Most organisations still open doors with 125 kHz proximity cards or MIFARE Classic badges whose security was broken years ago, and cheap handheld readers now make copying a badge a seconds-long task for anyone who can stand near an employee. Replacing them is not a single purchase: it is a multi-year project touching every reader, every card, the controller wiring and the badge office, and it has to run without locking staff out. This guide is the migration playbook: why the old credentials fail, how to inventory readers and cards, which target credentials to choose (secure smart cards and mobile credentials), how to run a dual-technology transition, how to budget, test and roll back. It is written for physical security managers, facilities and IT security leads, and the executives who fund the work. Credential types are compared vendor-neutrally; where products are named they are listed alphabetically by vendor and the order is not a ranking. Controller and head-end hardening is covered in the Physical Access Control Systems Security Guide.
Key takeaways
- Legacy cards are broken by design, not by bad luck. 125 kHz proximity cards send a fixed number with no cryptography, and MIFARE Classic's CRYPTO1 cipher was publicly broken in 2008. No configuration change fixes either.
- The reader is the migration bottleneck. Cards are cheap to reissue; readers, cabling and controller support decide the timeline. Inventory them first.
- Dual technology is a bridge with a downgrade risk. Multi-technology readers and cards let you migrate gradually, but while a reader still accepts the legacy credential, a cloned legacy badge still opens that door. Set a firm date to switch legacy reading off.
- Secure the whole chain. A secure card read by a reader that sends the number over Wiegand to the panel leaves the wire as the weak point. Pair the card migration with OSDP Secure Channel.
- Keys are the real asset. Who holds the card keys, how they are diversified and where they are stored matters more than the card brand. Own them, or know contractually who does.
What is changing and why
No regulator or vendor has set a single end-of-life date for proximity or MIFARE Classic cards. What has changed is the cost of attack: research, open-source tools and consumer devices that read and emulate low-frequency and 13.56 MHz badges are widely available, and searches for badge cloning have risen with them. A credential that can be copied cannot prove who is at the door, which defeats NIST SP 800-53 PE-3 Physical Access Control and NIST CSF 2.0 PR.AA-06.
| Credential | Frequency | Security property | Why it is being replaced |
|---|---|---|---|
| Proximity (prox) cards | 125 kHz | Static identifier (facility code and card number), no cryptographic authentication | Read at a distance and replayed or written to a blank card; nothing distinguishes the copy |
| MIFARE Classic | 13.56 MHz | Proprietary CRYPTO1 cipher, 48-bit keys | Radboud University showed in 2008 that keys can be recovered offline within a second; a shared site key exposes every card |
| Card serial number (UID) only readers | 13.56 MHz | Reader trusts the card's serial number | Even on a secure card, reading only the UID discards its cryptography |
| CHUID-only reading of PIV cards | 13.56 MHz | Signed but freely readable object | NIST SP 800-116 Rev 1 notes FIPS 201 deprecates CHUID authentication as giving little or no confidence; a partial clone can pass it |
The last two rows matter: organisations often buy secure cards and configure readers to read only the serial number, which leaves them no better off than prox. Legacy first-generation proprietary 13.56 MHz formats should be assessed against the manufacturer's current advisories in the same way.
Official timeline and current status
Because there is no announced retirement date, the dates that matter are the ones that established the risk and the replacement standards. Checked on 8 November 2026.
| Date | Event | Source |
|---|---|---|
| 7 March 2008 | Radboud University announces CRYPTO1 key recovery research on MIFARE Classic; paper presented at ESORICS 2008 after a court refused NXP's injunction on 18 July 2008 | Radboud University Digital Security group |
| June 2018 | NIST SP 800-116 Rev 1 published; new federal PACS must support authentication mechanisms such as PKI-CAK rather than CHUID | NIST |
| May 2020 | OSDP approved as international standard IEC 60839-11-5:2020 | Security Industry Association |
| October 2024 | SIA releases OSDP version 2.2.2 | Security Industry Association |
Your own timeline should be driven by risk: sites with high-value assets, regulated areas (data centres, laboratories, cash handling) and buildings shared with the public go first.
Who and what is affected
- Every badge holder: staff, contractors, visitors with temporary badges, and service accounts in the PACS that represent shared or vehicle credentials.
- Readers: single-technology 125 kHz readers must be replaced; many multi-technology readers can be reconfigured, but firmware and licence support for the target credential must be confirmed.
