Wireless access credential system

A method of using a wireless access credential in an access control system including at least a server system, a mobile device, and an access control edge device, the method comprising:

• encrypting, by the server system and using a symmetric cryptographic key stored by the server system and the access control edge device, a credential blob including the wireless access credential and a first public cryptographic key provided by the mobile device, wherein the first public cryptographic key and a first private cryptographic key are a first asymmetric cryptographic key pair stored by the mobile device;
• transmitting, by the server system, the encrypted credential blob to the mobile device for storage by the mobile device;
• establishing a secure wireless communication connection between the mobile device and the access control edge device including generating a shared cryptographic key;
• encrypting, by the mobile device and using the shared cryptographic key, a credential message including the encrypted credential blob;
• cryptographically signing, by the mobile device and using the first private cryptographic key, the encrypted credential message;
• transmitting, by the mobile device, the encrypted and signed credential message to the access control edge device;
• decrypting, by the access control edge device and using the shared cryptographic key, the encrypted and signed credential message to extract the encrypted credential blob;
• decrypting, by the access control edge device and using the symmetric cryptographic key, the encrypted credential blob to extract the wireless access credential;
• and
• unlocking a lock mechanism of an electronic lock associated with the access control edge device in response to successful authentication of the wireless access credential.