A token can replace a sensitive value. The difficult work is defining what the replacement means, who may reverse it and how the system behaves over time.

Long before the secure element became a general platform, SIM and UICC applets provided a small governed environment for keys, authentication and digital signatures.

Moving a live fare system from MIFARE Classic to MIFARE Plus is not a card replacement exercise. It is a controlled transition across credentials, readers, keys and operational states.

A SAM can keep master keys out of reader firmware and perform card protocols locally. The security result still depends on permissions, host integration and lifecycle.

When cryptographic operations must run without an HSM, software can reduce the exposure of key material—but it cannot make a hostile host trustworthy.