- Controllers and panels: must accept the new card number format (bit length) and, for OSDP, support the protocol and Secure Channel.
- Integrated systems: printers, secure print release, canteen payment, lockers, lifts and time and attendance systems often read the same badge and are forgotten until cutover.
- Executives and risk owners: the project needs multi-year capital funding and a policy decision on mobile credentials.
Finding affected systems and identities
| Inventory item | How to collect it | Decision it drives |
|---|---|---|
| Card population by technology and format | PACS cardholder export (card format, bit length, facility code); sample cards checked by the badge office with a multi-technology reader | How many cards to reissue and in what order |
| Readers by model, firmware, technologies enabled and interface | Installer records, PACS hardware tree, site survey door by door | Replace, reconfigure or keep; Wiegand or OSDP |
| Controller capability | Panel model and firmware against manufacturer documentation | Whether OSDP and new formats are supported or panels must be replaced |
| Reader configuration | Reader configuration cards or tools; check whether UID-only reading is enabled | Find secure cards that are being read insecurely |
| Other badge consumers | Ask facilities, finance and HR; check print and payment systems | Which systems must support the new credential before cutover |
| Key custody | Contracts with integrator and card supplier; key ceremony records | Whether you own site keys or are locked to one supplier |
Where identity fits: the card number is an identifier linked to a person in HR and the PACS. Reconcile the PACS cardholder list against HR leavers during the inventory; migration is the cheapest moment to remove orphaned and shared badges. See the Orphaned and Dormant Accounts.
Migration options
Target credentials
| Option | Security features (from vendor documentation) | Choose when | Trade-offs |
|---|---|---|---|
| Seos (HID) | Mutual authentication and secure messaging between card and reader; SIO-enabled data protection; combination cards with 125 kHz prox available for transition | Estate already on the vendor's readers; need for a bridging card | Confirm key custody options and licensing for multi-vendor readers with the vendor |
| MIFARE DESFire EV3 (NXP) | Hardware AES-128 with key versioning; Common Criteria EAL5+; ISO/IEC 14443 A; proximity check against relay; transaction timer against man-in-the-middle; backward compatible with EV2, EV1 and D40 | Multi-vendor reader estate; need for multi-application cards (print, payment) | Security depends on correct key management and diversified keys configured by the integrator |
| Mobile credentials (phone wallet or app, NFC or Bluetooth) | Credential protected by the phone's secure element and device unlock | Hybrid workforce, desire to cut card printing, strong mobile device management | Battery and device dependency; staff without suitable phones; privacy questions on personal devices |
| PIV or PKI smart cards | PKI-CAK challenge-response, highly resistant to cloning per NIST SP 800-116 | Government, defence supply chain, or single card for logical and physical access | Higher card and reader cost; certificate lifecycle to manage |
Whatever the card, configure readers to perform cryptographic authentication with the card's secure application, never to read only the UID. See the Smart Card and PIV/CAC Authentication Guide.
Reader wiring: Wiegand to OSDP
OSDP replaces the Wiegand interface with a two-wire, multi-drop, supervised connection; OSDP Secure Channel encrypts reader-to-panel traffic with AES-128, and SIA's OSDP Verified programme tests conformance. Schedule OSDP into the same door visit as the reader swap to avoid paying for access to each door twice. The Physical Access Control Systems Security Guide covers Secure Channel key handling and the Wiegand to OSDP steps in depth.
Transition strategies
- Multi-technology readers first, then cards: install readers that accept both old and new credentials, reissue cards by department, then disable legacy reading. Lowest disruption; longest exposure window.
- Combination cards: issue cards carrying both a secure credential and the legacy technology so they work on unconverted doors. Useful for large campuses; the legacy half stays cloneable until it is disabled at every reader.
- Site by site cutover: convert a whole building at once (readers, panels, cards). Shortest exposure; needs strong badge office capacity on cutover day.
Small organisations with one or two sites usually do best with a single-site cutover; large estates usually need multi-technology readers with a published legacy switch-off date per site.
Budgeting
- Readers: hardware, labour per door, and any cabling for OSDP.
- Controllers: upgrades or replacement where OSDP or new formats are unsupported.
- Credentials: cards or mobile credential licences, often recurring per user per year.
- Enrolment: badge office time, printing, and communication to staff.
