Dormakaba Pushes 125 kHz Access Upgrade
Dormakaba is urging organizations to modernize legacy 125 kHz physical access control systems, warning that unencrypted proximity credentials remain vulnerable to cloning and interception.
According to a new dormakaba white paper, organizations can migrate to 13.56 MHz DESFire EV2 credentials without replacing their entire access control infrastructure. Existing wiring, door hardware, electrified locks, panels and backend systems can often remain in place.
Legacy access credentials remain vulnerable
The white paper says many 125 kHz proximity cards and fobs transmit static credential data without encryption or authentication. As a result, attackers can intercept or clone credentials using inexpensive RFID tools.
Dormakaba said DESFire EV2 offers a stronger security model. It uses AES-128 encryption, mutual authentication and dynamic transaction security. These features help prevent intercepted credentials from being reused and reduce the risk of unauthorized access.
Phased migration can reduce disruption
Dormakaba recommends a phased migration rather than a full system replacement. Organizations can first deploy dual-frequency readers that support both 125 kHz and 13.56 MHz credentials. They can then introduce DESFire EV2 credentials in high-security areas such as data centers, financial zones and other restricted locations.
The rollout can later expand across the wider workforce before legacy 125 kHz credentials are fully decommissioned. The white paper argues that modernization should not wait for existing systems to fail. Instead, organizations should consider security, compatibility and lifecycle risks as legacy platforms age.
