WaveLynx 50H4 & 50D4 LEAF Credentials Explained

WaveLynx 50H4 and 50D4 are credential designations in WaveLynx Technologies' LEAF smart-credential line, associated with its Ethos and Wave reader ecosystem. Both are AES-secured 13.56 MHz smart cards that carry the LEAF data structure, so they behave as encrypted LEAF credentials rather than readable proximity cards.

Because they are LEAF credentials, a WaveLynx 50H4 or 50D4 card is designed to work across LEAF-compatible readers, not only WaveLynx hardware, while still being provisioned and keyed through the WaveLynx and LEAF ecosystem. The model numbers identify the WaveLynx credential; the security comes from the LEAF encryption underneath.

Inside a WaveLynx 50H4 or 50D4 credential is an AES-secured 13.56 MHz smart card running the LEAF data structure. In its base tier, LEAF uses 128-bit AES on a smart card whose current generation is certified to Common Criteria EAL5+, releasing its identity only after an encrypted mutual-authentication exchange.

LEAF describes "encrypted authentication with guaranteed unique badge IDs," with key diversification handled through its enterprise key-management services. For sites needing higher assurance, WaveLynx also offers the LEAF Verified tier, which replaces symmetric AES with ECC P-256 public-key cryptography at Common Criteria EAL6+ — a different, higher-certified secure element read by APEX readers.

WaveLynx 50H4 and 50D4 credentials are frequently supplied as combo cards that pair the AES-secured LEAF smart card with a 125 kHz proximity sidecar, commonly an HID Prox format. The sidecar exists so a building that still runs 125 kHz readers can keep unlocking doors while it rolls out LEAF credentials and upgrades readers.

WaveLynx Ethos and APEX readers are multi-technology and read past and present formats simultaneously, so one combo card works on both old proximity readers and new WaveLynx readers during the transition. Once every holder carries the LEAF credential and readers are upgraded, the 125 kHz sidecar can be retired.

A WaveLynx combo card layers a secure LEAF credential with a migration-only proximity layer. The breakdown below shows what each layer provides and which part a third party can supply.

The LEAF smart-credential layer of a WaveLynx 50H4 or 50D4 card cannot be cloned by copying a serial number, because it authenticates with 128-bit AES on an EAL5+ smart card and only releases its identity after that exchange. If the site uses LEAF Verified, the public-key ECC P-256 model at EAL6+ removes shared symmetric secrets entirely.

The copyable element is only the optional 125 kHz proximity sidecar on a combo card, which presents a readable number like any low-frequency proximity credential. That layer is intended as a temporary migration aid, and a hardened WaveLynx deployment runs on the LEAF credential alone.

Not for the LEAF credential itself. A WaveLynx 50H4 or 50D4 LEAF card is an encrypted, keyed credential provisioned within the WaveLynx and LEAF ecosystem, so no third party can produce a working compatible version, and Security ID Systems does not offer one. Additional LEAF credentials come from WaveLynx or your integrator.

The 125 kHz proximity sidecar is different. Where a WaveLynx site still runs that layer during migration, we can encode fully compatible 125 kHz credentials — the HID Prox sidecar format and the general Indala and AWID prox formats a mixed site carries.