RFID Smart Card Manufacturer

What a secure smart-card manufacturer actually ships

'Smart card manufacturer' covers everyone from a print shop laminating stock inlays to a factory that owns the cryptography — and on a security credential that gap is the whole risk. Proud Tek selects the secure IC, structures the application and keys, personalizes on air-gapped stations and read-verifies every card before it ships with its certifications attached. Most programs are migrations, so start with the two decisions that matter — the MIFARE DESFire EV3 card for new deployments, or the MIFARE Plus SE card when the reader estate has to keep working. The numbers below are the ones a security review checks first.

• 2008Direct factory since
• AES-128Card encryption standard
• EAL5+DESFire EV3 / Plus EV2 IC
• 100%Cards functionally verified

• Secure IC selection — we map your threat model, reader estate and offline-operation needs to a chip: MIFARE DESFire EV3 or MIFARE Plus EV2 for new AES-128 programs, MIFARE Plus EV1 for reader-preserving migration, Java Card where a dual-interface applet platform is required.
• Diversified key management — every card carries unique derived keys via NXP AN10922 diversification, not a single shared secret, so a cloned or lost card never exposes the population behind it.
• Secure personalization on the line — DESFire application directories, file structures and access conditions written to your script, keys injected on air-gapped stations, and the card locked before it leaves.
• Dual-interface construction — a single chip module bonded to both an ISO/IEC 7816 contact pad and an ISO/IEC 14443 contactless antenna, for programs that need contact-level assurance and tap convenience on one card.
• 100% functional verification — every personalized card is tested for contactless response, the authentication handshake and memory operations, with the results documented in the shipped test report.

The secure smart-card platform menu

This table is the fast way to see which secure platform fits your program. Every contactless option runs to ISO/IEC 14443 at 13.56 MHz; the dual-interface option adds an ISO/IEC 7816 contact interface; and the AES-128 and Common Criteria grades are the chip IC's own certifications, verifiable on the vendor datasheet rather than our word. Chip names are the parts we stock and allocate directly — browse the live MIFARE DESFire EV3 and NTAG 424 DNA cards, or read the DESFire EV1 vs EV2 vs EV3 breakdown.

• MIFARE DESFire EV3 — hardware AES-128 with a transaction MAC for offline verification and a proximity check against relay attacks; a card holds as many applications as its 2 KB to 32 KB memory allows, up to 14 keys per application. Common Criteria EAL5+ at the IC level, the grade demanded of banking and e-passport chips.
• MIFARE Plus EV2 — AES-128 in a MIFARE Classic-compatible layout with security-level switching from SL1 to SL3 and Common Criteria EAL5+; the upgrade when you want full AES today without re-issuing the reader fleet at once.
• MIFARE Plus EV1 — AES-128 in a MIFARE Classic-compatible layout: existing readers keep working at SL1 while cards run AES at SL3, the cost-effective reader-preserving step off MIFARE Classic.
• Java Card (GlobalPlatform) — a multi-application secure-element platform running custom applets for government ID, healthcare, transport and PKI authentication, and the usual home for a true dual-interface contact-plus-contactless card.
• NTAG 424 DNA — AES-128 with SUN (Secure Unique NFC) messaging that generates a fresh cryptogram on every tap, for smartphone-verified brand authentication and tamper-evident credentials (NFC Forum Type 4).
• MIFARE Classic — its CRYPTO-1 cipher has been publicly broken since 2008 and clones on commodity tools; we still build it for low-risk legacy programs, but never specify it for a credential guarding value — start at MIFARE Plus SE or DESFire.

Where a card printer stops — and where a secure manufacturer starts

A secure card program goes wrong in the gap between the datasheet and the card that ships — the blank card anyone can rewrite with a USB reader, the single shared master key, the 'AES-ready' inlay that was never actually keyed. A print shop laminates; a secure manufacturer owns the cryptography, the key handling and the read-test. When the credential controls a door or a fare, that difference decides whether it can be cloned at the doorstep — the same discipline behind our RFID access control and NFC brand authentication work.

Secure issuance and key handling, step by step

The difference between a card vendor and a card manufacturer shows up in personalization. We run key management and encoding as a documented production discipline: customer key material moves over encrypted channels, loads onto air-gapped stations, and is deleted after production per your retention instructions — with escrow of master keys only on explicit customer instruction. Every personalized card is functionally verified before it ships, and we supply sample cards for reader-compatibility testing before any volume order. Prefer to start with parts in hand? Request a sample pack or read how our card encoding service fits the wider program.

• AN10922Key diversification
• Air-gappedKey-loading stations
• 100%Auth-handshake tested
• Dual-IFContact + contactless

1. 1. Key exchange

   Your key hierarchy and personalization scripts transfer over encrypted channels under NDA — never by email, never in the clear.

2. 2. Scheme lock

   Application structure, file access rights and the AN10922 diversification method are locked on the production traveler before any card is written.

3. 3. Personalization run

   Diversified keys are injected and your data written on air-gapped encoding stations in a controlled environment — key material never touches a networked system.

4. 4. Verification

   Every card gets a 100% functional test, including the authentication handshake and memory operations, with results recorded against the encoding lot.

5. 5. Disposal & records

   Key material is deleted per your retention instructions; encoding logs and QC records are retained seven years for traceability and audit.

Proof your security team can verify

Trust on a secure-card order is not a feeling; it is a stack of documents your supplier-qualification and security teams can check without us in the room. Everything below is verifiable before you commit — the certifications page lists each standard and how to confirm it with the registrar, the factory page documents the plant, and the chip vendor publishes the Common Criteria certificates for the silicon itself.

• ✓ISO 9001:2015 quality system — certificate number and issuing registrar provided on request; production records retained seven years and retrievable by SKU or encoding lot.
• ✓Chip-level Common Criteria certificates: MIFARE DESFire EV3 and MIFARE Plus EV2 are EAL5+ at the IC level, verifiable on the NXP datasheet and distinct from our own factory certification.
• ✓Standards conformance: ISO/IEC 7810 card format, ISO/IEC 14443 contactless interface and ISO/IEC 7816 contact interface for dual-interface cards.
• ✓Documented key handling: encrypted key transfer under NDA, air-gapped injection and deletion after production per your retention instructions, with an auditable production traveler per lot.
• ✓Per-shipment documentation pack: commercial invoice and packing list by chip family and encoding lot, Certificate of Origin, radio-compliance conformity (FCC / CE as applicable) and RoHS / REACH material declarations.
• ✓Audit access: buyer engineering and security audits by appointment across two Shenzhen sites, with third-party (TÜV, SGS, Intertek, Bureau Veritas) inspection accommodated when a program requires it.

FAQ