> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/credential-information.md).

# Credential information

Compare credential technologies and understand the keys used to protect them.

Command Centre supports a wide range of access credentials. This section covers the technologies available, the keys that protect them, and what to do when cards do not read.

There are three types of access credential:

* Something you **know**: a PIN (typically 4 or 6 digits), a password, or a pass-phrase.
* Something you **have**: a card, fob, or phone. A card or fob can carry a credential in several forms: 125 kHz, MIFARE Classic, MIFARE Plus, iClass, Legic, DESFire EV1, DESFire EV2, CSN, or a printed QR code. A phone can carry secure credentials or QR codes.
* Something you **are**: a biometric measurement. This can be fingerprint, vein, face, hand, iris, or voice.

Using more than one factor raises the security level beyond any single technology. Card plus PIN and card plus biometric are common combinations.

### Credential comparison

This table compares some of the key attributes of the credential technologies Gallagher supports.

<table><thead><tr><th width="154">Technology</th><th width="101">125 kHz</th><th width="117">MIFARE Classic</th><th width="125">MIFARE Plus / DESFire EV1</th><th>MIFARE DESFire EV2/EV3</th><th>Mobile Connect</th><th>PIV</th></tr></thead><tbody><tr><td>Security</td><td>Low</td><td>Medium</td><td>High</td><td>Very High</td><td>Very High</td><td>Very High</td></tr><tr><td>Credential Cost</td><td>Low</td><td>Low</td><td>Medium</td><td>Medium</td><td>Medium</td><td>High</td></tr><tr><td>Supports multiple applications</td><td>No</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Supports multiple biometric apps</td><td>No</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Integration flexible</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Product status</td><td>Current</td><td>Current</td><td>Current</td><td>Current</td><td>Current</td><td>Current</td></tr><tr><td>Recommended for new sites</td><td>No</td><td>No</td><td>No</td><td>Yes</td><td>Yes</td><td><strong>Yes</strong></td></tr></tbody></table>

> Comparisons are indicative only. Technology choice is often specific to customer requirements. Consult your Gallagher representative when selecting.

### Credential threat lifecycle

| Attack category                                   | Technologies affected                 |
| ------------------------------------------------- | ------------------------------------- |
| No knowledge required (trivially clonable)        | 125 kHz                               |
| Knowledgeable attacks (real-world exploits exist) | MIFARE Classic, iClass                |
| Theoretical attacks only                          | *(none current)*                      |
| No known attacks                                  | MIFARE Plus, DESFire EV1/EV2/EV3, PIV |

**125 kHz.** Cheap hardware clones these cards in seconds. Avoid the technology in any situation where security is required.

**MIFARE Classic.** Compromised in 2008. Free Android apps can clone Classic credentials in seconds using published key lists. Gallagher actively encourages sites to migrate away from Classic. Reports of real-world cloning incidents are increasing.

**MIFARE DESFire.** To reduce risk on sites, it is recommended that sites not use the Gallagher default DESFire key. Sites installed at vEL8.20 or higher have unique Site Specific Keys (SSKs) generated at install and sites upgraded to vEL8.30 or higher can migrate existing DESFire credentials from Default keys to an SSK.

### Third-party readers and Site Specific Keys

Only the **Gallagher Access Object with the Facility Code on the site licence** is affected. If there are other Gallagher Access Objects on the card, but the Facility Code for those objects is not on the site licence, they will be unaffected.

Any other objects such as **Morpho, Salto, Non Diversified DESFire object, or ASCII objects are unaffected** by rolling the Gallagher keys.

***

🔗 **Related**

* [Legacy Credentials](/knowledge-hub/products/cc-hardware/credentials/legacy-credentials.md). Technologies that should no longer be used on new installations.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/credential-information.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.