Module 4: Card and reader technologies
Credential technologies, card formats and facility codes, why prox is easy to clone, mobile, MFA and migration.
- Tell credential technologies apart
- Decode a card format
- Understand why legacy prox is easy to clone
- Plan a migration to secure credentials and OSDP Secure Channel
4.1 Credential technologies
| Technology | Frequency | Security | Notes |
|---|---|---|---|
| Prox (HID Prox, EM4100, etc.) | 125 kHz | None | Transmits a fixed number; trivially cloned at a distance. |
| MIFARE Classic | 13.56 MHz | Broken | Crypto1 cipher is cracked; cards can be read and copied. |
| Legacy iCLASS (standard keys) | 13.56 MHz | Weak | Standard master key has been publicly compromised. |
| CSN / UID-only reading | 13.56 MHz | Weak | Reader uses only the chip serial number, which is easy to emulate. |
| MIFARE DESFire EV2 / EV3 | 13.56 MHz | Strong | AES-128 with your own keys; open platform. |
| iCLASS SE / Seos | 13.56 MHz | Strong | HID secure identity objects; Seos uses AES and is the basis for HID mobile and wallet credentials. |
| Mobile (BLE / NFC) | Phone | Strong | HID Mobile Access, Apple Wallet and Google Wallet employee badges on supported platforms. |
A DESFire card read in CSN mode is no better than prox.
4.2 Card formats and facility codes
A reader outputs a bit string. The card format tells the controller how to split it into a facility code (site), card number and parity bits. The controller must have the same format the cards were programmed with, or every card reads as unknown.
| Format | Bits | Layout | Range |
|---|---|---|---|
| H10301 (standard 26-bit) | 26 | 1 even parity, 8 FC, 16 card, 1 odd parity | FC 0–255, card 0–65,535 |
| H10304 (37-bit with FC) | 37 | Parity, 16 FC, 19 card, parity | FC 0–65,535, card 0–524,287 |
| H10302 (37-bit no FC) | 37 | Parity, 35 card, parity | Card up to about 34 billion |
| HID Corporate 1000 (35-bit) | 35 | Parity bits, 12 company ID, 20 card | Company ID unique to one customer |
The 26-bit format has only 255 facility codes and 65,535 cards per code, so duplicate numbers across organizations are common. Proprietary formats like Corporate 1000 are tracked by the manufacturer so your numbers are not reused elsewhere.
Try it: 26-bit H10301 encoder
Type a facility code and card number to see the exact bit string a reader sends, with both parity bits calculated.
4.3 Why prox is so easy to clone
A 125 kHz prox card answers any reader that powers it with the same fixed number. A hidden long-range reader in a bag can capture it from a short distance, and a cheap writable card or handheld device replays it. There is no cryptography to defeat. Wiegand wiring has the same problem on the wire side: a small device spliced behind the reader can log every badge.
Mitigations: move to DESFire EV3 or Seos with custom keys, use OSDP Secure Channel, add PIN at sensitive doors, and use tamper switches on readers.
4.4 Mobile credentials
- BLE credentials (e.g. HID Mobile Access) let the phone open the door from a short distance, often with a tap or twist gesture.
- NFC wallet badges (Apple Wallet, Google Wallet employee badges) behave like a secure card and can work in express mode, even when the phone battery is low on supported devices.
- The reader must support the mobile technology, and the platform must support the credential provider. Confirm Synergis support for a specific provider in Genetec's compatibility list before buying.
- Benefits: remote issuance and revocation, no plastic, phone biometrics as a second factor.
4.5 Multi-factor readers and OSDP Secure Channel
Factors are something you have (card, phone), know (PIN) and are (fingerprint, face, iris). Card plus PIN is the most common upgrade for high-risk doors; Synergis can apply card-and-PIN on a schedule so it is required after hours only. Biometric readers either match on the reader or on a server, and raise privacy rules (consent, retention) depending on your jurisdiction.
OSDP Secure Channel encrypts reader-to-controller traffic with AES-128. Readers start in install mode with a default key; the controller then sets a unique key. Make sure keys are changed from defaults and install mode is disabled after commissioning, or an attacker can swap in a reader and re-key it.
4.6 Migration strategy
- InventoryCard technologies, formats and facility codes in use; reader models and firmware.
- Install multi-technology readersRead both prox and secure credentials so old and new cards work side by side.
- Switch readers to OSDPRe-terminate as RS-485 and enable Secure Channel.
- Issue secure credentialsDESFire EV3, Seos or mobile, with a proprietary or long format.
- Turn off legacy readingDisable 125 kHz and CSN modes once everyone is migrated, starting with high-security doors.
Common mistakes
- Buying secure cards but leaving readers in CSN-only mode.
- Wrong card format in the software, so every badge is unknown.
- Leaving 125 kHz reading enabled forever after migration.
- Not changing OSDP Secure Channel keys from default.
- Ordering 26-bit cards with a facility code another nearby site already uses.
Check your understanding
1.Why is 125 kHz prox insecure?
2.Which is the correct H10301 26-bit layout?
3.A DESFire EV3 card is read only by its CSN. Is it secure?
4.What encryption does OSDP Secure Channel use?
5.Name the three authentication factors and one example each.