Secure your access control, link by link
From the badge to the controller, three choices decide how strong your installation is: the card, the link and the keys. Here is how to move from Wiegand and 125 kHz to a system that ANSSI recommends, and how SCAP supports you at every step.
What really happens at your door
These weaknesses have been documented for years. They require neither rare skills nor expensive equipment.
The badge can be copied
A 125 kHz card broadcasts its number to anyone who queries it. Mifare Classic® encryption (Crypto1) has been broken since 2008: off-the-shelf tools recover the keys. Reading only the serial number of a card, even a recent one, protects nothing.
The cable talks in clear
Wiegand sends the badge number over two data wires, with no encryption, no authentication and no line supervision. Anyone with access to the cable or the reader can read and replay that number.
ANSSI says it plainly
In its guide on physical access control, the agency classes the configuration with a clonable badge and the one with an unprotected wired link among those "to be ruled out".
Link 1: the badge
Four steps. Climb at least to the third.
The number is read as is and can be copied onto a blank card. No authentication.
To be replacedEncryption exists, but it is broken. Many installations even read only the serial number.
To be replacedThe card proves who it is with a key that only your system knows. Without that key, it cannot be copied.
RecommendedYour own application and files, with a different key for each card: even a broken card reveals nothing about the others.
Part number
What is the mapping?
A DESFire® card is a small filing cabinet: it holds applications, files and keys. The mapping decides how they are arranged.
Standard mapping
Factory layout and keys, known to every installer. The card is recent, but anyone can read it just as you do.
Your mapping
An application dedicated to your site, files that only you can read, a secret key specific to each card derived from a master key. SCAP can encode your cards this way.
Link 2: the connection between the reader and the controller
A strong badge is useless if its identity crosses the wall in clear.
A one-way link, which sends a number read in clear. A third party with access to the line can read and replay it.
To be replacedTwo-way, supervised link, with addressing and status feedback. But without Secure Channel, the data remains readable.
TransitionExchanges are encrypted and authenticated with a key specific to each reader. Provided you do not keep the standard's default key.
RecommendedThe reader relays without understanding: the card authenticates with the controller. The master key stays in a SAM card.
Part number
Why OSDP
Open, two-way standard, on a two-wire RS-485 bus that connects several readers. The existing Wiegand cable can often be reused for the migration.
The default key trap
To be installed, an OSDP reader accepts a public key, defined by the standard, valid for every reader in the world. Until it is replaced, the "encryption" is no encryption at all.
Why go all the way to transparent
A reader fitted on the corridor side is exposed equipment. If it holds no secret, stealing it or opening it reveals nothing. ANSSI recommends this architecture.
Link 3: the keys
The technology is only as good as the way you keep your keys.
A master key, protected in a SAM card
The SAM card itself produces the keys for each badge. The controller never handles the master key. ANSSI strongly recommends this (R69).
A different key for each card
Derived from the master key and the card number: breaking one card only allows that card to be copied, never another one to be made.
No factory key left in place
Neither on the cards nor on the OSDP readers. Change them at installation and record who holds what.
A key has a life, not a single moment
Expiry dates on badges, a procedure for losses, a key replacement plan in case of compromise.
The key ceremony and SAM cards
The master key is the secret of your whole system. It is created only once, in a precise and recorded setting: this is the key ceremony.
Scope
Who takes part, which sites, which zones. Separate master keys according to the protection level of the zones, as ANSSI recommends (R70).
Generate the master key
It is produced in a secure module, by a high-quality random draw. It never travels by e-mail, in a file or through an ordinary workstation.
Create the SAM cards
The master key is loaded into each SAM card: one per controller or per site, plus backup cards. The SAM card then calculates each badge's keys itself, without ever revealing the master key (R69).
Share and back up
A backup is kept in a safe, in several shares entrusted to different people: no one holds the whole on their own.
Document
A signed record lists the participants, the date, the serial numbers of the SAM cards and the keys created.
Plan ahead
Detect any key change, and prepare the replacement in case of compromise (R72 to R74).
SCAP prepares this ceremony with you, helps you create your SAM cards, then encodes your badges with the keys derived from them.
Organise the ceremonySCAP supports you, step by step
There is no need to change everything at once. At each step, security goes up a notch, and your access points keep working during the transition.
What SCAP does for you
SCAP supports its customers from the initial assessment to commissioning. We offer several hardware models, suited to your environment.
Assessment of your installation
Identification of your badges, state of your links and their keys, costed migration plan.
DESFire® badges and encoding
DESFire® cards, key fobs and tokens, with custom encoding of your keys and your mapping.
Readers, controllers and SAM cards
Several models compatible with OSDP, Secure Channel and transparent mode: we choose with you the one that suits your site.
MACS mobile credential
An encrypted token on the smartphone, with no physical badge to copy.
Find out more
- ANSSI, Recommendations on securing physical access control and video protection systems (in French): typical configurations no. 1 to no. 4, recommendations R33, R37, R40 and R69.
- OSDP (Open Supervised Device Protocol) standard from the Security Industry Association: AES-128 Secure Channel and transparent reader profile.
- MIFARE®, overview of the card families: Classic, DESFire®.
MIFARE®, MIFARE Classic® and MIFARE DESFire® are registered trademarks of NXP B.V. The other trademarks mentioned belong to their respective owners.
And tomorrow? DUOX, PKOC, Aliro
A new generation is coming: each badge, or each phone, carries its own key pair, and the reader no longer keeps any secret. Here is where these standards stand, and what they change for an installation that is already secure.
With MACS, tomorrow is today
These standards promise a credential in the phone, accepted by several brands. MACS, the SELEPSO group platform distributed by SCAP, already does it:
- Several brands. Readers, locks, cylinders, padlocks and lockers from different manufacturers, driven by the same service.
- One credential per resource. MACS generates a different credential, with its own security level, for each reader or each resource.
- One app, one cloud. The mobile credential for readers already installed and standalone access control, with no wiring, are managed together.
MACS is not one of these standards: it is a platform available right now, on iOS and Android.