0

The security industry typically uses rolling code algorithms to authenticate sender & receivers in keyless entry systems, which is called RKE (ex: KeeLoq).

In key-less smart key car system,

The transmitter periodically (at interval of 1-2 seconds) sends a low power RF signal. If a receiver is around it will check the rolling code sequence and match the code to authenticate (confirm this is how it works ?)

However, since the sender is periodically outputting a signal, can't the key easily go out of the sequence for rolling code sequence, how does it manage this part ?

Or does it use two-way communication to synchronize and increment the sequence counter?

Also, what does the exact signal look like that key sends to receiver, is it sequence number and some X bit code?

If I apply a range extender to the sender & receiver so that I can crack the key and get into the car without being key near to car,

Does the algorithm takes care of this scenario ? And if yes, how?

  • Hi Jigar - as this question currently stands, it is unclear what you are asking. – Rory Alsop Sep 15 '14 at 6:45
  • @Rory what part is unclear? – Jigar Joshi Sep 15 '14 at 14:59
  • The votes on this were for unclear, and for too broad. If your second last paragraph is your question then it us off topic. If your final paragraph, then it may be on topic. I could not figure out what you meant. – Rory Alsop Sep 15 '14 at 15:09
  • I don't think it is unclear question, see the attempt crypto made to answer from this question – Jigar Joshi Sep 15 '14 at 16:14
  • Jigar, 5 of us did vote because of the lack of clarity/scope of the question. If you can improve the question accordingly, folks may vote to reopen. – Rory Alsop Sep 15 '14 at 16:19
3

First, start by reading the answer to this question-> https://crypto.stackexchange.com/questions/18311/how-does-a-rolling-code-work This answers your first two questions. Also, the transmitter does not periodically send an RF signal, as what starts the authentication conversation is a key fob, not the car. The only way to break out of the sequence would be to repeatedly press your fob while out of range of the car.

The sequence is generated from a psuedo-random number generator (there is no true random number generator) with a seed. Each receiver and transmitter have different seeds, so one transmitter will no work for another, and vice versa. Also, even if two receivers and transmitters have the same seed, they are most likely at different spots at the sequence, and thus (most likely) wouldn't be able to work with each other. However, there are a multitude of attacks still possible, as shown here -> http://alrabady.com/images/Analysis_Keyless-entry.pdf (page 3)

This is what the rf signal looks like: http://www.ni.com/white-paper/13192/en/ The numbers are sent, and also a little bit of other information.

The algorithm is not made to stop an attacker (A) from grabbing the numbers, but is made so that if and when A does grab the numbers, A can't do anything with them. Proximity doesn't matter unless A is trying to do a jamming attack, as outlined by http://hackaday.com/2014/03/17/hacking-rolling-code-keyfobs/

  • for the first question, key fob does transmit signal periodically (I am not talking about the fob where you need to press the button to emit the signal, you just take the key close to car and it opens itself) – Jigar Joshi Sep 9 '14 at 21:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.