They’re like a password for the chip, the chip won’t communicate with a device that doesn’t know the password
Two answers for this one:
-
The keys come from HID, the company that manufactures the cards
-
The RFID Hacking community got them by hacking a lot of cards and readers, if you want to know more about this step, look into the iClass “Heart of Darkness” exploit, it’s very neat
If you’re looking for a raw breakdown of the technical side, I’m not the best guy for it, but basically the PM3 passes the “codephrase” to the chip so the chip knows it’s authorized to talk to the PM3
There are papers on the various exploits in some form or another, but unfortunately HID would have you believe these were secure cards, so they don’t publish much data about the cards themselves that would be helpful here in one place