Why DESFire key ownership deserves attention early on
MIFARE DESFire has become one of the most widely used card technologies in modern access control. It has replaced older UID‑based solutions thanks to its security, open standard, and broad industry support.
For many organisations, MIFARE DESFire is a natural and well‑reasoned choice.
One aspect, however, is often given less attention at the early stages of a project: who controls the DESFire security keys. Although DESFire is an open‑standard technology, security key ownership can determine whether the system remains open in practice or starts to resemble a closed solution. This can have a surprisingly significant impact on the system’s lifecycle over time.
How MIFARE DESFire works
DESFire technology is not based on a simple card serial number. The data stored on the card is protected, and the card can only be read when the card and the reader are able to authenticate each other. This authentication relies on DESFire security keys.
They are used to:
- identify the card
- encrypt communication
- protect the data stored on the card.
In practice, DESFire security is therefore not only about the card or the reader, but also about the security keys, and who controls them.
Because of their role, these keys must be:
- generated securely
- stored in protected environments
- managed with clear processes.
Both, open MIFARE DESFire technology, and some proprietary, closed technologies are based on security keys. Proper key management is essential for maintaining system security. At the same time, who controls these keys determines who can issue cards, program readers, and use credentials in the future.
Open and closed systems can both be secure
In access control, both open‑standard systems and closed, proprietary systems can be implemented securely. However:
A closed system may:
- limit components to a single vendor
- tightly control configuration and integration
- reduce variability and simplify responsibility
An open‑standard, such as MIFARE DESFire system:
- allows components from different suppliers
- supports multiple platforms and integrations
- gives customers more flexibility over time
From a purely security‑technical perspective, both models can offer strong protection when designed correctly. The difference is not primarily about security strength, but about control, flexibility, and long‑term options.
When open technology starts to behave like a closed system
MIFARE DESFire itself is an open‑standard technology. Cards, readers, and systems from different vendors can technically work together. However, the way MIFARE DESFire is implemented plays a crucial role.
If a reader manufacturer:
- creates the DESFire security keys
- stores them within their own environment
- does not allow the customer or integrator to manage them;
the result can closely resemble a closed, proprietary system, even though the underlying technology is open. In this situation, the openness of MIFARE DESFire no longer means practical flexibility.
Practical situations where this becomes visible
In daily operation, this difference is often unnoticed. Cards work, doors open, and the system performs as expected.
Challenges typically appear later, for example when:
- an organisation wants to introduce another access control platform
- several sites need to be aligned under a common access policy
- a system must be expanded
- a supplier or integrator needs to be changed.
If the MIFARE DESFire security keys are not available, existing cards and readers may not be reusable with a new system or reader.
Summary: Options for maintaining a secure system
- Proprietary, closed technology
Your system can be secure, but the supplier tightly controls future enhancements, as well as reader and card additions. The system is fully dependent on the supplier’s technological roadmap, development decisions and pricing. - Open‑standard technology (e.g. MIFARE DESFire) with supplier‑controlled keys
The technology itself is open, but the reader supplier retains control of the security keys and does not hand them over if you decide to change reader or card suppliers. - Open‑standard technology (e.g. MIFARE DESFire) with customer control options
Your supplier:
-
- Allows you to program your own readers and cards, if you choose to.
- Alternatively, lets you decide who programs your readers and cards.
- Can provide security key management and programming services.
- Is responsible for secure key handling in line with information security practices while the keys are under their control.
- Hands over the security keys to another party if you decide to change providers.