For decades, physical security systems, smart cards, vehicle alarms and connected devices have depended on symmetric encryption. In a symmetric system, the same secret key—or closely related secret keys—is used to encrypt, decrypt or authenticate communications.
Symmetric encryption itself is not inherently obsolete. Modern algorithms such as AES remain extremely strong when properly implemented. The danger arises when manufacturers distribute the same secret across thousands or millions of credentials, readers, applications or devices.
Once that shared secret escapes, every product that trusts it may become vulnerable.
Lessons from MIFARE Classic and HID iCLASS
MIFARE Classic is one of the best-known examples. The technology used the proprietary CRYPTO1 cipher and 48-bit secret keys to authenticate cards and protect stored information. Researchers reverse-engineered the system and demonstrated practical, low-cost attacks capable of recovering keys, reading card data and modifying credentials.
The problem was not limited to one stolen card. Organizations commonly deployed identical or predictable keys across many cards and readers. Recovering a useful key could therefore expose an entire credential population.
Legacy HID iCLASS systems presented a similar systemic risk. Researchers learned the proprietary authentication algorithm and demonstrated attacks against its secret-key design. More recent research showed how authentication keys could be extracted from credential encoders. In standard shared-key deployments, one recovered key could potentially be used against credentials belonging to numerous organizations.
A custom key assigned to one organization reduces the blast radius, but it does not eliminate the architectural problem: readers, encoders and credentials must all possess or derive secrets that are valuable to an attacker.
The security of the entire ecosystem ultimately depends on preventing every copy of that secret from being extracted—forever.
The KARR Alarm Case
The recently disclosed vulnerability involving dealer-installed KARR vehicle alarm systems demonstrates that this is not merely an old smart-card problem.
According to reporting on research conducted at the University of California San Diego, millions of KARR alarm modules relied on a common Bluetooth authentication key. Researchers reportedly recovered the hardcoded key by analyzing the manufacturer’s mobile application.
The same key was trusted by devices installed in approximately 2.2 million vehicles.
An attacker within Bluetooth range could potentially issue commands that normally belonged to the authorized application, including unlocking doors, controlling the alarm and activating the vehicle’s immobilizer. The researchers were reportedly able to demonstrate the attack using an ordinary Android phone.
This is the catastrophic weakness of a broadly shared secret: compromise does not remain local. A key recovered from one application may expose an entire product line.
Patching the software does not necessarily resolve the underlying deployment problem. Owners may not know the aftermarket device is installed, may never use the associated application and may therefore never receive the update.
Offensive Capabilities Are Becoming Commoditized
Organizations should assume that reverse engineering and vulnerability research will continue to become faster and less expensive.
Attackers can already rent powerful virtual servers with GPUs by the hour. Inexpensive software-defined radios, NFC tools, Bluetooth adapters and credential-programming devices are widely available. Frontier AI models can assist with source-code analysis, protocol interpretation, firmware review and the development of testing scripts.
Agentic AI systems can coordinate multiple stages of an attack: locating software, extracting binaries, identifying cryptographic functions, testing candidate keys and generating usable tooling.
AI does not magically break sound encryption. It does, however, reduce the expertise, time and labor required to find implementation mistakes. A secret embedded in an application, reader, encoder or firmware image should therefore be treated as a secret that may eventually become public.
Why Asymmetric Credentials Are the Better Architecture
Asymmetric systems use a mathematically related public and private key pair. The private key remains protected within the credential or secure element and is never distributed to readers. The public key can be shared freely without allowing anyone to impersonate the credential holder.
This fundamentally changes the risk model.
Compromising a reader does not reveal a universal credential-creation secret. Compromising one credential does not automatically compromise every other credential. Public keys can be distributed across systems without secret-key ceremonies, proprietary key-sharing modules or a growing collection of devices containing the same sensitive material.
The Public Key Open Credential, or PKOC, specification applies this model to physical and logical access. The credential generates its private key within a secure element on a phone or chip card. The private key remains on that device, while the public key serves as the shareable credential identifier used by compatible systems.
Properly designed symmetric systems using unique, diversified keys and hardened key-management infrastructure can still provide strong security. But globally shared or vendor-wide secrets create unacceptable systemic risk.
For modern, interoperable credential ecosystems, asymmetric designs such as PKOC provide the more defensible architecture: no universal secret to distribute, no master key that unlocks an entire population and a far smaller blast radius when an individual component is compromised.
The lesson is simple: a secret shared with millions of devices is not merely a key. It is a future breach waiting for someone to find it.
References
- HackingPassion.com, “KARR Car Alarm Bluetooth Flaw Exposes 2.2 Million Cars to Silent Theft.” (Hacking Passion)
- Physical Security Interoperability Alliance, “PKOC: Elevating the Experience of Secure Credentials.” (PSIA)
- Gans, Hoepman and Garcia, “A Practical Attack on the MIFARE Classic.” (arXiv)
- Kim et al., “Cryptanalysis of INCrypt32 in HID’s iCLASS Systems.” (IACR Eprint Archive)
- WIRED, “How Hackers Extracted the ‘Keys to the Kingdom’ to Clone HID Keycards.” (wired.com)