1

Part of a wireless door opener, the receiver Doorhan DHRE-2 works, according to description, with the rolling code. It looks like the receiver can register a new keyfob by listening to its normal opening code:

2) To record the new code hold down for 3 sec the key «SW1» on the recipient card, to make settings of the electric operator connected to the output CH1 and the key «SW2» - to make settings of the electric operator connected to the output CH2, at that the indicator LED1 will light. After that press the necessary key on the remote control unit for 2-3 sec. Attention! after the operation is completed only one key can be stored in the memory of the recipient.

It is not necessary to, for example, hold both buttons at the same time to transmit the secret.

This doesn't make sense to me. The receiver is supposed to be able to calculate next codes from last received code and some pre-shared secret, which is also stored on the keyfob. Does it learn the secret by listening to the normal open code, which is transmitted while you hold the open button for 3 seconds? Then why can't a thief do that?

2
  • Does opening the door normally require holding down the key button "for 2-3 sec"? If not, it's possible that the long press (combined with the earlier steps) makes the keyfob run some specific key exchange protocol instead of the normal authentication protocol. May 2, 2017 at 20:57
  • @IlmariKaronen those types of openers are 1-way communication only, the remote has no receiver May 3, 2017 at 0:13

1 Answer 1

2

Doorhan uses KeeLoq cipher. There's a somewhat informative Non-doorhan decoder description. From it we can learn that at least 3 learning strategies exist:

  • Simple Learning: fixed crypt-key
  • Normal Learning: crypt-key=f(manufacturer-key,serial). Serial sent in clear text in every opening signal. Our case.
  • Secure Learn: crypt-key=f(manufacturer-key,secret-keyfob-seed). Seed only sent by holding special combination of buttons.

The pdf also says:

Manufacturer’s code – A unique and secret 64- bit number used to generate unique encoder crypt keys.

That's a bit misleading. It should be the same among the receivers of the same model so any receiver could learn any compatible keyfob. The crypt-key is unique though.

There are 2 types of inauthentic Doorhan keyfobs:

  • With crypt key flashed by manufacturer. They work just like branded and cannot clone existing transmitters.
  • With manufacturer key. They do not requre learning and can clone existing transmitters (poorly, because most of the time they send a code which was already used). In fact, I saw versatile HR Matic transmitters that do this. Not sure whether they're compatible with Doorhan.

The latter can be used to steal our code and open a door once or twice, but it's not suited for usage with comfort.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.