Gallagher / Cardax IV 125 kHz Proximity Cards Explained

A Gallagher / Cardax IV card is the low-frequency, 125 kHz proximity credential from Gallagher's Cardax heritage. Unlike the 13.56 MHz Gallagher smart card, a 125 kHz Cardax IV card does not run a live cryptographic exchange with the reader. Instead it presents a stored identity number that the reader receives when the card enters the field.

That identity is a compact tuple: a 4-bit region code (A through P), a 16-bit facility code, a 24-bit card number, and a 4-bit issue level. Gallagher scrambles the on-card data with its own cipher so it is not a plainly printed number, but the credential is still a low-frequency proximity card rather than an AES-secured smart card.

The "16-bit facility code" is the site-identifying field inside a Gallagher / Cardax IV credential. A facility code (sometimes called a site code) groups all cards belonging to one installation, while the 24-bit card number distinguishes individual holders within it. On the Gallagher format, the facility code is 16 bits wide, giving a large range of possible site values, and the 4-bit issue level tracks re-issues of the same card number.

Understanding these fields matters because to encode a matching Gallagher / Cardax IV card, all four values — region, facility code, card number, and issue level — have to be reproduced correctly and then passed through the Gallagher cipher. Get the facility code wrong and the reader treats the card as belonging to another site.

A Gallagher / Cardax IV credential is encoded onto a programmable 125 kHz chip such as a T5577 or EM4305, with the Gallagher identity tuple written in the layout the reader expects and obfuscated by the Gallagher cipher. The anatomy below shows what each field contributes.

Because a 125 kHz Cardax IV card presents a stored number rather than performing a cryptographic challenge, it belongs to the same low-frequency proximity generation that the industry treats as copyable once the encoding is understood. Gallagher itself positions the 13.56 MHz AES-secured smart card as "more secure than 125kHz," which is the reason it steers sites off the proximity layer.

This is exactly why the 125 kHz Cardax IV format is the layer a site migrates away from — and, conversely, why it is a format that can legitimately be supplied as a compatible credential. Reproducing an open low-frequency proximity format is a very different matter from reproducing a site-keyed AES smart card, which cannot be cloned without a secret key.

Gallagher's own guidance is that its AES-secured 13.56 MHz smart card "represents the highest security available in access card technology currently" and is "more secure than 125kHz." A modern Gallagher smart card stores a site-specific application protected by 128-bit AES, so its identity is never broadcast in the clear the way a 125 kHz proximity number effectively is.

The migration path is therefore 125 kHz Cardax IV proximity, then AES-secured Gallagher smart card on a non-default site key. Gallagher T-Series Multi Tech readers can read both bands during the transition, so a site can accept legacy 125 kHz cards and new smart cards at the same door until every holder has moved.

Yes — the 125 kHz Cardax IV proximity layer is an open low-frequency format, so a matching credential can be encoded with your site's region, facility code, card number, and issue level and read by your existing Gallagher readers. This is different from the AES-secured 13.56 MHz Gallagher smart card, which is site-keyed and can only come from Gallagher or your integrator.

If your Gallagher site is still on, or partly on, 125 kHz proximity, that is the layer we can supply as compatible cards, together with the general HID, Indala, and AWID prox formats a mixed site often runs. Once you move fully to site-keyed AES smart cards, additional secure credentials should be sourced through Gallagher.