- Integrations: print, payment, lockers and lifts.
- Key management: key ceremony, secure storage and documented custody.
Testing and rollback
- Pilot one door type and one user group (for example, a single office floor) with the new card, the new reader configuration and OSDP Secure Channel.
- Test negative cases: a legacy card on a converted reader must be refused once legacy reading is off; a cloned UID must be refused; a revoked card must be refused within the expected time.
- Test integrations (printers, lifts, payment) with the new card before staff rely on it.
- Keep a rollback path during the pilot: multi-technology readers can re-enable legacy reading by configuration if the new credential fails; keep a stock of temporary legacy badges and staffed entry for critical doors.
- Remove the rollback path deliberately: once a site is fully reissued, disable legacy technology on every reader and record the date. A reader left accepting prox is the hole the project was meant to close.
Detection and measurement
- Percentage of doors with legacy reading disabled, by site.
- Percentage of active badges on the target credential.
- Readers on OSDP Secure Channel versus Wiegand.
- Legacy-format badge presentations per week after switch-off (should fall to zero; any remaining are lost, unreturned or cloned cards).
- Access granted to cardholders with no matching HR record: target zero.
- Monitor PACS events for the same badge used at two distant readers in a short time, a sign of a copied credential (PE-6 Monitoring Physical Access).
Risks of doing nothing
- Undetectable impersonation: a cloned prox or MIFARE Classic badge produces a normal "access granted" event in the cardholder's name, so logs point at the wrong person.
- Physical route to logical compromise: physical penetration testers routinely use copied badges to reach network ports, server rooms and unattended devices. See the Social Engineering and Physical Penetration Testing Guide.
- Stranded hardware: manufacturers steer new development to secure credentials and OSDP, so legacy readers become harder to buy and support.
- Audit findings: assessors testing PE-3 and ISO/IEC 27001:2022 A.7.2 Physical entry increasingly test badge cloning directly.
Common failure patterns
- Buying secure cards but leaving readers in UID-only mode, so the cryptography is never used.
- Running dual technology indefinitely because nobody owns the switch-off date.
- Upgrading cards and readers but leaving Wiegand in place, so card data still crosses the wire in clear.
- Leaving card keys with the integrator with no contractual right to them, locking the organisation in and leaving key custody unaudited.
- Forgetting printers, lifts and payment terminals, then re-enabling legacy reading to fix complaints.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PE-2 Physical Access Authorizations; PE-3 Physical Access Control; PE-6 Monitoring Physical Access | Who may enter, how entry is enforced, how it is monitored |
| NIST SP 800-53 Rev 5 | IA-5 Authenticator Management; SC-12 Cryptographic Key Establishment and Management | Badge lifecycle and card key custody |
| NIST CSF 2.0 | PR.AA-06 | Physical access managed, monitored and enforced commensurate with risk |
| ISO/IEC 27001:2022 | A.7.2 Physical entry | Secure areas protected by entry controls |
| Standards | IEC 60839-11-5 (OSDP); ISO/IEC 14443; NIST SP 800-116 Rev 1 | Reader protocol, contactless interface, PIV in PACS |
Practitioner checklist
- Export the cardholder database and count badges by technology, format and facility code.
- Survey every door: reader model, firmware, enabled technologies, Wiegand or OSDP, controller capability.
- Check whether any readers read only the card UID and fix them first.
- Choose the target credential and mobile policy, and document who owns the card keys.
- Pick a transition strategy per site and publish a legacy switch-off date for each.
- Replace or reconfigure readers and move them to OSDP Secure Channel in the same visit.
- Pilot, test negative cases and integrations, then reissue by department.
- Disable legacy reading on every reader once a site is reissued, and verify with a legacy test card.
- Reconcile badges against HR records and remove orphaned and shared cards during reissue.
Standards and references
- NIST: SP 800-116 Rev 1, Guidelines for the Use of PIV Credentials in Facility Access
- Security Industry Association: Open Supervised Device Protocol (OSDP)
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
- Radboud University: Security flaw in MIFARE Classic
- HID Global: Seos Essential + Prox
- NXP: MIFARE DESFire EV3
Related NHI Mgmt Group resources: Physical Access Control Systems Security Guide · Physical and cyber security convergence · Smart Card and PIV/CAC Authentication Guide · Physical and Environmental Security Policy Template