I find the key is either using a purely online system that relies on the UID* or seperately encrypting the content stored on the card. * Perhaps even using the

I find the key is either using a purely online system that relies on the UID* or seperately encrypting the content stored on the card. * Perhaps even using the UID combined with some encrypted data on card, as the UID can be changed on questionable mifare cards.