Episode 28 1:44 Low Current & ELV EN · العربية

Access Control, why OSDP is killing Wiegand

Wiegand's interface, SIA AC-01, was published in 1996 and has never been revised. It sets a timing window rather than a fixed rate: the typical example works out at ≈952 bit/s, and the window spans ≈4,000 down to ≈50 bit/s. Replace it, and check the card too. OSDP Secure Channel protects the link from reader to controller; cloning happens at the card, a few centimetres in front of the reader. They are separate risks, and fixing one does not fix the other.

A card reader on a post beside a glass speed gate in an office lobby
NLC Academy · Episode 28
Access Control, Wiegand vs OSDP
1:44
Animated explainer, press play to watch the concepts now; the filmed cut publishes once production wraps.
Key Takeaways

What you'll walk away with

Four ideas to carry into the next specification conversation you have.

01

Not withdrawn. Orphaned.

SIA's own catalogue entry for AC-01 reads: year published 1996, ANSI No, sponsoring subcommittee disbanded. Its credential data is one-way, reader to controller, but the cable is not: clause 3.2.5 defines a fifth conductor, LED Control, running panel to reader, with voltage levels and no defined encoding. AC-01 provides no built-in mechanism to detect a passive tap on D0/D1.

02

OSDP does not automatically mean encrypted traffic.

OSDP is a protocol that can be encrypted. Encryption comes from Secure Channel; a reader running in clear text is still conformant, and even in Secure Channel only the DATA field of the encrypting message types is encrypted. Distances differ too: ≈1.2 km is the RS-485 physical-layer guideline, while one manufacturer qualifies 1000 m for data with a locally powered reader and 200 m when the controller also powers the reader, the usual door.

03

Real in the specification, absent in the market.

The capability is genuine; the market is thin. In SIA's OSDP Verified list as archived on 16 June 2026, 1 of 200 products carried the Biometric mark and 3 the SmartCard mark. SIA reported 222 verified products from 32 companies and brands in July 2026. Check the current listing before writing native biometric support into a tender.

04

Enforce Secure Channel, and prove the key is not the default.

Write OSDP Secure Channel, enforced, cited as IEC 60839-11-5:2020, with a unique random key per reader where supported, set on trusted wiring or by the manufacturer's method, install mode disabled at handover, and a controller configured to refuse any reader that does not present Secure Channel. The default key is a fixed value printed in the specification itself: a reader still using it offers no secrecy. Hand over test results and key-generation records, never the keys.

NOT WITHDRAWN, ORPHANED
Thirty years. Still no revision.
AC-01: 30 years, 0 revisions20002010202012345678WiegandOSDP11996AC-01 published22008tap tool shown32011SIA OSDP group42015BLE tap shown52020IEC 60839-11-5620235 flaws published72024v2.2.2, errata only82026still no v2.3
SIA's catalogue (archived June 2026) lists AC-01-1996.10 as published in 1996, not an ANSI standard, subcommittee disbanded. No revision has been published.
QUANTIFY "SLOW"
≈952 bit/s is a timing example, not a Wiegand rate
D1D0101101 ms gap50 µs pulse5 pulse positions span 4.25 ms1001k10k100k1Mbit/s≈952 (example)AC-01OSDP ratesraw signalling rate, not door response time
AC-01 sets a window: 20 to 100 µs pulses, and a 200 µs to 20 ms pulse interval, which reader makers define as the pause between pulses. The typical example, a 50 µs pulse plus a 1 ms gap, is ≈1.05 ms per bit: ≈ 952 bit/s.
THE SPLIT THAT IS NOT IN THE STANDARD
AC-01 defines the frame, not its meaning
24 code bitsparityparity8-bit facility16-bit card numbera manufacturer's ordering code, not AC-01AC-01 stops at 24 code bits
AC-01 clause 5 defines the 26-bit frame as 2 parity bits plus 24 code bits, and leaves the split to the manufacturers. The familiar 8-bit facility code + 16-bit card number is one manufacturer format, H10301, not part of AC-01.
THE FIFTH WIRE
Wiegand data is one-way. The cable isn’t.
readerpanelD0 · D1to the panelLED controlto the reader+12 V · 0 Vto the readera passive tapAC-01: no built-in passive-tap detection
Card data on D0/D1 runs reader to controller. The LED control conductor (clause 3.2.5) and the power pair run the other way.
WIRING, NOT CRYPTOGRAPHY
Home run against multidrop
Wiegand, home runcontrollerone cable per reader8 terminals in practice61 to 153 m by gaugeOSDP, multidrop0x000x010x02controllerone pair plus powerterminated daisy chain200 m controller-powered
Topology is not security; Secure Channel is. Wiegand runs one cable per reader.
An open door controller enclosure in a riser cupboard, its board and terminal blocks landed on coloured field wiring, conduits entering from above
Reference

