A method of using a wireless access credential in an access control system including at least a server system , a mobile device , and an access control edge device , the method comprising: encrypting, by the server system and using a symmetric cryptographic key stored by the server system and the access control edge device , a credential blob including the wireless access credential and a first public cryptographic key provided by the mobile device , wherein the first public cryptographic key and a first private cryptographic key are a first asymmetric cryptographic key pair stored by the mobile device ; transmitting, by the server system , the encrypted credential blob to the mobile device for storage by the mobile device ; establishing a secure wireless communication connection between the mobile device and an access control edge device including generating a shared cryptographic key; encrypting, by the mobile device and using the shared cryptographic key, a credential message including the encrypted credential blob; cryptographically signing, by the mobile device and using the first private cryptographic key, the encrypted credential message; transmitting, by the mobile device , the encrypted and signed credential message to the access control edge device ; decrypting, by the access control edge device and using the shared cryptographic key, the encrypted and signed credential message to extract the encrypted credential blob; decrypting, by the access control edge device and using the symmetric cryptographic key, the encrypted credential blob to extract the wireless access credential ; and unlocking a lock mechanism of an electronic lock associated with the access control edge device in response to successful authentication of the wireless access credential . encrypting, by the server system and using a symmetric cryptographic key stored by the server system and the access control edge device , a credential blob including the wireless access credential and a first public cryptographic key provided by the mobile device , wherein the first public cryptographic key and a first private cryptographic key are a first asymmetric cryptographic key pair stored by the mobile device ; transmitting, by the server system , the encrypted credential blob to the mobile device for storage by the mobile device ; establishing a secure wireless communication connection between the mobile device and an access control edge device including generating a shared cryptographic key; encrypting, by the mobile device and using the shared cryptographic key, a credential message including the encrypted credential blob; cryptographically signing, by the mobile device and using the first private cryptographic key, the encrypted credential message; transmitting, by the mobile device , the encrypted and signed credential message to the access control edge device ; decrypting, by the access control edge device and using the shared cryptographic key, the encrypted and signed credential message to extract the encrypted credential blob; decrypting, by the access control edge device and using the symmetric cryptographic key, the encrypted credential blob to extract the wireless access credential ; and unlocking a lock mechanism of an electronic lock associated with the access control edge device in response to successful authentication of the wireless access credential . <EOS>