Cardax / Gallagher HF Smart Cards: The 13.56 MHz Upgrade Explained

A Cardax / Gallagher HF card is the 13.56 MHz smart-card version of a Gallagher access credential. "HF" means high frequency, distinguishing it from the older 125 kHz "LF" Cardax IV proximity card. Gallagher builds this credential on an AES-secured 13.56 MHz smart card and describes it as offering "secure 128-bit AES encryption" with "an additional layer of security" over the card data.

Crucially, the Cardax / Gallagher HF card encodes the same logical identity as the legacy Cardax IV card — the same region code, facility code, card number, and issue level. That is what lets a site move a cardholder from a 125 kHz proximity card to a 13.56 MHz smart card without renumbering the whole system.

The Gallagher HF smart card and the 125 kHz Cardax IV card are two carriers for one identity scheme. On the 125 kHz Cardax IV card, the identity is stored as a proximity number that the reader picks up in the clear (though obfuscated by Gallagher's cipher). On the 13.56 MHz Gallagher HF card, that same identity lives inside an AES-encrypted, site-keyed application and is only released after mutual authentication.

Because the underlying number is identical, a Gallagher site can bridge the two: a cardholder keeps their card number while the security model underneath is upgraded from a readable proximity value to a 128-bit AES exchange. This is the practical reason a Gallagher HF migration is described as an upgrade rather than a re-numbering project.

Identifying whether you hold a 125 kHz Cardax IV card or a 13.56 MHz Gallagher HF card determines what can and cannot be supplied. The two carriers behave differently and pair with different Gallagher T-Series reader variants.

A Gallagher HF smart card is only as clone-resistant as its key management. On 22 December 2020, Gallagher published a statement responding to a disclosed vulnerability in the default Gallagher smart-card keys, warning that cards left on those default keys "could be cloned or emulated." The same statement drew a sharp line: "Customers who have followed Gallagher's long-standing hardening guide, which recommends the use of site-specific keys, are not affected by this disclosure."

So the honest answer is conditional. A Gallagher HF card on a non-default, site-specific key is clone-resistant because a copy would need a secret AES key it cannot read. A Gallagher HF card still on the factory default keys is not. The difference is a configuration state at your site, which is why the credential is provisioned and keyed through Gallagher and its integrators.

Gallagher's T-Series readers come in a single-technology variant, which reads the 13.56 MHz AES-secured smart card, and a Multi Tech variant, which additionally reads 125 kHz proximity such as Cardax IV. A site running the Multi Tech reader can accept both the legacy 125 kHz card and the new Gallagher HF smart card at the same door.

That dual-read capability is what makes a phased cutover possible: readers are set to accept both carriers, cardholders are re-issued Gallagher HF smart cards over time, and only once everyone has moved does the site retire 125 kHz acceptance. During that window, the 125 kHz Cardax IV layer is exactly the part a third party can legitimately supply as a compatible card.

No third party can supply a working site-keyed Gallagher HF smart card, because the credential is bound to an AES site key held by the customer and Gallagher. Security ID Systems does not offer a compatible AES-secured Gallagher card — those come from Gallagher or your integrator, who also manage your keys.

The Cardax IV 125 kHz proximity layer is different. It is an open low-frequency format, and while a site still runs it on any door during migration, we can encode fully compatible 125 kHz credentials, along with the general HID, Indala, and AWID prox formats a mixed Gallagher site commonly carries.