OSDP
Wiegand's replacement — a two-way, supervised, optionally encrypted link between readers and controllers.
OSDP (Open Supervised Device Protocol) does the same job as Wiegand: it carries what the reader saw back to the access controller. It does that job as a real conversation instead of a one-way shout. It started as an industry spec, is maintained by the Security Industry Association (SIA), and is now an international standard (IEC 60839-11-5).
#What changes
| Wiegand | OSDP | |
|---|---|---|
| Direction | reader → controller only | both ways |
| Wiring | 2 data wires per reader | RS-485 twisted pair, many readers on one bus |
| Distance | ~150 m | ~1,200 m |
| Supervision | none | controller polls each reader constantly |
| Encryption | none | Secure Channel (AES-128) |
| Reader control | an LED or beeper wire or two | LEDs, buzzer, displays, firmware updates |
#Supervised
The controller polls every reader on the bus several times a second, and each reader has to answer. If a reader goes quiet, gets unplugged or starts answering strangely, the controller knows and can raise an alarm. That's the "S" in OSDP, and it's the thing Wiegand fundamentally can't do.
#Secure Channel
With Secure Channel turned on, the reader and the controller agree on session keys derived from a shared secret. After that, every message is encrypted with AES-128 and carries a MAC, so it can't be read on the wire or quietly altered. The card number no longer travels in the clear behind the wall.
Into the weeds: What actually goes over the wire
OSDP is a polled, half-duplex protocol on RS-485. The controller is the only one allowed to start a conversation. Each reader has an address on the bus and answers only when spoken to. Every message is a small packet: a start byte, the address, a length, a control byte, a command or reply code with its data, and a checksum or CRC. With Secure Channel on, it also carries a MAC. Commands cover things like "are you there?", "set your LED to green" and "beep twice". Replies cover "here's a card read", "someone's tampering with me" and "I'm fine".
OSDP protects the link between reader and controller. It can't help if the credential itself is weak: a card that only says a fixed number still says that number to anyone's reader. See Why old cards are a bad idea.