iCLASS

iCLASS is HID's 13.56 MHz access line, launched in 2002 as the step up from 125 kHz Prox. The name has stretched across three quite different generations, and telling them apart is the whole point of this page: legacy iCLASS, the SR migration card, and the SE platform. The last two — along with Seos — are held together by one idea, the SIO.

#Legacy iCLASS and the shared key

The original iCLASS cards encrypted their contents, which was a real step up from Prox reciting a number in the clear. But "standard security" iCLASS did it with a single master key shared across the entire ecosystem — every standard-security card and reader in the world leaned on the same secret.

That's brittle, and it broke the way brittle things do. Around 2010–2012, researchers (Martin Meriac's "Heart of Darkness" work, and the Radboud University group) extracted that master key and published how the system worked. Once the shared key is out, "encrypted" stops meaning much. There was a high-security / Elite option that used a customer-specific key, which raised the bar — but standard-security legacy was broken for everyone at once.

#The SIO: the thing the new cards share

HID's answer wasn't just a better cipher — it was a new data object. The SIO (Secure Identity Object) is a standards-based container that wraps your credential data in its own layer of signing and encryption, bound to the card so it can't simply be lifted onto another one. Crucially, the SIO is independent of the card underneath: the same object can live on an iCLASS SE card, a Seos card, or a phone.

That independence is the point. SR, SE and Seos all carry an SIO — it's the portable credential, and the card is just where it happens to sit today. Legacy iCLASS has no SIO, which is exactly why it's the one you migrate off.

#iCLASS SR and SE

• iCLASS SR is the migration card. It carries the old legacy iCLASS application and an SIO on the same card, so it opens doors on installed legacy readers and on new SIO-aware ones. It's the bridge you issue while you're swapping readers over — and it's only as strong as the weaker half anyone still accepts.
• iCLASS SE is the platform: readers and cards built around the SIO on a secure element, with AES and multi-technology support. This is the current iCLASS, and a different animal from the 2002 cards that share its name.

For the credential HID actually pushes today — the one that's also the key in your phone — see Seos.

#If you run iCLASS

• Standard-security legacy → migrate to Seos (or SR as a bridge), and turn off legacy acceptance once cards are reissued.
• Elite/high-security legacy → better, but still the old platform; plan the move to SE/Seos.
• Any of it → put OSDP on the reader-to-controller wire while you're in there.

With Proxmark3

hf iclass info identifies an iCLASS card and its configuration — useful for telling legacy from SE/SR on cards you own. Reading protected contents needs the keys.

With Flipper Zero

The PicoPass app reads legacy iCLASS / PicoPass cards and shows their configuration. For an iCLASS SE card, the Seader app can read it with a compatible SAM (secure access module) doing the crypto — on cards you own.

With Your phone

NXP TagInfo (Android) shows the chip family and UID, enough to confirm roughly what platform a card you hold is on.