Wiegand vs OSDP × where each fails or wins

SIA AC-01 (1996) against IEC 60839-11-5:2020. Rates and distances are the documents' own published figures, not rules of thumb.

Attribute Wiegand · OSDP Notes
StandardAC-01 (1996) · IEC 60839-11-5 (2020)AC-01 has never been revised and its sponsoring subcommittee is disbanded
Effective bit rate≈50 to ≈4,000 bit/sDerived from AC-01's permitted timing window, not a defined rate. ≈952 bit/s for the typical 50 µs pulse and 1 ms gap
Cable distance, Wiegand61 / 91 / 153 mBy conductor gauge, 22 / 20 / 18 AWG. Every quoted 150 m assumes the heaviest copper
Cable distance, OSDP200 m · 1000 m · 1200 mController-powered reader · locally powered reader, in the cited manufacturer guidance · RS-485 physical-layer guideline. ≈1.3× gain at a controller-powered door, not ≈7.8×
Wires5 (V, GND, D0, D1, LED) · 4 (V, GND, A, B)The fifth Wiegand wire is a panel-to-reader return channel with no defined encoding
EncryptionNone · optionalOSDP's Basic profile is clear text and fully conformant. Only the Secure profile is AES-128
Default keyn/a · published in the standardSCBK-D is a fixed value printed in the specification. A reader still using it offers no secrecy
Readers per port1 · per controller datasheetThe protocol addresses 127; the HID Mercury MP1501 takes 2 per reader port. The widely quoted 8 comes from another protocol
Biometric in the fieldn/a · 1 of 200 verified products (June 2026)Real in the specification, rare in the market: 3 of 200 carried the SmartCard mark in SIA's June 2026 list
Credential size26 / 35 / 37 / up to 300 bits · variableThe 26-bit ceiling is a myth. PIV defines formats up to 300 bits over the same two wires
What is encryptednothing · DATA onlyOSDP encrypts the data field only, under SCS_17 and SCS_18. The command byte always travels in clear
Key deliveryn/a · osdp_KEYSETSent inside an SCBK-D session in install mode, whose key inputs are public. A recorded pairing yields the site key
THE COMPARISON EVERYONE OVERSTATES
Physical-layer distance is not powered-door distance
Wiegand, 22 AWG61 mWiegand, 20 AWG91 mWiegand, 18 AWG153 mOSDP, controller-powered reader200 mOSDP, locally powered readerup to 1000 mRS-485 guideline1200 m≈7.8x on paper, ≈1.3x at a controller-powered door
AC-01 guidance for Wiegand: 61 m at 22 AWG, 91 m at 20 AWG, 153 m at 18 AWG. Axis's A1610 guidance for OSDP: 200 m to a controller-powered reader, up to 1,000 m for data with a locally powered reader.
THE SENTENCE THAT SELLS FALSE COMFORT
OSDP does not automatically mean encrypted traffic. Read the packet.
SOM1ADDR1LEN2CTRL1SECnCMD1DATAnMAC4CHECK1 / 2SQN 2 bits0x534 of 16 bytes sentBasic profileclearclearSCS_15 / SCS_16clearclearSCS_17 / SCS_18clearAESsent in clearencrypted, DATA onlyMAC: authenticationCHECK: error detectionSecure Channel encrypts DATA, not the command
Three protections, three jobs. A checksum or CRC on every packet detects errors.
THE MOST CHECKABLE THING ON A COMMISSIONING WALK
The site key can travel under a published one
controllerreaderosdp_CHLNGRND.A, sent in clearosdp_CCRYPTRND.B, cryptogramosdp_SCRYPTserver cryptogramosdp_RMAC_Iinitial MACosdp_KEYSETthe site key, 16 bytesif recorded:SCBK-D is publicRND.A is in clearsame session keyssite key readable
Three keys: SCBK-D, the published install-mode default; the SCBK, each reader's persistent base key; and session keys derived from it every session. Pair in install mode over untrusted wiring and a recording can reveal the SCBK.
BITS OF SECRECY, NOT BITS OF KEY
A 128-bit key can be worth 0 bits
SCBK-D, the default0 bitsto anyone who has the specificationinstall mode left open0 bitsto a device on the wire that asksBishop Fox's 3 tested patterns9.6 bits768 candidates, this set onlya uniformly random 128-bit key128 bitsonly if truly random and kept secreta key is worth its search cost, not its length
AES-128 is not broken; key management is the weak point. A published default is worth 0 bits to anyone with the specification, and install mode left open can hand the key to a device on the wire.
A card reader on a bench, its four-core tail landed on a terminal strip beside a blank test card
Deep Dive

