Inner Range SIFER Cards & Fobs: The IR56 Format Explained

An Inner Range SIFER card or fob is the credential half of the SIFER system, an AES-secured 13.56 MHz smart credential that Inner Range's SIFER readers authenticate with 128-bit AES. The same credential is issued as a plastic card or a key fob, and both carry the same 56-bit Inner Range identity, known as the IR56 format.

Because a SIFER credential is an encrypted smart card rather than a readable proximity token, its identity is released only after an AES exchange. That is what separates a SIFER card or fob from a 125 kHz proximity credential, whose number can be read and copied. The security level a given SIFER card actually provides, though, depends on its key tier.

IR56 is the 56-bit Inner Range credential identity used by SIFER. It is composed of a 24-bit site code, which identifies the installation, and a 32-bit card number, which identifies the individual holder. The breakdown below shows how the identity is structured.

Two SIFER cards can share the identical IR56 format and still differ completely in security, because the security lives in the key. A SIFER-P card is factory pre-programmed with a shared Inner Range global key and a default site code, so every SIFER-P card in the world uses the same key. A SIFER-U or SIFER-C card is bound to a custom site-specific 128-bit AES key that belongs only to one installation.

This is why a site that has hardened its SIFER system to a custom key will find that its readers "will not be able to read SIFER-P pre-programmed cards, only secured cards using the same custom encryption key." For cards and fobs, the practical lesson is that the tier — not the plastic — determines whether a credential is site-unique and clone-resistant.

A custom-key SIFER card or fob (SIFER-U or SIFER-C) cannot be cloned by a third party, because reproducing it would require a site-specific 128-bit AES key that is never exposed. A shared-key SIFER-P credential uses the common Inner Range global key, so while it is still an encrypted smart card, it does not provide the site-unique protection that a custom key does.

For the highest assurance, SIFER offers a "Gold Card" option that generates a guaranteed-unique key that nobody — including Inner Range — can view. A site that combines custom-key credentials with the Gold Card approach reaches the strongest SIFER configuration, where no external party holds the key needed to reproduce a working card or fob.

Sites usually reach SIFER cards and fobs by migrating from 125 kHz proximity or Wiegand credentials. Because SIFER uses its own encrypted credential and key model, new SIFER cards and fobs must be issued to all users, and the Inner Range Integriti controller must meet the firmware and software minimums for SIFER support.

During the transition, a site commonly keeps its legacy 125 kHz proximity credentials working in parallel until every holder has a SIFER credential. Those legacy proximity formats — Inner Range's own low-frequency prox and the general prox a mixed site carries — are the layer a third party can supply while the SIFER rollout completes.

For the shared-key SIFER-P profile, yes — the IR56 56-bit format is fixed and a compatible SIFER-P card can be supplied for a site still running the factory global key. For custom-key SIFER-U and SIFER-C credentials, no third party can produce a working card or fob, because each is bound to a site-specific key held only by the installation; those come from Inner Range or your integrator.

The always-available option is the legacy 125 kHz proximity layer a site migrates away from, including Inner Range's own low-frequency prox formats. Those open low-frequency formats we encode as fully compatible credentials for use during the SIFER rollout.