AKİS

AKİS Solutions

AKiS PKI

Developed in compliance with ISO/IEC 7816 standards, the AKiS PKI smart card family - comprised of AKiS v2.2, v2.5, and v2.6 - provides a secure, interoperable, and reliable foundation for digital identity and electronic signature solutions.

AKiS PKI products enable strong authentication, digital signing, and secure access across various public and private sector applications. Their advanced Public Key Infrastructure (PKI) architecture supports a wide range of cryptographic algorithms and ensures high levels of security and data integrity.

With their proven performance in e-Government, corporate, and financial systems, AKiS PKI smart cards help institutions establish trusted digital identities, safeguard transactions, and build a resilient digital ecosystem aligned with global standards.

Akis Ticket

Technicial Features

  • ISO/IEC 7816-3 contact-based communication
  • ISO/IEC 7816-4, 8, 9 compliant APDU command set
  • Secure messaging with AES-256
  • Hash computation (SHA-1, SHA-256, SHA-384, SHA-512)1
  • Random Number Generator (RNG)2
  • Card Verifiable Certificates3
  • Role-based access control mechanism
  • RSA Digital Signature Generation and Decryption3
  • RSA key pair generation4
  • ECDSA digital signature generation (ECC 128–640 bits)5
  • ECC key pair generation (ECC 128 - 640 bit range)5
  • Cryptographic checksum computation (DES3 MAC/CMAC/RetailMAC, AES MAC/CMAC)5
  • Symmetric encryption/decryption (DES3, AES: CBC, ECB, GCM)6
  • Wrap/Unwrap Key7
  • ECDH Key Derivation7
  • Session-based symmetric key generation7
  • Session-based ECC key pair generation7
  • Common Criteria (CC) EAL 4+ security evaluation
  • Support for multiple chip platforms8
    • UKTUM-H v7.01
    • Infineon SLE78CFX2400P
    • NXP P71D320P, P71D352P
  • PKCS#119 driver support
  • Support for CSP and Minidriver10

1 AKiS v2.2 supports SHA-1 and SHA-256 only.
2 AKiS v2.2 supports true random number generation, whereas AKiS v2.5 and v2.6 support Hybrid Deterministic random number generation.
3 AKiS v2.5 supports RSA 1024–2816 bits, AKiS v2.6 supports RSA 1024–2688 bits, whereas AKiS v2.2 supports RSA 1024 bits and 2048 bits only.
4 AKiS v2.5 supports RSA 1024–2816 bits, AKiS v2.6 supports RSA 1024–2688 bits, whereas AKiS v2.2 supports RSA 2048 bits only.
5 AKiS v2.5 and v2.6 only.
6 AKiS v2.5 and v2.6 only (block type GCM supported by AKiS v2.6 only).
7 AKiS v2.6 only.
8 Hardware platforms are certified for CC EAL 5+ or above.
9 MS Windows, Linux and MacOS operating systems.
10 MS Windows operating system only.

Search

Quick Links

Support
Main Menu
Follow Us
LinkedIn Instagram YouTube X-Twitter Facebook

© 2026 TÜBİTAK BİLGEM | All Rights Reserved.

