Inside PKOC: The Open Credential Spec Shaping the Future of Access Control

A recently published document from the Physical Security Interoperability Alliance (PSIA) is drawing attention to what many consider a landmark advancement in access control: Public Key Open Credential (PKOC).

Co-authored by Jason Ouellette, chairman of PSIA, and the late Ed Chandler, founder of Security by Design, the “What Is PKOC?” document offers a comprehensive overview of the open specification aimed at improving credentialing through greater security, simplicity and interoperability.

The document describes how PKOC uses public key cryptography to authenticate credentials such as smart cards and mobile devices, following x.509 standards. One of its core advantages, Ouellette explained to SecurityInfoWatch, is that it eliminates the need for shared secrets and proprietary licensing — two of the most common limitations in traditional access control credentials.

Unlike traditional access control credentials that rely on symmetric encryption methods — many of which have known vulnerabilities — PKOC harnesses asymmetric cryptography. Each credential has a unique private/public key pair, eliminating the need for a shared secret.

“This is PK without the ‘I,’ meaning PKOC does not require or utilize a certificate authority,” said Ouellette, who serves as corporate vice president of innovation & technical partnerships for Elatec GmbH. “That keeps the solution very simple while enabling interoperability and vendor-neutral compatibility, while reducing fraud and unauthorized access.”

Simplicity Without Sacrificing Security

First introduced by PSIA in 2021, PKOC has steadily evolved as an open, vendor-neutral alternative to proprietary credentialing systems. At its core, the specification is designed for ease of deployment. There are no facility codes, site codes or complex card numbering systems to manage. Enrollment, however, remains one of the key challenges, particularly in environments migrating from legacy credentials.

“The main challenges of any organization going to PKOC are the enrollment of a PKOC credential and the migration away from legacy credential types,” Ouellette said. He recommends USB PKOC readers or enrollment services, along with multi-technology readers and hybrid credentials, to ease this transition.

According to the “What Is PKOC?” document, the enrollment process can require some creativity, especially for access control systems that were designed around 50-bit formats. For example, wedge readers may need to split 128-bit credentials into multiple fields using tabbed inputs to fit into legacy access control system screens. That complexity is expected to diminish as more systems build native support for larger PKOC keys.

Crucially, as Ouellette emphasizes, PKOC is fully open: there are no licensing fees, royalties or membership requirements. Any manufacturer or integrator can create PKOC-compliant readers and credentials, leveling the competitive playing field and enabling cost reduction for end users.