4 ms·

I know that a button on the keyfob would work, but this attack could also be prevented with clock syncing, as the re-transmission of the signal will certainly t

I know that a button on the keyfob would work, but this attack could also be prevented with clock syncing, as the re-transmission of the signal will certainly take time. A simple timed ping (with cryptographicly signed time-stamps to prevent replay) would sort this out.

jimmies 9y ago
Relying on timings for this type of thing is impractical because you'd have to sync the time to the nanoseconds and wireless is notorious for being noisy. It'd make it more expensive too. The most practical one, I think, is to make it NFC-near instead of BLE-near. Or, you know, just use a non-contactless one. Or add a button.
- berbec 9y ago
  Or use something that you put in a tumbler-style mechanism that requires physical contact as well as the RF
mrb 9y ago
The problem of distance-bounding mechanisms is that the technology isn't quite there yet. A microcontroller in a keyfob operates at ~5 MHz. If it takes 1 clock cycle to receive & decode the first bit of the cryptographic challenge as well as to start transmitting the first bit of the response, then the R/F signal has already traveled 60 meters. Most cars parked in a driveway by the owner's house are less than 30 meters away from the keyfob. The limited performance of the low-power microcontroller isn't the only problem. The R/F signal itself is modulated at a low baud rate. If it's modulated at 1 Mbaud then each bit is sent as an R/F symbol that's 300 meters long in the air. In a sense the R/F receiver needs to demodulate "300 meters of R/F analog data" to be able to decode it to a 0 or a 1. If there is a little delay or noise at the beginning of the 300 meters of data because the signal is being relayed (if you can visualize what I mean), then the receiver isn't going to notice. The low-power constraint on the keyfob (as it's powered by a small battery that must last years) prevents manufacturers from developing R/F physical layers and chips that are performant enough for precise distance-bounding.

jimmies 9y ago

Relying on timings for this type of thing is impractical because you'd have to sync the time to the nanoseconds and wireless is notorious for being noisy. It'd make it more expensive too. The most practical one, I think, is to make it NFC-near instead of BLE-near. Or, you know, just use a non-contactless one. Or add a button.

berbec 9y ago
Or use something that you put in a tumbler-style mechanism that requires physical contact as well as the RF

mrb 9y ago

The problem of distance-bounding mechanisms is that the technology isn't quite there yet. A microcontroller in a keyfob operates at ~5 MHz. If it takes 1 clock cycle to receive & decode the first bit of the cryptographic challenge as well as to start transmitting the first bit of the response, then the R/F signal has already traveled 60 meters. Most cars parked in a driveway by the owner's house are less than 30 meters away from the keyfob. The limited performance of the low-power microcontroller isn't the only problem. The R/F signal itself is modulated at a low baud rate. If it's modulated at 1 Mbaud then each bit is sent as an R/F symbol that's 300 meters long in the air. In a sense the R/F receiver needs to demodulate "300 meters of R/F analog data" to be able to decode it to a 0 or a 1. If there is a little delay or noise at the beginning of the 300 meters of data because the signal is being relayed (if you can visualize what I mean), then the receiver isn't going to notice. The low-power constraint on the keyfob (as it's powered by a small battery that must last years) prevents manufacturers from developing R/F physical layers and chips that are performant enough for precise distance-bounding.