A method of using a wireless access credential in an access control system including at least a server system, a mobile device, and an access control edge device, the method comprising: encrypting, by the server system and using a symmetric cryptographic key stored by the server system and the access control edge device, a credential blob including the wireless access credential and a first public cryptographic key provided by the mobile device, wherein the first public cryptographic key and a first private cryptographic key are a first asymmetric cryptographic key pair stored by the mobile device; transmitting, by the server system, the encrypted credential blob to the mobile device for storage by the mobile device; establishing a secure wireless communication connection between the mobile device and an access control edge device including generating a shared cryptographic key; encrypting, by the mobile device and using the shared cryptographic key, a credential message including the encrypted credential blob; cryptographically signing, by the mobile device and using the first private cryptographic key, the encrypted credential message; transmitting, by the mobile device, the encrypted and signed credential message to the access control edge device; decrypting, by the access control edge device and using the shared cryptographic key, the encrypted and signed credential message to extract the encrypted credential blob; decrypting, by the access control edge device and using the symmetric cryptographic key, the encrypted credential blob to extract the wireless access credential; and unlocking a lock mechanism of an electronic lock associated with the access control edge device in response to successful authentication of the wireless access credential. encrypting, by the server system and using a symmetric cryptographic key stored by the server system and the access control edge device, a credential blob including the wireless access credential and a first public cryptographic key provided by the mobile device, wherein the first public cryptographic key and a first private cryptographic key are a first asymmetric cryptographic key pair stored by the mobile device; transmitting, by the server system, the encrypted credential blob to the mobile device for storage by the mobile device; establishing a secure wireless communication connection between the mobile device and an access control edge device including generating a shared cryptographic key; encrypting, by the mobile device and using the shared cryptographic key, a credential message including the encrypted credential blob; cryptographically signing, by the mobile device and using the first private cryptographic key, the encrypted credential message; transmitting, by the mobile device, the encrypted and signed credential message to the access control edge device; decrypting, by the access control edge device and using the shared cryptographic key, the encrypted and signed credential message to extract the encrypted credential blob; decrypting, by the access control edge device and using the symmetric cryptographic key, the encrypted credential blob to extract the wireless access credential; and unlocking a lock mechanism of an electronic lock associated with the access control edge device in response to successful authentication of the wireless access credential.