b9d315a2af7a2f6e23611af9a7d3ea05e
5c3b8a224583f19d949d721947f9060

4da2fdefa951bd7dcebd14dfc8d1fab36
93cc2c6be2a6a3339deea42b96bc4fc

628b983b97837b56f92b2c2fd9f7f25e
ab989a7fc0289b14d3b9e7b16be82208

ec11ca282b33844be9a53df663b3460
655ba9441814477a6bcafc4f429112af9

ed43b8055d348f0e05dd7df1dd517882
40fbb89264ab6ea45b7c1d3f7d05af9a

e71e374bd3e3184dbedb30f7d884a4db9
10bd9604b4ee7bb0c594d813697d4b4

c62eb06af9e5e0b9e5d7c8769302bf13
db53abe6a48a6df999251511d34a3dda

f5c13be5338f4208539f9551fc7865302
000e2153370d512052db4d0557e89d5

8dc864309d0acd1e672a344032f145052
e0c644fb3c3ea02cd217f44e3646d53
572ed2c825e1631e6ab095e635cfb630b
3e3d3f73595c02a7b765882d65e2895
3476C511A7CF7F2BF354394BBB53F36DC
6BD48E64CBF20ACD2D9851D748CFC3F
8A3D6DBDFD500F165987FF892FF114058
4516F8FF2270026D0FD2CD53ACDD2BF
8D939CB7BD3B2381399462A7A5AC7D14
760DC330A65814BD01E20F121E073A0E
E2EFC0FC98E48D6984289E21194ADF2A
5993D0220F65A7AEA9F2791222D0A1A2
ticket

AKİS TICKET / OSPT Cipurse-Based Smart Card for the e-Payment and Ticketing Application

AKiS BiLET, developed by TÜBİTAK BİLGEM—a member of the OSPT Alliance—runs on the domestically developed smart card operating system (AKİS) and is based on CIPURSE1 It is a contactless smart card technology. AKiS BiLET is specifically designed to be used as a payment method in electronic fare collection systems in the transportation sector, thanks to its advanced security infrastructure, low costs, and compliance with open standards. It is also the first domestically developed smart card solution for contactless card applications such as access control and parking systems.

KEY FEATURES

  • Contactless data rate: 848 kbit/s
  • 13.56 MHz operating frequency
  • ISO/IEC 14443-4 protocol layer support
  • ISO/IEC 7816-compliant file system
  • APDU command set compliant with ISO/IEC 7816-4 and ISO/IEC 7816-92
  • 8 applications, configurable2
  • 32 files per application, configurable2
  • Binary Files, Linear Record Type, Circular Record Type, Value Record Type Files
  • Consistent Transaction3 mechanism
  • Support for Multiple Applications
Technicial Features

SECURITY FEATURES

  • Hardware platform with a CC EAL 6+ security level
  • True Random Number Generator (TRNG)
  • AES-1284, 128-bit advanced encryption mechanism
  • 8 AES-128 security keys for each application
  • Easy and flexible and key management system
  • Resistant to Differential Power Analysis (DPA) attacks
  • Resistant to Differential Fault Analysis (DFA) attacks
  • Mutual Authentication (AES-128) Based on ISO/IEC 9798-2
  • ISO/IEC 7816-4-based Secure Messaging modes (Plain, AES MACed, AES ENCed)
  • Data Integrity Protection
  • File-Based Access Authorization and Secure Messaging

APPLICATION AREAS

  • eTicket apps
  • Employee Attendance Control Systems
  • Access control systems
  • Parking systems
  • Libraries
  • Health, social assistance, loyalty, and similar card programs

CIPURSE
OPEN STANDARDS
CIPURSE open standards provide a proven technology infrastructure based on the ISO/IEC 7816 and ISO/IEC 14443 standards and AES-128 to deliver secure, flexible, and standardized electronic toll collection solutions.

INDEPENDENT TECHNOLOGY
Platform-independent: CIPURSE technology can be implemented on any smart card chip that meets all specifications, as well as on NFC SIM cards or JavaCards as an applet.

Vendor-independent: CIPURSE technology was developed not as a proprietary solution for a specific manufacturer, but as a standard and open technology that anyone who wishes to do so can implement. Today, many companies—including TÜBİTAK—are developing CIPURSE products, and the number of these companies is steadily increasing.

Card reader independent: No modifications are required to existing card readers to communicate with CIPURSE cards. CIPURSE technology can be used with all smart card readers that support the ISO/IEC 14443 Type A L4 standards.

