What happens when you tap your card?
step by step. What travels between the card, ChipLogin and Windows.
Prepared in advance: the card and the ChipLogin system verifying share a secret key. The key is not sent during this authentication.
The reader and workstation relay messages between the card and server.
Use the buttons or arrow keys ← →
All 7 steps in one view
Simplifications and sources behind the diagram
We show routine sign-in with an already issued card, ending with online sign-in to a domain account. In mode, the reader, ChipLogin service and Windows are on one PC. In mode, card messages are relayed through the workstation to the server; an approved connection protects the network path.
Card application selection and other protocol fields are grouped into step 2. DESFire AuthenticateEV2First uses the card's RndB challenge, ChipLogin's response containing a modified RndB and its own RndA, and a final card response with a modified RndA. The simplified labels do not mean these numbers travel in the clear. Fresh challenges prevent simple replay of an old response; they do not by themselves prove the card's physical distance.
In step 6, ChipLogin's on the PC (Credential Provider) receives the encrypted envelope, decrypts it and passes the credentials to Windows. If the server or workstation is fully compromised, this diagram does not guarantee password secrecy. ChipLogin Auth must be available to release credentials again.
A local Windows account is verified against the local database. If the domain is unavailable, Windows may use cached authentication, depending on configuration; this is a separate Windows feature. The arrow to represents standard Windows authentication messages, not sending a plain password over the network.
Sources: shared/ChipLogin.Desfire/Ev2Authenticator.cs:20–98, shared/ChipLogin.Desfire/DesfireLogin.cs, authserver/ChipLogin.Auth.Service/Program.cs, station/ChipLogin.Station.Service/Worker.cs, station/ChipLogin.CredentialProvider/CChipLoginCredential.cpp:783–824 and Windows authentication documentation. Sources as of 1 October 2026.