RFID Locks: Contactless Credentials, Frequencies, and Standards

How an RFID Lock System Is Built

A typical installation has three parts:

• The credential. A card, fob, or phone carries an identifier and, in secure systems, keys for authentication.
• The reader. It powers and talks to the credential. It may be built into the lock or mounted beside the door. See card readers.
• The decision point. A standalone lock decides on its own. In a networked system, an access control panel decides and then releases an electric strike, maglock, or motorized lock. See access control, electronic locks, and electromagnetic locks.

Frequency Families

125 kHz "prox"

In a 2010 Chaos Communication Congress talk, researchers Milosch Meriac and Henryk Plötz described HID Prox (circa 1991) as 125 kHz with "proprietary modulation and encoding," and summarized its security as "no security, read-only." Schlage's key-systems guide likewise lists proximity credentials as "easily duplicated."

13.56 MHz smart cards

High-frequency cards operate at 13.56 MHz and follow international standards:

• ISO/IEC 14443 covers proximity cards. Part 1 "defines the physical characteristics of proximity cards (PICCs)." NXP lists an operating distance of up to 100 mm for its DESFire EV3 under ISO/IEC 14443 Type A.
• ISO/IEC 15693 covers vicinity cards. ISO's abstract says these "can be energized at ranges of up to 1 m" from the reader's 13.56 MHz field. A card answers only when a command selects it by "the unique identification number encoded into every card," which is a process called anti-collision.

The same 27C3 talk described HID iClass (established 2002) as "13.56 MHz, partially ISO 15693 or 14443-B," with claimed "(3)DES security," and presented the researchers' security analysis of it.

Card Families and Security

Within 13.56 MHz, security depends on the chip family. NXP, which makes the MIFARE line, describes two of them:

• MIFARE Classic. NXP says it "started a revolution in the contactless smart card business back in 1994." The current EV1 uses NXP's proprietary MIFARE CRYPTO1 security on ISO/IEC 14443-3 Type A. NXP's own product page adds: "For security-relevant applications, customers should refer to our MIFARE DESFire and MIFARE Plus product families."
• MIFARE DESFire EV3. NXP lists AES with 128-bit keys in hardware, "mutual three-pass authentication," encrypted data on the radio channel, a "Proximity Check for protection against Relay Attacks," and a transaction timer "to mitigate man-in-the-middle attacks." It is certified to Common Criteria EAL 5+; the older EV1 was EAL 4+. NXP lists access management and smart locks among its applications.

Schlage's comparison chart calls MIFARE Plus and DESFire EV1 its "most secure credentials," saying "advanced data encryption makes duplication nearly impossible."

Schlage's chart is headed "Ensure your credential is a[s] secure as your keyway." See key control.

Reader Wiring: Wiegand and OSDP

Many readers report to a controller over the legacy Wiegand interface. The Security Industry Association (SIA) describes the Open Supervised Device Protocol (OSDP) as "a more capable alternative to the legacy Wiegand interface."

• Origin. OSDP was created in 2008 by HID Global, Mercury Security, and Lenel. Ownership passed to SIA in 2012.
• Standardization. It became an international standard, IEC 60839-11-5:2020.
• Security. OSDP Secure Channel "supports high-end AES-128 encryption," and the protocol "constantly monitors wiring to protect against attack threats."

Testing Standard: UL 294

In North America, access control equipment is evaluated to UL 294. The current edition is dated May 24, 2023.

• Scope. It applies to equipment "intended to regulate or control" entry into or exit from controlled areas, or access to devices.
• Levels. It defines "four levels of security performance with Level I (lowest level security equipment) to Level IV (highest level security equipment)."
• Limits. The standard states that "the accuracy of the logged data is not evaluated." Burglar-alarm functions fall under separate alarm standards.

For egress-side releases on access-controlled doors, see request to exit.

Mobile Credentials

Phones can stand in for cards. Apple's support documentation describes an employee badge in Apple Wallet:

• Setup. The badge is added through "the app provided by your employer." The employer must take part, and Apple's security guide says multifactor authentication must be enabled.
• Use. The user holds the iPhone or Apple Watch near the reader. With Express Mode on, no unlock step is needed.
• Loss. Putting the device in Lost Mode "temporarily removes your cards and passes, including your employee badge."

Apple's security guide lists other access key types: hotel room keys "at supported locations," student IDs, home keys, and car keys. Other phone platforms offer their own credential systems, which this article does not cover. See smart locks and smart lock protocols.

Hotel Card Locks: From Punched Cards to Electronics

Recodable hotel card locks began before RFID. According to the Norsk biografisk leksikon, Norwegian engineer Tor Sørnes proposed a punched-hole card lock principle in 1975.

• The card. Each card had 32 holes, giving about 4.2 billion combinations. Each new guest got a new code.
• First system. The first system, VingCard, was ready in 1977 and patented in 29 countries. The following year it was installed at the Park Hotel in Sandefjord.
• First U.S. hotel. In 1978 the Peachtree Hotel in Atlanta trialed the locks, then ordered them for all 1,076 rooms.
• Electronics. Sørnes later led development of electronic card locks based on magnetic stripes, which VingCard had ready in 1992–93.

Today, phone-based hotel room keys "at supported locations" are among the access key types Apple lists. See transponder keys for the automotive use of similar radio technology.

Related Topics

• Access control
• Card readers
• Electronic locks
• Smart locks
• Smart lock protocols
• Electromagnetic locks
• Request to exit
• Transponder keys
• Key control

Sources