1 The CIPURSE open specifications are published by the OSPT Alliance.
2 Applies only to the CIPURSE T Profile.
3 By ensuring that the data to be written to the card is written completely in a single pass, it helps prevent communication problems
A mechanism that prevents potential data corruption.
4 AES (Advanced Encryption Standard), ISO/IEC 18033-3:2010 & FIPS 197.

esrc

AKİS GEZGİN e-Driver's License App

The AKiS GEZGiN e-Driver's License application complies with the ISO/IEC 18013 standards (ISO/IEC 18013-3:2009 and ISO/IEC 18013-3:2017)1 It has been developed to be compliant. Thanks to the Basic Access Protection (BAP) feature, the information on the contactless chip can only be read via secure communication, and the Active Authentication feature prevents the passport from being copied. Thanks to the Extended Access Protection (EAP) feature (compliant with ISO/IEC 18013-3:2009), all files (DG1–DG24); and the Extended Access Control (EAC) feature (compliant with ISO/IEC 18013-3:2017) ensures that personal biometric data (DG3 and DG4) is protected. EAP/EAC ensures that only authorized readers can access these data groups.

The AKiS GEZGiN e-Driver’s License application contains a total of 24 data groups (DG1–DG24); of these, DG1—which contains the license holder’s demographic data along with vehicle categories, restrictions, and conditions—must be defined, while the definition of the other data groups is optional.

Technicial Features

FEATURES OF THE AKiS TRAVELER'S DRIVER'S LICENSE

ISO/IEC 18013 LDS

  • Basic Access Protection (BAP)

Active Authentication (AA)

  • RSA (up to 2048 bits): SHA-1, SHA-256, SHA-384, SHA-512
  • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512

Extended Access Protection (EAP)

  • ISO/IEC 18013-3:2009
  • RSA (up to 3072 bits): SHA-1, SHA-256, SHA-512
  • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512

Extended Access Control (EAC)

  • ISO/IEC 18013-3:2017
  • EAC v1
  • RSA (up to 3072 bits): SHA-1, SHA-256, SHA-512
  • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512

Contactless Communication

  • ISO/IEC 14443-3, 4 Type A
  • Baud rate: 424/848 kbps

Secure Messaging

  • DES3
  • AES-128, AES-192, AES-256

Multi-Chip Support2

  • Infineon SLE78CLFX3000P (88K memory capacity)
  • Infineon SLE78CLFX4000P (192K memory capacity)
  • NXP P71D320P (80K Memory Capacity)

Compliance with Standards

  • ISO/IEC 18013-3
  • ISO/IEC 14443-3, 4
  • ISO/IEC 7816-4, 8, 9
  • BSI TR-03110 (for EAC)
  • BSI TR 03111

BASIC ACCESS PROTECTION (BAP)

It is a mechanism that enables an authorized terminal to access the data stored on the contactless chip and ensures that communication between the terminal and the contactless chip takes place securely. It enables the generation and verification of session keys, as well as the initiation of secure communication, through the optical scanning or manual entry by the operator of the MRZ (Machine Readable Zone) / SAI (Scanning Area Identifier) information printed on the e-Driver’s License.

EXTENDED ACCESS PROTECTION (EAP)

It enables the updating of secure session keys using Chip Authentication (EAP–CA) and controls access to all data sets on the chip using role-based certificates via Terminal Authentication (EAP–TA).

EXTENDED ACCESS CONTROL (EAC)

It enables the updating of secure session keys through Chip Authentication (EAC–CA) and, through Terminal Authentication (EAC–TA), controls access to optional signature and biometric data sets stored on the chip using role-based certificates.

ACTIVE AUTHENTICATION (AA)

It prevents the creation of an exact copy of the eDriver's License chip.

 

[1] Personalized AKiS GEZGiN cards may support only one of the ISO/IEC 18013-3:2009 and ISO/IEC 18013-3:2017 standards, depending on the personalization.
[2] The chips are certified under the CC EAL 6+ security evaluation.

epasaport

AKİS GEZGİN e-Passport App

e-PASSPORT APPLICATION

The AKiS GEZGiN e-Passport application was developed in compliance with ICAO 9303 standards. Thanks to the Basic Access Control (BAC) and Supplemental Access Control (SAC) features, the information on the contactless chip can only be read via secure communication, and the Active Authentication feature prevents the passport from being copied. Additionally, the EAC feature uses CVC certificates to protect individual biometric data; only authorized countries can access this data.

The AKiS Gezgin e-Passport application supports Logical Data Structure (LDS) 1.7 and can contain up to 11 data groups (DG1–DG11); of which DG1, which contains MRZ data, must be defined; the definition of the other data groups is optional.

