To what extent can cryptography help protect against relay attacks (on vehicles)?


A keyless entry system means just that: it allows the entry into the vehicle (by unlocking the doors) without using a key, usually using some sort of radio fob. Many vehicles also pair this fob with an anti-theft (immobilizer) system and require the fob to start the car, but they need not be the same thing.

In systems with radio fobs, cryptography is generally useful to prevent an attacker from (a) guessing all possibilities and (b) listening for messages and then guessing the key used to send them. Some insecure fobs have used 16-bit LFSRs, which fail both of these tests. More secure fobs use AES, which if used with a suitably sized key in a secure way, prevent both of these from being problems.

However, cryptography doesn't prevent relay attacks where the attacker attempts to impersonate the fob to the car and the car to the fob. That's because the problem isn't that the message isn't secure, but that the fob is not close. Usually this is solved by requiring a round-trip message to be within a certain number of milliseconds so that the fob is provably within a certain distance according to the speed of light and the expected performance of the fob. This same technique is used to prevent relay attacks on contactless credit cards as well.

  • Thanks. So now that I understand cryptography cannot prevent relay attacks, is it also the case the poor cryptography is not responsible for relay attacks? Or is poor cryptography indeed somewhat responsible? – CyberCrusader Jan 9 at 22:28
  • No, cryptography isn't responsible. Think of it like a TLS connection: you have two ends which want to communicate, and with a secured message, they can communicate with any number of intermediate hops, which is good. In this case, the two ends are communicating through a long distance with the help of an attacker, which is bad. The cryptography secures the message either way, but in one case, long-distance messages are good, and in one case, long-distance messages are bad. – bk2204 Jan 9 at 22:33
  • So, in the case of the attacker helping, the attaker is using a relay attack? – CyberCrusader Jan 10 at 4:16
  • And why would it be bad? Surely if the message is secure, it doesn't really matter how the message gets there, even if an attacker helps. Or are you refering to the fundamental issue that is an attacker being able to have that ability? – CyberCrusader Jan 10 at 4:28
  • The issue with a relay attack is that the message from the legitimate fob is being proxied over a long distance to access a vehicle without the owner present. – bk2204 Jan 10 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.