NativeNCA — an NCALayer replacement for Windows: Kazakh e-signature without Java

Why not NCALayer

NCALayer has earned its retirement

For years it signed documents for the whole of Kazakhstan, and we thank it for that. Compare one signature in NCALayer and in NativeNCA: press the button in either window.

A typical Java app0.0 s

NCALayer

Ready. Probably.

NativeNCA0.0 s

NativeNCA

Sign in to your accountThe site asks to use your digital signature

idp.egov.kzHTTPS

Personal eGovGOST · Password in the vault

Windows Hello: touch the sensor

SignedThe key stayed on the computer, and no password was needed.

This is a parody. Any resemblance to reality is intentional.

NCALayer compared with NativeNCA
In short	NCALayer	NativeNCA
Java	Brings a whole Java runtime and keeps it in memory	Not needed. A single .NET file that sits in the tray
Key password	Find the .p12 file and type the password. For every signature	Once, when you add the key. After that, Windows Hello
Choosing a key	Guess which `GOST512_…p12` is the right one	Readable names and photos: "Personal eGov", "LLP Shanyrak"
Certificate for 127.0.0.1	The same private key on every computer	A separate one per computer, the issuing key destroyed
Source code	Closed, nothing to check	Open on GitHub under GPL-3.0, you can build it yourself
Looks	Straight from the age of Java applets	Fluent Design, Mica, light and dark themes

Features

What NativeNCA does

You add your .p12 keys once. After that, every request from a website opens a window that shows who is asking, what exactly will be signed and with which key.

Works like NCALayer

Listens on the same wss://127.0.0.1:13579 and speaks the same protocol, so websites need no changes.

GOST and RSA keys

СТ РК ГОСТ Р 34.10-2015 (512 bit) and RSA keys from NCA. CMS/CAdES and XML signatures are checked against reference signatures made by Kalkan.

Windows Hello

Approve a signature with your face, fingerprint or PIN. You type the key password once, when you add the key.

Encrypted vault

Keys and passwords are encrypted with Windows DPAPI. If you like, a Windows Hello key from the TPM adds a second layer.

You see what you sign

The confirmation window shows the site's domain, the data itself and the keys that fit the request.

Key photos

Give a key a photo or a company logo and crop it right in the app, so keys are hard to mix up.

NCA timestamps

With a CAdES-T timestamp, a signature can still be verified after the certificate expires.

Install and updates

Installs without administrator rights. The app tells you about a new version and updates when you press "Update". You can roll back to the previous version.

Made for Windows 11

Fluent Design, Mica, dark theme, a tray icon and start with Windows. Opens right away, with no splash screen.

How signing works

What happens when a site asks for a signature

The site sends a request
eGov or your bank connects to 127.0.0.1:13579, as it did with NCALayer.
You see who is asking and for what
The domain, the request content and the matching keys. You can pick another key or cancel.
You confirm with Windows Hello
The key is decrypted in memory and the data is signed on your computer.
The site gets only the signature
It receives the signature and your public certificate. The private key stays on the computer.

NativeNCA confirmation window: idp.egov.kz asks to sign in, a key is selected, a Confirm with Windows Hello button

NativeNCA confirmation window in the dark theme

Security

How NativeNCA protects your keys

The code is open under GPL-3.0, and the README describes the protection in detail. Here are the main points.

Open source

Cryptography, the vault, the protocol and the updater are on GitHub. GitHub Actions builds releases from that same code, and every zip comes with a SHA-256 checksum.

NCALayer: closed source

NativeNCA: open source, GPL-3.0

A certificate of its own on every computer

The browser needs a certificate for 127.0.0.1. NativeNCA issues it from its own certificate authority and destroys that authority's key right away. Name constraints allow local addresses only.

NCALayer: the same private key in every installation

NativeNCA: each computer has its own

A vault protected by Windows

Keys and passwords are encrypted with DPAPI for your Windows account. In protected mode they are also encrypted with AES-256-GCM under a TPM key that only Windows Hello can unlock.

Without you, even a program running under your account cannot decrypt the keys

Signed updates

Every release zip is signed with the project key. NativeNCA installs an update only if the signature is valid for that exact version and architecture and the version is newer than the installed one. Files come only from github.com over HTTPS, and the previous version is kept for rollback.

A server for this computer only

NativeNCA listens on 127.0.0.1 only, so nothing on your network or the internet can connect to it. Signatures are made on the computer, and the private key is never sent anywhere.

No telemetry

The app sends nothing to the developer. It goes online in two cases: to GitHub to check for updates (you can turn this off), and to the NCA timestamping service if timestamps are on.

Good to know

NativeNCA is an independent project. It is not affiliated with or endorsed by NCA (НУЦ РК) or JSC "National Information Technologies", and it is not a certified cryptographic tool.
If you reset your Windows PIN while Windows Hello protection is on, the vault cannot be decrypted. Keep your original .p12 files and their passwords.
Keep NCALayer around in case a service rejects a signature, and let us know when that happens.

