LEGIC advant ATC Cards Explained: AES, Memory & Security

A LEGIC advant ATC card is a 13.56 MHz smart card built on LEGIC's ATC chip family, the current generation of LEGIC's credential technology. LEGIC advant is standards-based — supporting ISO/IEC 14443-A and ISO/IEC 15693 with an on-card file system — and secured with open, published cryptography rather than a proprietary scheme. The ATC family spans several memory sizes, commonly denoted ATC128, ATC256, ATC1024 and ATC4096.

LEGIC advant is the generation LEGIC promotes for new installations and as the migration target for older LEGIC prime sites. Because it is multi-application, a single ATC card can host several independently keyed applications — access control, time and attendance, payment, transport — each isolated in its own segment.

LEGIC advant uses open-standard cryptography. LEGIC's own Common Criteria statement describes an advant transponder chip supporting 3DES and AES, with "mutual authentication with 112 bit 3DES," "data encryption with 112 bit 3DES or 128/256 bit AES," and "message integrity with secure MAC." That means the card and reader prove identity to each other before data moves, the channel is encrypted, and each message is integrity-protected against tampering.

Advant also applies key diversification — a different key per card — so recovering the keys from one card does not compromise the rest of the system. This is the same class of protection used by other current AES-secured 13.56 MHz smart cards, and it is what makes a LEGIC advant ATC card resistant to the serial-number copying that defeats older proximity credentials.

Yes. LEGIC advant's silicon is certified to Common Criteria EAL4+, with the certificate granted by Germany's Federal Office for Information Security (BSI). LEGIC's published Common Criteria statement documents the certification for its advant transponder chip, which is significant because it is an independent, third-party assurance of the security design rather than a vendor claim.

Independent certification is a meaningful signal on a security credential. It means the chip's cryptographic implementation was evaluated against a recognised standard by an accredited body, so a buyer is not relying solely on LEGIC's marketing. For LEGIC advant ATC cards, EAL4+ is the headline assurance figure to cite.

ATC memory size is chosen by how much a card must carry. A small ATC128 or ATC256 card suits a single access-control application; larger ATC1024 or ATC4096 cards hold more segments for multi-application deployments where door access shares the card with payment, printing, or transport. Each application lives in its own key-protected segment, so applications cannot read one another's data.

Provisioning is controlled by LEGIC's key management. A LEGIC Security Module (SAM), governed by the Master-Token System-Control hierarchy, holds the application keys and is authorised "to initialize and delete segments on a LEGIC advant" card. That keeps the authority to add or remove an application on an ATC card anchored in hardware and in the Master-Token, not in whoever operates an encoder.

The table summarises the LEGIC advant ATC card properties an integrator checks.

A working LEGIC advant ATC card is provisioned under your installation's Master-Token and encoded by a LEGIC Security Module, so an independent supplier cannot produce a keyed, ready-to-use advant credential. Security ID Systems does not offer one; additional ATC cards come from LEGIC or the integrator that holds your Master-Token authority and application keys.

What we supply are the open-format cards used around a LEGIC deployment — serial-number cards for simple readers, and hotel or legacy cards for adjacent doors. Those are the formats below.