STid Architect & SECard Explained: Security, Keys & Credential Options

STid Architect is STid Electronics' modular access-control reader line, and SECard is the desktop kit used to configure it and encode its credentials. An Architect reader operates at 13.56 MHz (ISO/IEC 14443 A and B, plus ISO/IEC 18092) and adds a Bluetooth channel for smartphone credentials, so one reader can serve cards, fobs, and phones.

The key idea that separates STid Architect from a plain proximity reader is that the credential is not a number broadcast in the clear. Architect reads an AES-secured contactless smart card whose identity is protected by mutual authentication and per-card diversified keys, and those keys are generated by the site owner using the STid SECard kit. That makes SECard the heart of the system: it is where a customer defines their private key architecture and writes it to both the readers and the cards.

STid Architect uses the 13.56 MHz high-frequency band and reads an AES-secured contactless smart card across the EV1, EV2, and EV3 credential generations, alongside a Bluetooth channel for STid Mobile ID. STid's Architect Blue (ARCS) flyer lists support for ISO/IEC 14443 types A and B and ISO/IEC 18092, and the wider Architect range can also read legacy 125 kHz proximity, LEGIC, and iCLASS or similar cards by their card serial number (CSN) during a migration.

The security comes from the newer generations. STid describes the current AES-secured smart card as using "public algorithms and an EAL5+ certified crypto processor," with Secure Messaging that "protects against interleaving and replay attacks" and a Proximity Check that gives "protection against relay attacks." That is a fundamentally different model from a 125 kHz card, whose fixed number can be copied with a cheap cloner.

SSCP® (Secure & Smart Communication Protocol) is STid's own encrypted, bidirectional reader-to-controller protocol, and it sits alongside — not instead of — the open OSDP standard. An Architect reader can be configured for Wiegand, Clock & Data, SSCP® v1/v2, or OSDP v1/v2 with Secure Channel, letting an installer keep legacy wiring or move to a fully encrypted link.

The reason this layer matters is that legacy Wiegand wiring is unencrypted and can be tapped to inject card numbers. Both SSCP® and OSDP Secure Channel replace that with an authenticated, AES-encrypted conversation between the reader and the door controller, so the protection that starts at the card is carried all the way back into the building. STid supports both so a site is never locked into a single controller vendor.

With STid Architect, the customer holds the keys. STid markets this as "Create your own security keys — full independence over encryption," and it is the single most important fact about ordering STid credentials. Because the AES keys that bind a card to your readers are generated and stored by you in the SECard kit, STid itself cannot reproduce a working credential for your site, and neither can any card reseller.

STid packages this in tiers. The table below shows how key ownership changes across the Easyline, Expert, and Individual configurations — the move from STid's default keys to your own site-specific keys is what turns an Architect deployment from convenient into genuinely clone-resistant.

An STid Architect badge configured with your own keys cannot be cloned by copying a number the way a 125 kHz proximity card can. The credential is an AES-secured smart card, so its identity is protected by mutual authentication with per-card diversified keys; a copy would also have to reproduce a secret key it never has access to. STid adds Secure Messaging against replay and interleaving, a Proximity Check against relay attacks, and a patented motion sensor that erases the authentication keys from a reader if it is pulled off the wall.

For a mechanism-by-mechanism breakdown of how each of these defences maps to a specific attack, see the companion guide, STid Architect EV3 cards: key ownership and clone resistance. The short version: on STid Architect, clone-resistance depends far more on whether the site enabled its own keys than on the plastic itself.

No genuine "compatible" STid Architect card exists, because a working credential must carry your site's private AES keys, and those are held only in your SECard kit. Security ID Systems does not sell a drop-in STid card; the correct source for more encoded credentials is STid or the integrator that manages your keys. Blank STid stock — such as the STid 8870 2K smart card — can be ordered, but it still has to be encoded with your keys before it will open a door.

Where we can help is the other end of the same system. Many sites running STid Architect still have 125 kHz proximity readers on parking, lifts, or older doors, and some Architect readers are configured to read a card serial number (CSN) as a plain identifier. Those open and UID-based formats we do supply as fully compatible, encoded credentials.