HID Prox keys don't use any kind of challenge-response crypto and so can readily be duplicated. I would say there are two meaningful mitigations here though: 1

HID Prox keys don't use any kind of challenge-response crypto and so can readily be duplicated. I would say there are two meaningful mitigations here though: 1) HID Prox is quite old, and while still in common use it shouldn't be used in any new installations for a number of years now. 2) The situation was the same for other digital lock systems of the period, such as the now largely forgotten Marlok and the Secur-a-key. HID Prox basically just predates a challenge-response scheme being technologically feasible. Unfortunately, the intersection of Prox with later RFID technology makes it easier to duplicate Prox keys than these other types (the other types would just require specialized jigs to duplicate) Today, HID sells a number of systems using different protocols. However, they have both DESFire and SIA compliant products - in fact, as you hint at, HID was one of the original developers of the OSDP protocol and (along with their collaborators) assigned it to SIA. I'm not necessarily defending HID, as the company has made a huge number of missteps over the years and it looks like that's not stopping now. However, most of the old complaints about HID products are no longer true and they sometimes get an unfairly hard rap - for example, HID's decision not to change the physical case design of their keys over the years (which is useful to their customers who have invested in tooling) has lead a lot of people to believe that all HID systems are Prox systems, which is not true. Of course, I would argue that selling new Prox systems at all at this point is a huge mistake - and you can still buy new Prox systems from HID, although I'm sure they'll try to upsell you to their OSDP-compliant iCLASS system. EDIT: As a further note in HID's defense, one of the big problems with HID products is that their catalog line-up is really, really confusing to interact with from a security perspective. If you buy an iCLASS system, for example, there's still a half-dozen different actual protocols that could be used to do the card authentication. It can get very frustrating very quickly. There are two big reasons for this, though. The first is that HID tries very hard, perhaps too hard, to allow customers to upgrade without having to replace all of their equipment at once, so most HID systems are designed to interoperate with many older systems. The bigger reason though is that many HID systems are designed to very specific requirements from the federal government and other parties, and these requirements are often confusing and contradictory. That's a problem you'll see a lot in the enterprise security space: systems that are really confusing because they are exactly FISMA, FICAM, F-whatever compliant.