuration, the card is a PKCS#11 token for SSH, Firefox, OpenSSL or any PKCS#11 application, and SSSD uses it for the logon of local or directory accounts. The output below comes from the card of the videos — Ubuntu 24.04, OpenSC 0.25:

$ pkcs15-tool -D
PKCS#15 Card [GIDS card]:
	Version        : 2
	Manufacturer ID: www.mysmartlogon.com
PIN [UserPIN]
	Flags          : [0x12], local, initialized
	Tries left     : 3
Private RSA Key [32c092ab-53bb-45e8-9285-0c757c37b0fb]
	Usage          : [0x06], decrypt, sign
	Access Flags   : [0x1D], sensitive, alwaysSensitive, neverExtract, local
	ModLength      : 2048
X.509 Certificate [32c092ab-53bb-45e8-9285-0c757c37b0fb]

$ ssh-keygen -D /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDR02nc/AIytXWDrAEIndxsqoTIN6xMXbjLAC/7H4Ws...

$ ssh -I /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so server
Enter PIN for 'GIDS card (UserPIN)':
signed in on server as adiant with the GIDS card

Writing works from Linux as well: a key pair generated with pkcs11-tool --keypairgen --key-type rsa:2048 is listed by Windows (certutil -key -csp "Microsoft Smart Card Key Storage Provider") next to the one Windows generated.

Commands for initialization, enrollment, PFX import, PIN change, unblock and the Linux logon configuration: see the GIDS how-to guide.

Get started in three steps
1. Install the applet
Download GidsApplet.cap and load it with GlobalPlatformPro: gp --install GidsApplet.cap
2. Initialize the card
Run the GIDS Initialization Tool on Windows, or gids-tool --initialize on Linux and macOS. Keep the admin key.
3. Use it
Enroll from your Active Directory CA, import a PFX, or create a certificate with EIDAuthenticate — then log on with the card.

Read the how-to guide Tested cards

Requirements
Card
  • JavaCard 2.2.1 or later, with GlobalPlatform card manager keys to load the applet — see the tested cards
  • requestObjectDeletion() recommended, to free the memory of deleted files
  • No PIV applet on the same card: Windows and OpenSC select PIV first
Computer
  • Windows 7 SP1 / Server 2008 R2 or later; PFX import from Windows 10
  • Linux, macOS: OpenSC
  • RSA 1024 and 2048 with the Windows driver
  • Any CCID smart card reader
FAQ & known issues

The admin key is the only way to unblock the PIN. If the PIN is blocked and the admin key is lost, the card has to be erased: delete and reinstall the applet with GlobalPlatformPro, then initialize it again. The Initialization Tool proposes a random admin key and asks you to copy or save it before initializing.

The Microsoft GIDS minidriver only implements RSA 1024 and RSA 2048. Our findings on the minidriver are documented here.

Yes, from an elevated command prompt once the smart card KSP accepts key import: certutil -csp "Microsoft Base Smart Card Crypto Provider" -importpfx file.pfx, or with OpenSC pkcs15-init on any platform. Details in the how-to guide.

Yes. EIDAuthenticate uses it for local accounts (the video above), SmartPolicy for domain logon with a third-party PKI. EIDVirtual is a port of this applet running on a USB key.

Known issue: Windows and OpenSC select the PIV applet before the GIDS applet: with both on the same card, the GIDS data is not used. Windows also caches the card type by ATR under the Calais registry key — delete that entry or change the ATR to resolve conflicts. On x64 systems, the entry exists in both the normal and the Wow64 registry nodes.