About ActivClient SDKs

The ActivID ActivClient (referred to as ActivClient) SDK is provided as part of ActivID ActivClient for Windows. This SDK enables an integrator to customize and expand the standard ActivClient features.

Companies that want to use some of the standard features in ActivClient and also create their own smart card-based applications should use the ActivClient SDK.

ActivID ActivClient SDK Benefits

  • Provides high-level APIs – the ActivClient SDK allows you to develop smart card applications without any previous knowledge about smart card technology.

    By encapsulating low-level commands (reader management, smart card structure management, smart card insertion and removal, and so on), the ActivClient SDK lets you focus on the security services that you need to develop.

  • Compatible with standards – the ActivClient SDK is based on and leverages several smart card-based standards:

    • Microsoft Cryptography APIs – providing compatibility with Microsoft applications and a wide range of PKI-enabled Windows applications from third-party vendors.

    • PKCS#11 (from RSA Labs) – providing compatibility with a wide range of PKI-enabled applications from third-party vendors; also supports non-PKI services, such as data storage.

    • Smart Card Basic Services Interface (BSI) – defined by the U.S. Government as part of the Government Smart Card - Interoperability Specifications (GSC-IS). For more information, see http://csrc.nist.gov/groups/SNS/smartcard/index.html

    • PIV is the Personal Identity Verification of US Federal Employees and Contractors. For more information, see http://csrc.nist.gov/groups/SNS/piv/index.html.

  • Feature-rich – the ActivClient SDK provides access to multiple security technologies – static passwords, one-time passwords (HID Global-patented mechanism or ANSI X9.9 standard), or a certificate (public key cryptography).

ActivID ActivClient SDK Use Examples

Following are examples of ways of using the ActivClient SDK:

  • Create a smart card PKI application based on PKCS#11.

  • Use the smart card to store private information (confidential records, keys, and so on).

  • Automate the use of ActivID one-time passwords (for user authentication) by integrating communication with the smart card directly inside your application.

ActivID ActivClient SDK Components

The ActivClient SDK:

  • Offers a generic and high-end approach to smart card applications.

  • Provides all information and definitions for integrating ActivClient APIs.

  • Allows to access and use ActivClient smart cards.

To provide choices to application developers and comply with all applicable API standards, the ActivClient SDK supports a variety of APIs:

  • Basic Services Interface (BSI) API

  • Microsoft cryptography APIs (CryptoAPI, Cryptography Next Generation…)

  • PIV API

  • PKCS#11 API

Note: The ActivClient ACOMX API provided in ActivClient 6.x as a public API is now deprecated with ActivClient 7.x. The One-Time Password services previously available in ACOMX are now available in the PKCS#11 API. For further information, see ActivID ActivClient SDK PKCS#11 API.

Use the BSI API if you are developing a multi-credential application.

Supports

PKI and static data such as personal information data. The BSI API and the PKCS#11 API are similar in functionality and scope. They differ in that PKCS#11 is a standard developed by RSA whereas BSI is a standard developed by the US government/NIST. PKCS#11 implements a higher level of abstraction of card objects and services than BSI, which is much lower level than PKCS#11. In addition, BSI supports SKI.

Languages

C, Java; HID Global provides samples in C and Java.

Description ActivClient SDK's BSI API component is an implementation of the Basic Services Interface (BSI) included in the U.S. Government Smart Card - Interoperability Specifications (GSC-IS). The library included in ActivClient SDK implements a subset of BSI API v2.1. This API provides cryptographic, data storage, and utility services.

The BSI API:

  • Provides support for:

    • Smart card cryptographic and data storage operations.

    • Smart card state and reader state management.

    • Data storage.

    • PIN management.

  • Is recommended for developers who want to perform smart card cryptographic operations and/or some data storage. While the BSI API hides most of the complexity of working with smart cards, it requires more knowledge of smart cards than other ActivClient APIs require.

For more information, see ActivID ActivClient SDK BSI API.

Use Microsoft cryptography APIs for Microsoft PKI-based applications.

Supports

PKI

Languages

C++; HID Global provides a sample in C++ in a Universal Windows application with Windows::Security::Cryptography namespace.

