Protocols

CanoKey supports the following protocols:

  • FIDO2
  • OpenPGP Smart Card 3.4
  • PIV (NIST SP 800-73-4)
  • OATH
  • NDEF
  • WebUSB

Besides, CanoKey also provides an additional admin applet to manage the key.

FIDO2

The implementations are following CTAP2.1 and CTAP2.0.

Supported features:

  • Up to 64 resident keys
  • The HMAC extension
  • Ed25519

See the FIDO2 / CTAP2 protocol documentation for the command list, GetInfo contents, supported algorithms and extensions, and firmware-specific behavior.

OpenPGP Smart Card 3.4

CanoKey implements all the mandatory features of the specification. Besides, the following optional features are also implemented:

  • PUT DATA with TAG C4
  • Algorithms
    • RSA 2048 (generate on card / import) / 4096 (import only)
    • ECDSA and ECDH: secp256r1 (NIST P256) / secp384r1 (NIST P384) / secp256k1
    • Ed25519 and X25519

Note that the following features are not supported:

  • KDF
  • Secure Messaging
  • AES
  • Command: MANAGE SECURITY ENVIRONMENT

See the OpenPGP applet protocol documentation for the command list, data objects, supported algorithms, and firmware-specific behavior.

PIV

CanoKey implements the mandatory features of the specification, including biometric and Security Object data objects. It also provides configurable algorithm IDs, PIV attestation, complete Retired Key Management slots, and other extensions.

See the PIV applet protocol documentation for the command list, data objects, supported algorithms, and firmware-specific extensions.

Secure Messaging is not supported.

OATH

Please refer to the OATH documentation.

Admin Applet

Please refer to the Admin Applet documentation.

NDEF

NFC Forum Type-4 Tag.

The maximum capacity of NDEF message is 1022-bytes.

See the NDEF applet protocol documentation for the file layout, commands, and the read-only flag.

WebUSB

Please refer to the WebUSB documentation.