Source code How the protection works Builds on GitHub Actions

Screenshots

Looks like a Windows 11 app

The interface is built with Fluent Design. Screenshots follow the site's theme.

My keys

All keys in one list with names, photos, expiry and purpose. Certificate details, IIN and issuer are right next to it.

Installation

Getting started

STEP 1

Download the zip

The button below picks the build for your processor. Extract the zip to any folder.

STEP 2

Install

Run NativeNCA.exe and press "Install". No administrator rights needed, and the app appears in the Start menu.

STEP 3

Add a key

Windows asks once about the browser certificate: answer "Yes". Then pick your .p12 file from NCA and enter its password.

STEP 4

Sign in to eGov

As usual. The NativeNCA window appears instead of NCALayer. If NCALayer is running, the app offers to close it.

Windows 10 version 2004+ or Windows 11 x64 or ARM64 Windows Hello recommended

You can also skip installation: "Run without installing" starts the app from the extracted folder, but that copy does not update itself.

Download NativeNCA Version 0.3.0 · x64 · 67.8 MB

FAQ

Frequently asked questions

Is this an official app?

No. NativeNCA is an independent open-source project. It is not affiliated with NCA (НУЦ РК) or JSC "National Information Technologies", and it is not a certified cryptographic tool. For websites it makes no difference: they talk to NativeNCA over the same protocol as to NCALayer.

Do I need to uninstall NCALayer?

No. But the two cannot run at the same time, because websites expect both on the same port, 13579. If NCALayer is running, NativeNCA offers to close it and turn off its autostart. You can turn autostart back on at any time.

Does NativeNCA work with eGov and banks?

Yes. NativeNCA implements the NCALayer modules commonUtils and basics: sign-in, CMS/CAdES and XML signatures, several documents at once. If a service rejects a signature, please open an issue on GitHub and use NCALayer for now.

Do I need Java?

No. NativeNCA is written in .NET and ships as a single file with everything it needs. Neither Java nor the Kalkan SDK is required.

Which keys are supported?

File keys (.p12) from NCA: СТ РК ГОСТ Р 34.10-2015 (512 bit) and RSA.

Hardware tokens and ID cards (Kaztoken, eToken, JaCarta, ID card) are not supported yet. Legacy GOST 34.310-2004 keys are not supported either: NCA stopped issuing them, and all of them have expired.

Where are my keys and passwords stored?

In %APPDATA%\NativeNCA\Vault, encrypted with Windows DPAPI for your account. With Windows Hello protection on, they are also encrypted with AES-256-GCM, and the key for that lives in the TPM and opens only with your face, fingerprint or PIN.

How does NativeNCA update?

The installed app checks GitHub at start and every six hours. When a new version is out, a banner appears in the window and Windows shows a notification once. The update starts only when you press "Update": NativeNCA downloads the zip, checks the developer's signature and restarts within a few seconds. Keys and settings are kept.

If something is wrong with the new version, Settings has a "Roll back to the previous version" button. You can also turn off update checks there.

Why does the app install a certificate?

Websites connect to wss://127.0.0.1:13579 over TLS, so the browser has to trust a local certificate. NativeNCA creates a certificate authority for your computer only, issues one certificate for 127.0.0.1 and localhost and destroys the authority's private key right away. Nothing else can be certified with it.

Chrome, Edge and Firefox take the certificate from the Windows store. If Firefox was open during setup, restart it. You can remove the certificate in the app's settings.

Windows SmartScreen warns me when I run it. Is that normal?

SmartScreen does this for apps that few people have downloaded so far. Click "More info", then "Run anyway". To make sure the zip has not been tampered with, compare its SHA-256 with the .sha256 file on the release page: in PowerShell, run Get-FileHash NativeNCA-*.zip.

What happens if I reset my Windows PIN?

If Windows Hello vault protection is on, the Windows Hello key disappears together with the PIN, and the protected data cannot be recovered. Without that protection, resetting the PIN changes nothing. Either way, keep your original .p12 files and their passwords.

How do I uninstall NativeNCA?

With "Uninstall NativeNCA" in the app's settings, or in Windows Settings → Apps → Installed apps. By default, keys and settings stay in %APPDATA%\NativeNCA in case you reinstall. Tick the checkbox to remove them along with the browser certificate. Your original .p12 files are never touched.

Is there a version for macOS or Linux?

No. NativeNCA relies on Windows Hello, DPAPI and the Windows certificate store, so it runs on Windows 10 and 11 only.

How much does it cost?

Nothing. The app is free, has no ads, and the code is open under GPL-3.0. If you want, you can support development.

Support development

NativeNCA is free, with no ads and no telemetry. Donations go towards compatibility with new sites, hardware token support and a code signing certificate, after which SmartScreen will stop warning on launch.

Digital signatures without Java or a password every time