What OSDP changes operationally

Seven things to check before the protocol conversation starts.

The cloning happens in front of the reader, not behind it.

That is the point of the whole episode: the attack is on the credential, not on the wire. HID describes the modern version as migration mode used in reverse: the number is read out of a secure card with a legitimate desktop encoder and written to a cheap rewritable prox card. AES-128 is never touched. Multi-technology cards make it easy, because they ship with the weak technology enabled, so a site can believe it has migrated while every employee still carries a cloneable 125 kHz chip in the same piece of PVC.

Supervision is the operational gain.

Wiegand's return conductor carries LED voltage levels, not data, so the controller learns nothing from the reader between card reads: a reader that lost power or was pulled off the wall can look like a quiet door. OSDP is polled. The controller addresses each reader in turn, and power, tamper and offline conditions come back as messages the access system can log and alarm. That supervision, not encryption, is what every OSDP installation gets by default.

The eight-readers-per-loop figure is a transposition error.

The manual that started the "eight readers per port" figure says eight RS-485 devices on a different protocol, "or up to two OSDP devices". The protocol itself addresses 127; the MP1501 takes two per reader port. Take the number from the controller datasheet, never from a round figure. Sharing also has a key cost: where readers on one loop share a key, the least protected reader exposes it for every door on the loop, so set a unique key per reader where the controller supports it.

No explicit OSDP requirement was identified in the Saudi references reviewed (4 October 2026).

In the Saudi regulations and standards we reviewed, we found no explicit requirement for OSDP; project and client specifications can still require it. NCA's Essential Cybersecurity Controls, ECC-2:2024 control 2-14, which apply to government entities and CNI operators, require authorised access to critical areas, access and monitoring logs (CCTV) and protection of those logs, and name no credential technology, no card encryption and no reader protocol. On standards, a GSO store search on 4 October 2026 listed IEC 60839-11-1 and 11-2 as Gulf standards; 11-5 did not appear. A search result is not proof that a standard was never adopted, and a GSO standard is not by itself a Saudi mandate. Say so plainly, then make the engineering argument on its merits.

The standard does not open the door.

Note the layer boundary that matters most: IEC 60839-11-1 clause 1 excludes access point actuators and sensors and sends electric door openers, locks, turnstiles and barriers to other standards. Fail-safe and fail-secure are defined in 11-2 and required nowhere in it. The release decision belongs to the building and fire code per door leaf, which in Saudi Arabia means SBC 201-CR-2024 and SBC 801-CR-2024, Section 1010, and the Civil Defence escape-route rules, chapter 3: opening without a key or special knowledge, and manual opening if automatic means fail. A maglock plus a card reader is not, on its own, compliance.

The real key travels under a published one.

Install mode pairs a reader by opening a Secure Channel session with SCBK-D, the default key printed in the specification, and sending the site key inside it as osdp_KEYSET. Every input to that session's keys is public: the base key is published, and the challenge RND.A crosses the wire in clear because no key exists yet to protect it. A recording of the pairing therefore yields the site key. ICT's application note puts the condition in writing: communications are not secure during installation, and until pairing completes nobody may have access to the wiring. Rejecting SCBK-D afterwards does not undo a pairing that was recorded, so provision on physically trusted wiring or by the manufacturer's out-of-band method, then prove install mode is closed.

Only the DATA field is ever encrypted.