Description HID Global’s ActivClient Mini Driver library is compliant with Microsoft Cryptographic APIs. It is used by the ActivClient product for secure Windows PKI logon, for secure email (S/MIME with Outlook and Outlook Express), and for secure Web access (SSL in Internet Explorer).

Microsoft Cryptography APIs:

  • Abstracts the smart card data model and is primarily focused on cryptographic operations.

  • Is recommended for:

    • Developers who want to create PKI-enabled applications but do not need to manage the smart card state (card insertion and removal, PIN change).

    • Use with applications dedicated to the Microsoft Windows environment and that leverage the Microsoft Cryptography APIs infrastructure.

Supported Microsoft cryptography APIs are:

  • Smart Card MiniDriver API

  • Microsoft Cryptography APIs: CryptoAPI (CAPI) using Microsoft Base Smart Card Crypto Provider (CSP).

  • Microsoft Cryptography Next Generation (CNG) API using Microsoft Smart Card Key Storage Provider (KSP)

  • Universal Windows Cryptography API (Windows::Security::Cryptography namespace)

  • .Net Framework API (System.Security.Cryptography namespace)

For more information, refer to the Microsoft API Documentation.

Use this API for PKI based application using PIV End Point card or PIV data retrieval.

Supports

PKI and PIV data access, as well as mutual authentication and external authentication.

Languages

C, Java; HID Global provides samples in C and Java.

Description ActivClient SDK’s PIV API is an implementation of Personal Identity Verification (PIV) Middleware API as per National Institute of Standard and Technology (NIST) SP800-73-4 specifications. This API provides cryptographic, data storage, and utility services for FIPS 201 PIV-compliant cards.

The ActivClient PIV API:

  • Provides support for

    • Smart card cryptographic and data storage operation

    • Client-based management on smart cards and smart card readers

  • Is recommended for developers who want to perform smart card cryptographic and data retrieval operations specifically on FIPS 201 PIV-compliant cards.

For more information, see ActivID ActivClient SDK PIV API.

Use this API to create generic PKI-based applications.

Supports

PKI and static passwords.

Languages

C, Java; HID Global provides samples in C and Java.

Description ActivClient SDK’s PKCS#11 API is a generic implementation of the PKCS#11 v2.20 standard.

The PKCS#11 API:

  • Provides support for:

    • Smart card cryptographic operations.

    • Client-based management of smart cards and smart card readers.

  • Is recommended for developers who want to:

    • Perform smart card cryptographic operations, use data storage, or have close control of the smart card state (card insertion and removal and PIN entry and change).

    • Reuse their code on a non-Windows platform.

For more information, see ActivID ActivClient SDK PKCS#11 API.

Note: ActivClient provides separate samples to work with IAIK PKCS#11 wrapper. For more information, refer to Readme.txt in JavaSampleIAIK folder in the distribution package.

64 and 32-bit Versions

ActivClient x64 provides 64-bit editions of these APIs and also supports 32-bit editions of the APIs for compatibility with 32-bit applications that rely on the 32-bit APIs.

The ActivClient SDK provides support for integrators implementing applications that rely on ActivClient APIs on 64-bit platform. The SDK package provides API documentation and dependency files (header, lib).

Samples are available in Java, C++ and C language (source code and compiled binary).

For each API, the SDK provides:

  • Dependency files (header, lib).

  • C or C++ (both 32-bit and 64-bit samples): source code and binaries, functional only on 64-bit platform.

  • Documentation: PDF versions of the reference guides are available for all APIs (except the Microsoft Cryptography APIs for which you should refer to the Microsoft documentation instead). Javadoc is available for BSI and PIV.

  • Additional samples provided – For PIV, BSI, and PKCS#11 only, a Java wrapper sample and binaries which can be run only on 64-bit platform.

Interoperability

The ActivClient SDK focuses on providing card usage services for cards that have already been issued. The ActivClient SDK interoperates with other tools that provide other capabilities:

Goal Tool
Issue smart cards ActivID Credential Management System (CMS)
Customize ActivClient setup or configure ActivClient options For more information, see the ActivID ActivClient for Windows Administration Guide which provides customization, deployment and configuration instructions.
Create new Java Card applets Java Card Development Kit (available from Oracle at http://www.oracle.com and from card vendors)