HID Seos Cards and Credentials: Formats, Security and What Reads Them

Identify

Which Seos credential do I have?

HID makes Seos credentials in three shapes. The Seos Card is 2.127 by 3.375 inches and at most 0.033 inch thick, and HID lists no slot punch for it. The Seos Clamshell is a card in a welded plastic (ABS) shell with a slot punched to hang it on a lanyard, and the Seos Key Fob is a 39.5 by 31.75 mm fob for a key ring.

HID describes both the clamshell and the key fob as delivering the same level of security as a smart card. The Seos Essential is a simpler card: one access control application with no support for additional applications.

HID's Seos overview page also lists Bamboo Eco, Paper-Based and FIDO-Enabled Seos cards, and Seos cards with MIFARE Classic or MIFARE DESFire EV2; this page doesn't cover them.

For how 125 kHz prox cards and 13.56 MHz smart cards differ on any brand, see prox cards vs. smart cards.

Source HID's Seos overview page, its Seos Card, Seos Clamshell and Seos Key Fob product pages, and the Seos Card, Seos 8K Clamshell, Seos 8K Key Fob, Seos + Prox, Seos Essential and Seos Essential + Prox data sheets.

Naming

How does Seos relate to iCLASS?

In HID's naming, Seos is the credential technology and iCLASS SE is the platform it belongs to. HID's Seos Card data sheet says the cards provide trusted management of secure identities within HID Global's iCLASS SE platform, which is based on its Secure Identity Object (SIO) data model.

The clamshell, key fob and Seos + Prox documents each call the product part of the iCLASS SE platform. HID's pages also join the two names: the key fob data sheet describes "iCLASS Seos technology", the key fob product page links to "iClass Seos Credentials", and the card pictured on the Seos Card data sheet is printed "iCLASS Seos Card".

HID still treats iCLASS and Seos as two technologies. Its Seos/iCLASS 522X card carries both, and HID says it "Supports iCLASS and advanced credential technology powered by Seos".

An SIO is HID's data model for storing and transporting identity information in a single object. HID says SIOs can be deployed on contactless and contact smart cards, smart phones and USB tokens.

Source HID's Seos Card, Seos 8K Clamshell and Seos 8K Key Fob data sheets, its Seos Key Fob, Seos + Prox and Seos/iCLASS 522X product pages, and its Secure Identity Object page.

Security

What does HID say about Seos security?

HID describes mutual authentication, a check in which the card and the reader each prove they are genuine, as validating the authenticity of the card and reader to each other. HID's Secure Identity Object page says the data within the SIO is secured with a wrapper that provides key diversification, authentication signatures and encryption.

HID's Seos brochure gives the Seos SIO four characteristics: assigned unique digital identity information for the user, bound to the device cryptographically, signed at the time of creation and validated each time the credential is used, and encrypted to prevent an unauthorized party from reading the embedded user ID.

On privacy, HID says the Seos + Prox card "Communicates no traceable identifiers during card sessions to help prevent card data from being divulged or cloned by unauthorized parties." Seos Essential cards default to a random unique identifier, "meaning information isn't associated with the user without a secure authentication."

The brochure also says: "In July 2020 the Seos technology achieved a SEAL-5 rating – the highest level attainable – during an independent security evaluation conducted by TÜV."

The clamshell and key fob data sheets say both are based on a Common Criteria EAL 5+ hardware platform; EAL is short for evaluation assurance level, a grade for how thoroughly the chip's security was evaluated.

Source HID's Seos brochure, its Secure Identity Object page, and the Seos Card, Seos 8K Clamshell, Seos 8K Key Fob, Seos + Prox and Seos Essential data sheets.

Readers

Which HID readers read a Seos card or fob?

HID's Seos overview page says Seos is fully supported by HID Signo, iCLASS SE and multiCLASS SE reader platforms. The Seos Card and Seos Essential data sheets narrow that: iCLASS SE and multiCLASS SE readers that can process SIO-enabled data formats, and only iCLASS SE readers with firmware Revision E or later.

HID's documents disagree about the key fob on multiCLASS SE readers. The Seos Key Fob product page says it is fully supported by HID Signo, iCLASS SE and multiCLASS SE reader platforms; the Seos 8K Key Fob data sheet says multiCLASS SE readers are not supported and lists iCLASS SE single-technology and iCLASS SE Express deployments.

HID tests read range in open air, and says conditions including a metallic mounting surface can significantly degrade read range and performance.

For the readers themselves, their models, wiring and lights, see HID card readers.

Source HID's Seos overview page, its Seos Key Fob product page, and the Seos Card, Seos 8K Clamshell, Seos 8K Key Fob, Seos + Prox, Seos Essential and Seos Essential + Prox data sheets.

Migration

Can one card work with older prox or iCLASS readers?

HID's multi-technology cards carry Seos plus an older technology, for environments where legacy Prox or iCLASS reader technologies are in place and an upgrade to more secure technology is desired. Prox here means 125 kHz proximity cards, the older low-frequency type. The plain Seos Card has none: its data sheet lists HID Proximity as "No".

HID's 520X product page says migration credentials allow the replacement of readers gradually as time and budget allow. HID adds that the 520X and 522X cards also support network access by one-time password (OTP).

Source HID's Seos overview page, the Seos Card, Seos + Prox and Seos Essential + Prox data sheets, and the Seos Essential + Prox, Seos/iCLASS 522X and Seos/iCLASS/Prox 520X product pages.

Phones

Can a phone carry a Seos credential?

HID's Seos brochure says Seos is a software-based credential technology, so it is not tied to the underlying hardware chip, and that Seos powers HID Mobile Access, HID's phone credential.

HID says HID Mobile Access supports iOS and Android devices, including smartphones and wearables like Apple Watch. A mobile credential can sit in a digital wallet, in an organization's own app through software development kits (SDKs), or in the HID Mobile Access app.

HID says mobile credentials use Advanced Encryption Standard (AES) encryption and store keys in the phone's secure element, a protected chip in the phone. It adds that mobile-ready Signo and iCLASS SE readers that are already installed can use existing Seos keys.

Source HID's Seos brochure and its Mobile Access Solutions page.

Durability

How long does a Seos card or fob last?

HID lists a lifetime warranty for the Seos Card, Seos 8K Clamshell, Seos 8K Key Fob, Seos + Prox, Seos Essential and Seos Essential + Prox. Write endurance is how many times data can be written to the chip, and data retention is how long the chip holds its data.

HID says the key fob's molded housing is capable of withstanding elevated operating temperatures when compared with cards, and its data sheet lists IP67 (1 m for 1 hour), a dust and water rating.

Source HID's Seos Card, Seos 8K Clamshell, Seos 8K Key Fob, Seos + Prox, Seos Essential and Seos Essential + Prox data sheets.

FAQ

HID Seos questions

Service for HID Seos cards and fobs in the Bay Area

Elwin Security installs, repairs and supports card reader and key fob systems that use HID Seos credentials as part of card reader and key fob access control for commercial and multifamily properties in the San Francisco Bay Area. Calls are answered 8:00 AM-8:00 PM daily at (408) 539-0535.