I wanted to clone my garage door remote to learn more about IoT security in particular so I read a lot about rolling codes, and the more I read the more I am convinced there is no way to actually clone any rolling/hopping code remote even with its master key (seed value or encrypting key) - there are many algorithms out there to derive the next values for a given synchronisation counter and seed value/encrypting key.

And yet! The so-called "universal remote" manage to clone rolling-code remotes when fed the master key in addition to the button signal... How is that possible? Do they use a very common encrypting technique and just assume that the majority of remotes out there use the same algorithm (I stumbled upon the HCS301 during my research, maybe Keeloq is the most widespread?)?

  • 1
    If the same master key is installed into a cloner device then it will generate same rolling codes as the original device generated in the past. To synchronise with the original remote, cloner device has to be pressed as many times as the original remote was pressed. Once they are synced they have same counter and master key. This is not exactly unauthorised cloning if the master key is known. – defalt Oct 13 at 10:09
  • Thank you for your comment. This much I know, in the case of the cloning device and the target using the same rolling code algorithm (although it was particularly well put in this particular case). Does that mean that all rolling codes devices out there all use the same algorithm? Is it Keeloq? – Mister Mystère Oct 13 at 11:23
  • Most of the key fobs use proprietary algorithms. Some of them are broken. Radio Hacking: Cars, Hardware, and more! - Samy Kamkar - AppSec California 2016 – defalt Oct 14 at 5:48

Generating rolling code is as simple as passing a secret key (sk) and initialising it with an incremental value of counter.

HMAC-SHA256(sk, counter)

Most of the key fobs use proprietary algorithms to generate rolling codes. You can't create a universal remote even if you know which algorithm manufacturers are using. The seed value is unique per key fob. To generate same rolling code as the targeted key fob, you need to know this seed value or a secret key depends on the implementation.

The easier way is instead of figuring out the secret value, clone the rolling code and replay.

Jam+Listen(1), Jam+Listen(2), Replay (1)

2nd rolling code is still unused and can be replayed later. This is called rolljam attack. Hacking a Car’s Key Fob with a Rolljam Attack

This attack works on any key fob which doesn't authenticate the device. A generic remote exploiting this attack can be built using software defined radio. You don't even need to know the underlying implementation.

The so-called "universal remote" manage to clone rolling-code remotes when fed the master key

It is still not universal. The master key is specific to the manufacturer and its car model. You can derive the secret key for key fob using this master key but you also need to implement the same algorithm specific to the manufacturer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.