RFID, Mifare and NFC Badges: Fleet, Encoding, Management
Three Badge Families Coexist, Only Mifare DESFire EV2 Has Withstood Since 2008
Deploying a new Mifare Classic fleet in 2025 is a clear-cut GDPR Article 32 violation: crypto1 has been publicly broken since 2008 (Garcia et al., Radboud University, ESORICS 2008) and can be cloned with a smartphone in 30 seconds, which disqualifies this technology as a technical security measure within the meaning of the regulation. The choice of badge technology commits the IT department for 8 to 12 years, the average observed lifespan of an office building fleet. Three families still coexist in France, but only one withstands published attacks: Mifare DESFire EV2/EV3 with 128-bit AES and 28 multi-application sectors (NXP DESFire EV2 specification). Budget 4 to 8 EUR per badge, 350 to 900 EUR per installed reader and 5% buffer stock.
The French office building market uses three technologies whose security levels range from zero encryption to 128-bit AES. The choice determines GDPR Article 32 compliance (technical security measures) and resistance to duplication attacks.
| Technology | Frequency | Encryption | Vulnerability | Unit price |
|---|---|---|---|---|
| EM4100 / HID Prox | 125 kHz | None | Cloning in 5 sec | 1.50 to 3 EUR |
| Mifare Classic | 13.56 MHz | Crypto1 (broken 2008) | Smartphone duplication in 30 sec | 2 to 4 EUR |
| Mifare DESFire EV2 | 13.56 MHz | 128-bit AES | None published | 4 to 6 EUR |
| Mifare DESFire EV3 | 13.56 MHz | 128-bit AES + LRP | None published | 5 to 8 EUR |
Price ranges taken from supplier quotes in 2024. The ISO/IEC 14443 standard governs contactless communication between a theoretical 0 and 10 cm; in practice, the effective read distance on office wall readers is generally between 3 and 5 cm. NFC (ISO/IEC 18092) reuses the Mifare physical layer and allows the smartphone to act as a virtual badge.
Our reading differs from the dominant integrator narrative on one specific point: the industry doxa still presents Mifare Classic as an acceptable low-cost option for non-sensitive zones (parking, lockers). In practice, on the fleets we have renewed since 2006, mixing Classic + DESFire on the same medium systematically creates a flaw, because the master key ends up exposed through the weakest sector. All or nothing: a new fleet is entirely DESFire EV2 at minimum, or it is not Article 32 compliant.
When this analysis does not apply: on a site with fewer than 30 employees, a single controlled door and no multi-application use planned, the ROI of Mifare DESFire EV2 is not justified before 5 to 6 years compared to a high-security mechanical cylinder lock or a single keypad code. The multi-application logic requires at least 50 employees and 2 different badge services to amortise the software infrastructure.
For the IT Department: Encoding a 500-Badge Fleet in 4 Steps Over 12 Weeks, Master Key on the Client Side
The badge project follows a sequencing aligned with the fit-out schedule, with delivery of an operational fleet 3 days before move-in. For the IT department, the critical deliverable is not the badge: it is the AES master key and its documented chain of custody, the central item in the annual CNIL audit and the records of processing activities.
- Audit and technology choice (weeks 1 to 3): inventory of the existing fleet, selection of Mifare DESFire EV2 minimum, sector sizing (4 out of 16 available: access, catering, printing, lockers).
- Pre-cabling (weeks 3 to 6): shielded 8-pair cables, 12V or 24V power supplies, structured cabling routes in raised flooring with 20 to 30% capacity reserved for future additions.
- Diversified AES encoding (weeks 6 to 10): master keys generated per site, never shared across buildings, derived through UID diversification to block copying.
- Acceptance and training (weeks 10 to 12): functional reader tests, 2 to 4 hours of Office Manager training, handover of master keys to the client safe.
For the DPO and the IT department, the quantified GDPR stake: a DESFire EV2 fleet with the master key on the client side and logs purged at 90 days costs 4 to 6 EUR per badge plus 350 to 900 EUR per reader, i.e. 35,000 to 80,000 EUR for a site of 500 employees. A clear-cut Article 32 non-compliance (Mifare Classic, logs retained beyond, key held by the integrator) exposes the organisation to 4% of global turnover under GDPR Article 83: the compliance ROI is mechanically positive from the very first audit.
On projects of 120 to 1800 employees, the average lead time for encoding and initial distribution is around one week, with buffer stock planned from day one. Beyond 2500 employees on a single site, or in the case of migration from a Mifare Classic fleet kept in service during the switchover, the schedule extends to 18 to 24 weeks with a transitional dual-encoding phase. Below 80 employees, dedicated pre-cabling is not justified: the system integrates into the existing structured cabling and the project drops to 4 to 6 weeks.
Multi-Application Reduces the Number of Media Carried and Simplifies Administration
The Mifare DESFire EV2 badge holds up to 28 applications per medium (public NXP DESFire EV2 specification). Pooling media allows a single badge to replace several older ones (access, staff restaurant, copier, parking), significantly reducing the number of media carried by each employee.
At a 4200-employee Paris headquarters we supported in 2022, pooling access + catering + printing generated 18,000 EUR in annual management savings (orders, distribution, after-sales) measured over the 24 months following delivery. This result is specific to that context and cannot be mechanically extrapolated.
Revocation is immediate, within 30 seconds via the central software, a point regularly cited by IT departments during annual GDPR compliance audits. Adoption of the NFC mobile badge progresses noticeably over 24 months when the option is offered, with stronger adoption among employees under 35 (iOS supported since version 14 released in 2020, Android natively since 2015).
The loss rate observed on our projects is generally between 4 and 7% per year, which justifies planning a buffer stock of at least 5%. Above 8%, the audit systematically reveals a failure in internal communication or an overly lax sanction policy.
When multi-application is not justified: on a site without an internal staff restaurant, without badge copiers and without managed parking, pooling drops to a single application (access) and the DESFire EV2 versus EV1 investment generates no measurable return. The savings calculation requires at least 3 active applications and 1500 employees: below that, the multi-application ROI slips beyond 4 years.
Three IT Pitfalls: New Mifare Classic, Master Key with the Integrator, Logs Beyond 3 Months
Across the fleet audits carried out since 2006, three defects recur in the majority of files non-compliant with GDPR Article 32.
- New Mifare Classic fleet: crypto1 broken since 2008, smartphone duplication in 30 seconds via NFC Tools or MIFARE Classic Tool. The unit cost gap between Mifare Classic and DESFire EV2 remains marginal relative to the overall budget of a reader fleet, and does not constitute an acceptable economic argument for keeping a compromised technology.
2.
