Executive Summary
The Physical Security Interoperability Alliance (PSIA) has released version 2.0.1 of its Public Key Open Credential (PKOC) specification. The update incorporates implementation experience and extensive application, reader and card testing while maintaining backward compatibility with existing PKOC implementations.
PKOC is an open, royalty-free specification for secure, interoperable credentials based on public-key cryptography. Because the credential proves possession of a private key rather than presenting a shared secret, PKOC eliminates the need to store credential secrets in readers or control panels — reducing the risks associated with traditional credential architectures and giving manufacturers and end users greater flexibility in how they source and deploy credentials.
What's New in PKOC 2.0.1
PKOC 2.0.1 introduces:
- A new information command that allows a reader to determine a credential's supported PKOC version, profile and message-size capability before beginning a transaction
- Clarified profile detection and version handling, giving developers predictable behavior across mixed-version deployments
- Defined handling for credentials that do not support extended Application Protocol Data Units (APDUs), so readers can select a compatible transaction path rather than encountering failures in the field
- Improved terminology, formatting and implementation guidance throughout the document
"PKOC 2.0.1 reflects what we have learned from implementing and testing the specification in working applications. The testing confirmed that the updated specification functions properly while remaining compatible with existing PKOC cards and readers. That is important for manufacturers and end users that want to adopt stronger credential security without disrupting current implementations."
Testing & Validation
The specification was reviewed and tested by members of the PSIA PKOC Working Group using PKOC-enabled applications, physical credentials and readers from 4 member companies. This practical validation was an important part of ensuring that the changes addressed real implementation requirements while preserving interoperability.
"One of the primary objectives for PKOC v 2.0.1 was to simplify the migration from legacy systems to PKOC. This release introduces PKOC Validated mode which provides optional functionality that enables Enterprises to include legacy identifiers together with the core PKOC Credential."
The release represents another step in the maturation of PKOC as an open credential framework for physical and logical access control applications, supporting both smart card and mobile credential form factors.
"PKOC was developed to give the security industry an open and interoperable alternative to proprietary credential technologies. Version 2.0.1 strengthens the technical foundation of the specification and makes it easier for manufacturers, integrators and end users to evaluate and deploy PKOC-based solutions."
Specification Availability
The PKOC 2.0.1 specification is publicly available from the PSIA. The Physical Security Interoperability Alliance is a global consortium of physical-security manufacturers, integrators, consultants and end users that develops open specifications promoting interoperability among security systems and devices. PSIA specifications are developed collaboratively by industry participants and are available for use by the security community.
View PKOC Specification