Bosch (Keenfinity) Access Cards Explained: Coding, Security & Upgrade

Yes — as of 2025, Bosch's building-technologies access and intrusion business trades as the Keenfinity Group, and boschsecurity.com now redirects to keenfinity-group.com. The products themselves remain Bosch-branded: the AMS management software, the AMC2 access modular controllers, and the LECTUS reader family are all still current under the Keenfinity name.

For anyone maintaining a Bosch access system, the practical takeaway is that support, documentation, and product security advisories now live on the Keenfinity site, but the hardware and card technology are unchanged. This guide uses "Bosch" for the products and "Keenfinity" for the company that now stands behind them.

Bosch recommends replacing 125 kHz proximity with an AES-secured 13.56 MHz smart card. Bosch's data-security whitepaper is blunt that legacy prox "has been compromised," noting that "card-copying devices … make copies" and "gain illicit access," and it states that "upgrading the frequency from 125 kHz to 13.56 MHz allows you to take advantage of the security functions on 13.56 MHz processor cards."

Bosch adds that among modern cards, only a very few credential types remain uncompromised — it names AES-secured 13.56 MHz smart cards and LEGIC Advant among them. In other words, moving to 13.56 MHz is necessary but not sufficient; the card also has to use its cryptographic functions properly, which is where the Bosch Code and key diversification come in.

Bosch's whitepaper attributes a secure smart card to three functions working together, and it is a useful, vendor-neutral way to judge any access credential. The table below lists them and shows how they contrast with a legacy proximity card.

Reading only the card serial number (CSN) is not enough because, as Bosch notes, the CSN "is always stored in a public (unencrypted) card sector" — anyone with a reader can retrieve it, and it can be copied. A system that authenticates on the CSN alone is little better than a proximity card with a longer number.

Bosch's answer is the "Bosch Code": rather than trusting the public serial, a Bosch-coded card stores its credential data in the card's secure, encrypted sector, protected by key diversification (a unique key derived per card), encryption of the reader-to-card conversation, and mutual authentication so the card and reader each prove themselves. Because that secure sector is written with your site's keys, a Bosch-coded card cannot be reproduced by simply copying its serial number.

Yes — Bosch recommends OSDP v2 Secure Channel for the reader-to-controller link in place of legacy Wiegand. Bosch's whitepaper explains that Wiegand wiring is unencrypted and can be tapped, whereas OSDP v2 Secure Channel provides an AES-encrypted, authenticated connection; Bosch also cites AES-256 encryption on the controller-to-server link.

This matters because the strongest card in the world is undermined if the wire behind the reader broadcasts card numbers in the clear. Running Bosch LECTUS readers to an AMC2 controller over OSDP v2 Secure Channel carries the protection that starts on the card all the way into the AMS software, closing the tap-and-replay gap that legacy Wiegand leaves open.

A Bosch-coded AES smart card is written with your site's keys, so additional coded credentials are sourced through Bosch/Keenfinity or your integrator — Security ID Systems does not sell a drop-in Bosch-coded card. If your system is an older Bosch Access Professional or AMC deployment reading legacy formats, the companion guide, Bosch Access Professional & AMC: cards, readers & prox migration, covers the migration path in detail.

What we supply is the legacy and UID layer: the 125 kHz proximity cards and card-serial-number credentials that Bosch multi-technology readers still accept during a migration. Those open formats we encode as fully compatible credentials that read identically on your existing readers.