Credentials and readers: cards, phones, Wiegand and OSDP
What a credential proves and how it can be attacked: authentication factors, legacy 125 kHz proximity cards, contactless smart cards and mobile credentials, card formats and number collisions, skimming, sniffing and cloning, and how readers talk to controllers over Wiegand or OSDP with Secure Channel. Builds on lv-access-control.
- Level
- Intermediate
- Length
- About 60 minutes
- Contents
- 3 lessons · 1 video · final exam
- Status
- Published · updated 3 Oct 2026
Skills you'll practise
- Explain which authentication factors a card, a PIN and a biometric provide, and choose how many a door needs from the organization's area levels
- Decode the fields of a 26-bit card format and explain how duplicate card numbers arise
- Describe skimming, sniffing and cloning and choose credentials and practices that reduce each risk
- Compare Wiegand and OSDP wiring and features and check that Secure Channel is actually in use
- Plan a migration from legacy proximity cards to cryptographically protected credentials
Course outline
- 1.Credentials and readers: cards, phones, Wiegand and OSDPVideo · 3 min
- 2.Credentials and authentication factorsLesson · 20 min
- 3.How credentials are attackedLesson · 18 min
- 4.Readers and controllers: Wiegand and OSDPLesson · 22 min
- 5.Credentials and readers: cards, phones, Wiegand and OSDP: knowledge checkKnowledge check · 20 questions
- 6.Final exam8 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- NIST SP 800-116 Rev. 1: Guidelines for the Use of PIV Credentials in Facility Access (threats: identifier collisions, revoked cards, skimming, sniffing, cloning; Controlled / Limited / Exclusion areas and 1 / 2 / 3 authentication factors; US federal guidance used here as an example)
- Security Industry Association: Open Supervised Device Protocol (OSDP): open standard between panels and peripherals such as readers; bidirectional; 2 wires instead of 12+ allows multidrop; Secure Channel with AES-128; IEC 60839-11-5:2020; SIA OSDP Verified conformance testing
- GSA idmanagement.gov: PACS 101 (credential readers, control panels, access control servers, cardholder data repositories; use legacy credentials only as part of a migration strategy)
- Wikipedia: Wiegand interface (DATA0/DATA1 and ground; 26-bit format of parity, 8-bit facility code, 16-bit ID, parity; manufacturers typically specify about 150 m / 500 ft)
- Wikipedia: Proximity card (125 kHz cards carry a facility code and card number; contactless smart cards at 13.56 MHz under ISO/IEC 14443 and 15693)
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.