Technicial Features

FEATURES OF THE AKiS TRAVELER PASSPORT

ICAO LDS 1.7
Basic Access Control (BAC)
Active Authentication (AA)

  • RSA (up to 2048 bits): SHA-1, SHA-256, SHA-384, SHA-512
  • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512

Supplemental Access Control (SAC)

  • PACE v2
  • MRZ and CAN support
  • Support for Generic Mapping and Integrated Mapping
  • ECDH (Brainpool curves up to 512 bits)
  • DH (1024 bit, 2048 bit)

Extended Access Control (EAC)

  • EAC v1
  • RSA (up to 3072 bits): SHA-1, SHA-256, SHA-512
  • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512

Contactless Communication

  • ISO/IEC 14443-3, 4 Type A
  • Baud rate: 424/848 kbps

Secure Messaging

  • DES3
  • AES-128, AES-192, AES-256

Common Criteria (CC) Security Evaluation

  • CC EAL 4+ for BAC (ALC_DVS.2)
  • CC EAL 5+ for SAC & EAC (ALC_DVS.2, AVA_VAN.5)

Multi-Chip Support1

  • Infineon SLE78CLFX3000P (88K memory space)
  • Infineon SLE78CLFX4000P (192K memory capacity)
  • NXP P71D320P (80K memory capacity)

Compliance with Standards

  • ICAO 9303
  • ISO/IEC 14443-3, 4
  • ISO/IEC 7816-4, 8, 9
  • ICAO Technical Report: Supplemental Access Control for MRTDs (for SAC)
  • BSI TR-03110 (for EAC)
  • BSI TR 03111

BASIC ACCESS CONTROL (BAC)

It is a mechanism that enables an authorized terminal to access the data stored on a contactless chip and ensures that communication between the terminal and the contactless chip takes place securely. It enables the generation and verification of session keys, as well as the initiation of secure communication, through the optical reading of the MRZ (Machine Readable Zone) information printed on the e-passport.

EXTENDED ACCESS CONTROL (EAC)

It enables the updating of secure session keys via Chip Authentication (EAC–CA) and, via Terminal Authentication (EAC–TA), the control of access to the DG3 (fingerprint) and DG4 (iris) data groups within the chip.

ACTIVE AUTHENTICATION (AA)

It prevents the creation of an exact copy of the e-passport chip.

SUPPLEMENTAL ACCESS CONTROL (SAC)

It is a mechanism that, thanks to the Diffie–Hellman key-generation protocols (DH/ECDH), enables the creation of session keys that are more secure and stronger than those generated by BAC.

 

[1] The chips are certified under the CC EAL 6+ security evaluation.

akispki

AKİS PKI / Smart Card Operating System

The AKiS operating system was developed in accordance with ISO/IEC 7816 standards and features PKI capabilities. When customized with the PKCS#15 data structure, AKiS versions 2.2 and 2.5 can be used in PKCS#11 applications such as user login and digital signatures.

Technicial Features

AKiS PKI1 Features:

  • Support for ISO/IEC 7816-4, 8, and 9 command sets
  • AES-256 Secure Messaging
  • Summarizing
  • Card Verifiable Certificates
  • Role-based access mechanism
  • True Random Number Generator (TRNG)
  • RSA digital signing, decryption, and CVC certificate validation processes2
  • Generating an RSA key pair3
  • ECDSA digital signature generation (ECC 128–640 bits)
  • Generating an ECC key pair (ECC 128–640-bit range)4
  • Symmetric encryption/decryption (DES3, AES-128, AES-192, AES-256)4
  • Cryptographic integrity checks (DES3 MAC/CMAC/RetailMAC, AES MAC/CMAC)4
  • Common Criteria (CC) EAL 4+ security level
  • Multi-chip support5
    • UKTUM-H v7.01
    • Infineon SLE78CFX2400P
    • NXP P71D320P

