Tokens & HSM

Feitian

ePass2003 USB token

Feitian USB cryptographic token for storing digital certificates and private keys, validated FIPS 140-3 at security level 3. Works with PKCS#11 and Microsoft CryptoAPI applications on Windows, macOS and Linux.

What is the ePass2003?

The ePass2003 is a USB cryptographic device based on smart card technology. Private keys are generated and used inside the token and cannot be exported: signing, decryption and authentication happen on the device, not on the computer.

It works as a second authentication factor: using it requires both the physical token and its PIN. CertiSur sells it as the replacement for the mToken CryptoID, which it no longer offers.

FIPS 140-3 validated, security level 3

NIST validated the token's cryptographic module under FIPS 140-3, the US federal standard for cryptographic modules. The certificate is public: you can check it on the NIST website.

Certificate
#5151
Overall level
3
Validated
Jan 28, 2026
Valid until
Jan 27, 2031
Validated module
FEITIAN ePass Token Cryptographic Module
View the certificate on NIST

Technical specifications

Interface USB with status LED. CCID: uses the operating system's standard drivers.
Chip HSC32K2 with the FTCOS operating system.
Asymmetric algorithms RSA 2048/3072/4096, ECDSA P-256/P-384/P-521.
Symmetric and hash AES 128/192/256, SHA-1, SHA-256, SHA-384, SHA-512, HMAC.
Standards PKCS#11 v2.40, Microsoft CryptoAPI, CNG, Smart Card Minidriver, PC/SC, X.509 v3.
Operating systems Windows 7 to 11, Windows Server 2008 to 2022, macOS and Linux.
PIN protection Automatic lockout after the maximum number of failed attempts.
Random numbers AES DRBG (NIST SP 800-90A) seeded by a physical entropy source.

What you can use it for

Windows sign-in with a smart card.
VPN authentication with Cisco, Check Point and OpenVPN.
Email signing and encryption in Outlook and Thunderbird.
Document signing in Microsoft Office.
Certificate-based access to websites from Chrome and Firefox.
Disk encryption with BitLocker.

Key benefits

Private keys are generated on the token and stored encrypted with AES. They can never be read or exported.
Two-factor authentication: the physical token plus its PIN.
All cryptographic operations run inside the device.
Self-tests of firmware and algorithms at startup. If one fails, the token stops operating until it is reset.
Works with any PKI application that uses PKCS#11 or Microsoft CryptoAPI.
Token administration over an encrypted secure channel (SCP03).