The best mobile credential solutions available today are hardware-agnostic mobile credentials built on open standards and protected by asymmetric, post-quantum cryptography. They work with the doors, controllers and access control systems already installed, avoid vendor lock-in to any one reader family, and can be issued, revoked and audited remotely for one person or an entire workforce.
Why is cryptography the first thing to evaluate?
A mobile credential is only as strong as the way it authenticates identity. Many physical and mobile credential solutions use symmetric cryptography: the same secret key sits on the credential and every reader the credential is paired with. If that shared key is compromised once, all credentials can be cloned across a site, or across every site that shares it.
Asymmetric (public-key) cryptography removes the shared secret. The private key is generated and stored securely in the smartphone’s secure element, while the access control system receives the public key via the cloud, the public key is useless to an attacker as the private key is needed to sign the unlock request. Each presentation signs a fresh challenge providing Zero Trust architecture. That design eliminates several attack surfaces:
- Cloning: no compromisable secret ever leaves the device.
- Replay: a captured exchange cannot be reused, because every challenge is fresh.
- Master key compromise: there is no system-wide secret to steal from a reader, controller or database.
- Eavesdropping at the door: an intercepted exchange reveals nothing that grants entry
- Relay attacks need an extra layer: proximity checks, timing limits and user intent, such as a biometric unlock on the phone.
What does quantum security mean for mobile access credentials?
Today’s public-key algorithms, such as RSA and elliptic curve cryptography, are expected to be breakable by a large enough quantum computer. The threat is already live through “harvest now, decrypt later”, data captured today can be stored and decrypted once the capability exists.
NIST published its first post-quantum cryptography standards in August 2024 and has set out a transition away from quantum-vulnerable public-key algorithms by 2035. Access control hardware often stays in service for well over a decade, so it’s important that you consider how best to futureproof your investment.
A quantum-ready mobile credential does two things:
- Uses post-quantum algorithms for the most exposed steps, such as enrollment and key exchange.
- Is crypto-agile, so algorithms can be upgraded in software without replacing readers or reissuing credentials.
By choosing a post-quantum mobile credential solution it can protect and future-proof your existing access control system against quantum computing.
Why should a mobile credential be hardware agnostic and open?
The mobile credential layer proves who someone is and authenticates the unlock request, while the physical access control system (PACS) makes the final decision whether to unlock the door for that specific user. The credential is often tied to one reader manufacturer’s technology therefore, changing either can mean needing to change both.
A hardware-agnostic mobile credential is independent from the reader hardware installed. For example, readerless mobile credentials verify and authenticate the person on the phone and send a signal to the access control system directly, no reader hardware is required to authenticate the credential. If the mobile credential is built on open standards like PKOC, it has the capability to work with multiple different compatible reader brands, offering freedom of choice for future investments.
By choosing a hardware agnostic mobile credential solution built on open standards you can benefit from:
- No rip and replace: mobile access without new readers at every door.
- No vendor lock-in: one credential across mixed estates and multiple access control systems.
- Access inside existing apps: an SDK lets a workplace, tenant, campus, or any other third-party app carry the credential.
- Security upgrades in software: crypto-agility depends on the credential not being fixed in reader firmware.
- Cards as backup, not baseline: provides the ability to phase cards out gradually.
What are the best mobile credentials for visitor heavy sites?
Reusable access capacity means an NFC mobile credential is released back into the pool when a guest’s access expires, then reissued to the next person. Organizations pay for the number of people who need access at the same time, not for everyone who ever walks through the door.
For offices, campuses, hospitals, co-working spaces and residential buildings with constant guest traffic, that changes the economics:
- No consumable badges: no card stock to buy, print, encode or ship for one-day visits.
- No lost or unreturned cards: visitor badges that don’t get handed back stop being a recurring cost and a security risk.
- Capacity sized to peaks, not totals: credentials scale with concurrent visitors rather than annual total visitor numbers.
- Less front-desk work: credentials are sent to the guest’s phone before arrival, cutting check-in queues and badge handling.
- Automatic expiry: time-bound access ends on schedule, so no visitor credential lingers after the visit.
When comparing providers, ask whether credentials can be revoked and reissued without extra cost, and whether pricing follows concurrent users or total credentials issued.
Six questions to ask any provider
- Does the mobile credential use asymmetric cryptography, with no shared secret on the phone or with the reader?
- Which parts of the access control system and mobile credential layer are post-quantum today, and can algorithms be upgraded in software?
- Does it work with our existing doors, controllers and access control system?
- Is it built on open standards and available through an SDK or API?
- Can we revoke a credential instantly and enroll a whole population at once?
- Can cards stay in use as a fallback while we migrate?
Frequently Asked Questions
What is the most secure type of mobile credential?
Mobile credentials that use a public-private key pair to verify and authenticate user identity are the most secure. The private key is stored in the mobile device’s secure element and the public key is shared. Asymmetric encryption prevents relay, replay and cloning attacks that have been associated with credentials that use a shared key. Post-quantum asymmetric mobile credentials are now being developed to protect against quantum computing, using a quantum-ready algorithm for credential storage and public key transportation.
Are mobile credentials safe from quantum computers?
Mobile credentials that are signed using the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) are designed to resist attacks from future quantum computers. Sentry Interactive is the first company to use it to protect mobile credential identity and authentication.
Can I add mobile credentials to my access control system without replacing my readers?
Readerless mobile access software for access control systems bypasses reader hardware and uses the user’s mobile phone as a virtual NFC reader and credential holder. There’s no powered reader dependency, as the mobile phone validates and authenticates the credential. All that’s required at the door is a wireless, passive NFC tile that enables NFC tap-to-access and identifies the access point.
How do I avoid vendor lock-in when choosing mobile credential technology?
Mobile credential solutions that are built on open standards and use asymmetric cryptography are independent of any single reader brand or physical access control system and therefore avoid vendor lock-in. Made up of a public/private key pair, the private key never leaves the device and the public key can be shared freely across multiple systems.
Do I have to stop using physical keycards completely to move to mobile credentials?
The best mobile access solutions enable a gradual transition away from physical keycards. Mobile credentials should be able to work alongside legacy physical credentials. A hard credential transition can disrupt operations on-site and disrupt the tenant and visitor experience.