Mobile credentials
Your badge, room key, car key and ID, living in your phone — and the three radios that decide how close you have to get.
A mobile credential is anything that used to be a card or a key, now carried by your phone or watch: office badges, student IDs, hotel room keys, home locks, car keys, transit passes, even driving licences. The phone does card emulation, or talks to the reader over another radio, and the door or the gate never sees a piece of plastic.
#Three radios, three ways to get in
| Radio | Range | Feels like | Good at |
|---|---|---|---|
| NFC | a few cm | tapping a card | unmistakable intent, works with a dead-ish battery |
| Bluetooth LE | metres | the door "knows" you're there | no tapping, works with older readers via an app |
| UWB | a metre or two, to ~10 cm | the door opens as you reach it | hands-free, and much harder to fool with a relay |
NFC is the same 13.56 MHz tap as a card. Bluetooth judges distance by signal strength, which is rough and easy to stretch. UWB actually measures the distance by timing, which is why hands-free locks and car keys are moving to it.
#Two ways a credential gets into your phone
#In the wallet
Apple Wallet and Google Wallet can hold credentials natively, stored in the phone's secure hardware and presented with the same tap as a payment card:
- Employee badges and student IDs, issued by the building's access system and often emulating a modern smart-card credential.
- Hotel room keys, which arrive with the booking.
- Home keys for compatible smart locks.
- Car keys, using an industry standard (CCC Digital Key) that covers NFC, Bluetooth and UWB.
Many of these work in express mode: no unlock, no Face ID, just tap. Some keep working for a few hours after the battery dies.
#In an app
Plenty of access systems use their own app, usually over Bluetooth: open the app, wave or twist the phone near the reader, door opens. This works on any phone and with readers that have no NFC card emulation, but every vendor does it differently. That's the mess Aliro is trying to clean up.
#IDs and licences
Mobile driving licences follow their own standard (ISO/IEC 18013-5). The phone and the verifier start talking via an NFC tap or a QR code, then move the data over Bluetooth or NFC. Two nice properties:
- the data is signed by the issuing authority, so it can be checked offline (the same idea as e-passport chips)
- the holder can share just what's needed, for example "over 21: yes" without a name, address or birth date
#What changes vs a plastic card
- No fixed UID. Phones usually present a random UID, so a reader can't recognise a phone by serial number. The system needs a real cryptographic credential, which is a good thing (see Public-key cards).
- Issued and revoked over the air. No card printer, no "return your badge"; it disappears from the wallet.
- Harder to lend, easier to lose track of. You can't hand a colleague your phone as casually as a badge, and your phone already has a lock screen.
- The battery is now part of the door. Hence the express and power-reserve features.