rfid.wtf / WTF is RFID?
In the wild

Office badges

The badge you tap at work is usually just a number. Everything interesting happens in a box in a closet.

Every morning, millions of people wave a bit of plastic at a grey box by a door. Here's what's actually going on.

The badge, the reader, the controller, the lock.
The badge, the reader, the controller, the lock.

#Four parts, one door

  • The badge carries a credential, ranging from a bare number to a proper cryptographic key.
  • The reader on the wall reads it and passes what it got down a cable. Most readers don't decide anything.
  • The controller, usually in a locked room somewhere, checks the credential against its list ("is badge 4021 allowed through this door at this time?") and decides.
  • The lock does what it's told.

The cable between reader and controller has its own story: the old Wiegand interface sends everything one way and in the clear, and OSDP replaces it with a supervised, encrypted link.

#What's in the badge?

Depending on when the building's system was installed, a badge is usually one of these:

Technology Band In short
HID Prox and other 125 kHz cards LF a fixed number, the oldest and weakest option
iCLASS (legacy) HF HID's first secure card; its older versions are long outdated
iCLASS SE / Seos HF HID's current secure credentials
MIFARE DESFire HF AES-based smart card, common outside North America
Phone or watch HF + Bluetooth/UWB the badge lives in a wallet or an app

Lots of buildings run multi-technology readers that accept several of these at once, so old and new badges work side by side during a migration. That's convenient, and it also means the door is only as strong as the oldest badge it still accepts.

#If you look after the doors

The usual advice, roughly in order:

  1. Retire 125 kHz credentials. They repeat a fixed number (see Why old cards are a bad idea).
  2. Use a modern secure credential (DESFire EV2/EV3, Seos, or mobile credentials), with keys set up for your site, not left at defaults.
  3. Upgrade the wire. Move readers to OSDP with Secure Channel turned on.
  4. Turn off what you don't use. Once the old badges are gone, stop the readers accepting them.

Where next

HID ProxThe beige 125 kHz badge on half the office lanyards in North America. It shouts one fixed number and does no crypto at all.Deep diveLF · 125–134 kHziCLASSHID's 13.56 MHz access family, in three acts — broken legacy iCLASS, the SR migration card, and the modern SE platform. What ties the new ones together is the SIO.Deep diveHF · 13.56 MHzMIFARE DESFireNXP's AES smart card — a tiny file system with a lock on every drawer. The usual right answer to "what should we migrate to?", if you manage the keys.Deep diveHF · 13.56 MHzWiegandThe two-wire, one-way link between a badge reader and the door controller — a 1980s design that's still everywhere.ConceptOSDPWiegand's replacement — a two-way, supervised, optionally encrypted link between readers and controllers.ConceptWhy old cards are a bad ideaThree ways a card can be weak — it says a fixed number, its crypto was broken years ago, or its keys were never changed. Here's how to tell, and what to use instead.ConceptMobile credentialsYour badge, room key, car key and ID, living in your phone — and the three radios that decide how close you have to get.Concept

Shows up in

HF — 13.56 MHzMulti-technology readersSeosPIV and CACMIFARE DUOXAliro