Key takeaways
- A 125 kHz prox fob sends its site code and card number unencrypted, so it can be copied to a blank card.
- Researchers report a Mifare Classic access control card was successfully cloned.
- Kisi supports end-to-end encryption using MIFARE DESFire EV1 and EV3 cards, fobs, tags.
- Replace a lost fob by switching it off in the system and issuing a new one. No rekey is needed for a fob.
The short version
Which key fobs can be copied?
It depends on the technology inside the fob.
| Technology | Copy exposure | Source |
|---|---|---|
| 125 kHz proximity (HID 26-bit cards use this) | Information on the card isn't encrypted. A copier extracts the site code and card number and writes them to a blank card. | ICT; Kisi documentation |
| MIFARE Classic | Researchers cloned a Mifare Classic access control card in 2008. | Radboud University Nijmegen |
| MIFARE DESFire EV3 (13.56 MHz) | Kisi supports end-to-end encryption using MIFARE DESFire EV1 and EV3 cards, fobs, tags. ICT recommends MIFARE DESFire 13.56 MHz. | ICT; Kisi documentation |
| HID Seos | AES-128 with mutual authentication and a diversified session key for each card session. | HID Global datasheet |
Proximity fobs
How a 125 kHz prox fob gets copied
ICT says the main issue is that the information on 125kHz prox cards isn't encrypted. A copying device can read the site code and card number and transfer them to a blank card.
Going from the box to a duplicate card took no more than 15 seconds.
Kisi's documentation lists the read range of low-frequency credentials at 30 cm to 1 m. Kisi's compatibility list shows the HID H10301 (26-bit card) as 125 kHz.
13.56 MHz and smart cards
Are smart-card fobs safe from copying?
Not automatically.
HID's Seos datasheet lists a mutual authentication protocol with a diversified session key to protect each card session.
Upgrading
Readers that accept old and new formats
HID's iCLASS SE platform brochure says the readers support 125 kHz HID Prox, Indala, AWID and EM4102 and can use low and high frequency technologies simultaneously.
Its Seos datasheet describes a multi-technology migration card that combines 125 kHz proximity with a Seos microprocessor, and says Seos cards are supported only by iCLASS SE readers with firmware Revision E or later.
Ask for each reader's accepted formats in writing, and turn off the ones you no longer issue.
What managers do
What to do instead of copying a fob
Add people in the system, one fob each, so each credential has a name on it.
When a fob is lost, remove it in the system. Kisi's documentation, as one example, lets an administrator delete, deactivate or deassign a lost credential. Deactivate keeps it on the list so it can be turned back on, and deassign lets you give the same card to another user.
For the key side, see replacing shared keys and PINs with access control. To compare a stand-alone keypad with a managed system, see keypad locks vs managed access control.
- Give each person their own fob. A second fob for a spouse or a roommate is a second record, not a copy.
- Switch off a lost fob the same day, then issue a replacement.
- HID's iCLASS SE document says you can extract access control data from an existing card and write it to a new card.
- ICT says you can further increase security by pairing smart cards with another credential such as a PIN.
- Rekey the physical locks separately. A switched-off fob does not change a metal key.
Questions from residents and managers
Questions about copying and replacing fobs
Can I copy my apartment key fob?
A card copying device can transfer a 125 kHz card's site code and card number to a blank card. Ask the property manager for a second fob in the system, so the building knows who holds it and can switch it off.
How do I tell which kind of fob I have?
The fob alone may not tell you. A 26-bit HID card is a 125 kHz format, per Kisi's compatibility list. A site walk covers the reader models and the credential list.
Is a DESFire or Seos fob impossible to clone?
HID's Seos datasheet lists mutual authentication with a diversified session key to protect each card session. How the reader and system are set up still counts, so ask how each reader checks the card.
What if a tenant loses a fob?
Switch that fob off in the system and issue a new one. A rekey is for metal keys, not fobs.
Sources and further reading
These sources back up the general guidance. Your building and the people who approve the work decide the details for your doors.
- Integrated Control Technology (ICT): The 125kHz Proximity Card Dilemma
- Kisi: NFC versus RFID technology
- Kisi: Credential compatibility guide
- Kisi: Lost or stolen credential
- Kisi: Remove credentials
- Digital Security group, Radboud University Nijmegen: Security flaw in Mifare Classic: press release, March 12, 2008
- HID Global: iCLASS Seos card datasheet (October 2016)
- HID Global: iCLASS SE Platform Solutions brochure