Read the packet and the marketing sentence falls apart. The start byte, address, length, control byte and command byte always travel in clear. Under the Basic profile the data does too, and that is conformant. SCS_15 and SCS_16 add a message authentication code, of which only the first 4 of 16 bytes are sent, but leave the data readable. Only SCS_17 and SCS_18 encrypt, and only the data field. Bishop Fox also showed that the capability reply a reader uses to advertise encryption cannot itself be protected, so a device on the wire can rewrite it and some controllers fall back to clear text. The defence is a controller configured to refuse any reader that does not present Secure Channel. Controller firmware sits in the same chain: CVE-2023-21406, a heap overflow in the OSDP message parser of AXIS A1001 firmware 1.65.4 and earlier, was fixed by an Axis update.

THE REORDERING THIS EPISODE EXISTS FOR
OSDP protects the reader-controller link. Credential cloning is a separate risk.
a few cme.g. 30 mthe only link OSDP protectscredentialclone ordowngradethe cardkeyed file,legacy offreaderdefaults,legacy onhighsecurityonlywiretap, downgrade,capture the keyunique keys,tamper alarmedcontrollerfirmwareflawsvendorpatchesappliedthe published attackthe control that closes it
Secure Channel protects the reader-to-controller link. It does not secure the credential, legacy 125 kHz cards, open formats, reader configuration or controller firmware.
THE CRYPTOGRAPHY IS NOT THE TARGET
A downgrade attack never needs to break AES-128
one card125 kHz andAES-128an encoderreads thelegacynumbera blank cardwrittenwith itthe readeropensthe doorthe AES-128 chip is not attacked
HID describes attackers who cannot copy a Seos or DESFire credential and "use migration mode in reverse": the credential data is read and re-encoded onto a legacy card. It works only where the legacy technology stays enabled and the reader accepts it.
THE PART CRYPTOGRAPHY CANNOT FIX
A credential number alone is not proof of authenticity
openH10301anyone canorder a numberduplicatespossibletrackedH10302HID controlsissuanceduplicatespreventedrestrictedCorporate 1000authorisedbuyers onlyduplicatespreventedissuance control is not proof of authenticitythat needs card authentication
A credential number identifies a user; it does not prove the card is genuine. That takes card authentication, protected credential data, controlled issuance and correct controller authorisation.
TWO LADDERS, AND NEITHER OPENS THE DOOR
Grade is not the same as Level. And the standard excludes the lock.
IEC 60839-11-11234set by risk assessment,per access pointUL 294IIIIIIIVset by type testing,per producttwo ladders, two different bases
Escape doors follow SBC 201-CR-2024 and SBC 801-CR-2024, Section 1010, and Civil Defence escape-route rules: opening without a key or special knowledge, and manual opening if automatic means fail. Check each door.
THE SAUDI ANSWER, HONESTLY
No explicit OSDP requirement was identified in the Saudi references reviewed (4 October 2026)
access, CCTV logsNCA ECC-2:2024, 2-14GSO standards found11-1:2014, 11-2:2016OSDP part, 11-5not found in GSO searchOSDP on the wireno explicit requirement foundprojects and clients can still specify itreferences reviewed 4 October 2026
NCA ECC-2:2024 applies to government entities and private operators of critical national infrastructure. Control 2-14 requires authorised access to critical areas, access and monitoring logs (CCTV) and their protection; it names no reader protocol.
From the Academy to the Field

NLC, access control with the credential and the link both specified.

We specify the credential and the link together, because neither replaces the other: legacy 125 kHz credentials and insecure or open 13.56 MHz credential technologies disabled, a key-protected file read rather than the card serial number, and a tracked format. Then OSDP Verified to the Secure profile, cited as IEC 60839-11-5:2020, with a unique random key per reader where supported, install mode closed at handover, tamper events alarmed as well as logged, and key-generation records, never keys, in the handover file.

See the solution
Next Episode

Public Address & STI / STIPA

Watch next

Get the next episode by email

Practical lighting know-how from NLC Academy. No spam, unsubscribe anytime.

By subscribing you agree to receive NLC emails.

Sources

Sources & further reading

The standards and manufacturer documents behind every number on this page.

Shareable

Forward the carousel to a colleague

An 18-slide explainer, ready to post straight to LinkedIn as an image carousel.

Slide 1
Slide 8
Slide 11
Download 18 PNGs or grab the PDF