[1] Driver support for PKCS#11 applications (PKCS#11 and Minidriver).
[2] AKiS v2.5 supports RSA key lengths ranging from 1024 to 2816 bits, while AKiS v2.2 supports only 1024-bit and 2048-bit RSA keys.
[3] AKiS v2.5 supports RSA key lengths ranging from 1024 to 2816 bits, while AKiS v2.2 supports only 2048-bit RSA keys.
[4] Supported only in AKiS v2.5.
[5] The chips have at least a CC EAL 5+ security evaluation certificate.

national

National Identity Card / T.R.- TRNC Identity Card

IDENTITY CARD OF THE REPUBLIC OF TURKEY AND THE TURKISH REPUBLIC OF NORTH CYPRUS
ELECTRONIC ID CARD APPLICATION (Contact-Based Card Feature)
  • Visual identity verification
    Photograph, wet signature, guilloche, rainbow printing, MLI, microtext, halftone printing, charm, embossed printing, optically variable ink, ultraviolet ink, and OVD/DOVID
  • Electronic identity verification
    Electronic certificate, digital photo, PIN
  • Biometric authentication
    Fingerprint/finger vein pattern/hand and foot prints
  • Ability to upload a Qualified Electronic Certificate (QC) and private key
  • Support for ISO/IEC 7816-4, 8, and 9 command sets
  • AES-256 Secure Messaging
  • Summarizing
  • Card Verifiable Certificates
  • Role-based access control mechanism
  • True Random Number Generator (TRNG)
  • RSA digital signing, decryption, and certificate validation processes1
  • Generating an RSA key pair2
  • ECDSA digital signature generation (ECC 128–640 bits)3
  • Generating an ECC key pair (ECC 128–640-bit range)3
  • Symmetric encryption/decryption (DES3, AES-128, AES-192, AES-256)3
  • Cryptographic integrity checks (DES3 MAC/CMAC/RetailMAC, AES MAC/CMAC)3
  • Common Criteria (CC) EAL 4+ security level
  • Multi-chip support4
    • UKTUM-H v7.01
    • Infineon SLE78CFX2400P
    • NXP P71D320P
Technicial Features

  • ELECTRONIC TRAVEL DOCUMENT APPLICATION (Contactless Card Feature)5

    • Compliance with standards
      • ICAO 9303
      • ISO/IEC 14443-3, 4
      • ISO/IEC 7816-4, 8, 9
      • ICAO Technical Report: Supplemental Access Control for MRTDs (for SAC)
      • BSI TR-03110 (for EAC)
      • BSI TR 03111
    • Compliant with the ICAO LDS 1.7 data structure
    • Basic Access Control (BAC)
    • Active Authentication (AA)
      • RSA (up to 2048 bits): SHA-1, SHA-256, SHA-384, SHA-512
      • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512
    • Supplemental Access Control (SAC)
      • PACE v2
      • MRZ and CAN support
      • Support for generic mapping and integrated mapping
      • ECDH (Brainpool curves up to 512 bits)
      • DH (1024 bit, 2048 bit)
    • Extended Access Control (EAC)
      • EAC v1
      • RSA (up to 3072 bits): SHA-1, SHA-256, SHA-512
      • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512
    • Contactless Communication
      • ISO/IEC 14443-3, 4 Type A
      • Baud rate: 424/848 kbps
    • Secure Messaging
      • DES3
      • AES-128, AES-192, AES-256
    • Common Criteria (CC) Security Evaluation
      • CC EAL 4+ for BAC (ALC_DVS.2)
      • CC EAL 5+ for SAC & EAC (ALC_DVS.2, AVA_VAN.5)
    • Multi-chip support4
      • Infineon SLE78CLFX3000P
      • Infineon SLE78CLFX4000P
      • NXP P71D320P

    [1] AKiS v2.5 supports RSA key lengths ranging from 1024 to 2816 bits, while AKiS v2.2 supports only 1024- and 2048-bit RSA keys.
    [2] AKiS v2.5 supports RSA key lengths ranging from 1024 to 2816 bits, while AKiS v2.2 supports only 2048-bit RSA keys.
    [3] Supported only in AKiS v2.5.
    [4] The chips have a security evaluation certificate of at least CC EAL 5+.
    [5] These are the features of AKiS GEZGiN.