3 ms·

The obvious choice is to sort of skip the crypto entirely. The key fob can hold more than enough 128-bit random numbers to last the life of the car. Think about

by tropo 8y ago

The obvious choice is to sort of skip the crypto entirely. The key fob can hold more than enough 128-bit random numbers to last the life of the car. Think about how much we can put on a little USB device these days. Cross off codes as they are used. This only requires a 1-way signal and a transmit button. If the car can just ask for a code, without a button being pressed, then you have the problem of a foe tunneling the keyfob signal over a long-distance repeater link. Dealing with that requires timing measurements to measure the distance that the signal has traveled.

FullyFunctional 8y ago
Exactly (the last part). There's a fundamental weakness here. Fixing the obvious weakness in the single sided authentication and weak crypto isn't enough to fundamentally solve it. Not sure there's _any_ way to fully make this secure. AFAIK, Model 3 doesn't have this feature & vulnerability.
- tropo 8y ago
  Proposal for expensive cars that don't require a button press: The key fob and car contain identical pre-shared random data. (could be gigabytes) Each transaction uses 4 tokens, 2 going in each direction, with each token being 128 bits. Upon a button press, the key fob selects and destroys the next 1-time-use token it contains. It begins to transmit. First the key fob sends a token. The car must respond with the correct token, which is checked by the key fob. Failure causes radio silence. After a few padding bits to allow for that checking, the car sends another token. The key fob XORs this one with the key fob's second token, which is then transmitted. The car takes note of the latency. Each 100 ns delay (a single bit at 10 megabit/second) is worth about 30 meters at the speed of light. The car can use this to exclude key fobs that are excessively distant. Now consider the repeater attack. The key fob is somehow mistakenly activated. The attacker forwards the signal over a microwave relay to the car, and does likewise for the signal going back to the key fob. Responses arrive late, causing rejection. You don't much need crypto here. It's just XOR with a 1-time pad. Cheaper cars should just to that alone, with 1-way transmission. Expensive cars should do 2-way and measure the timing, but they don't need fancier crypto.
  - walrus01 8y ago
    This is not a bad idea but I can think of two problems in real world execution: a) Car companies won't want to hand out fobs that have any sort of writable memory, takes battery, and risks write memory wearout. Never seen a fob or smartcard that has memory which is written with every individual transaction. Having the fob do a computation on every transaction means it will need a lot more battery (in Wh per year) compared to a regular remote-unlock key fob for an ordinary passenger car. b) High precision RF travel/distance timing, onboard computer system in the car capable of reliably determining to within 100ns timing interval, taking into account randomness in the real world environment such as reflections from nearby low-e class windows, metal structures, and such, may not be cheap or easy to implement.
    - burfog 8y ago
      I think the battery/memory/computation issues work out fine. Remember, the normal alternative is heavy-duty crypto like AES or a public-private key pair. This is just XOR. Write memory wearout is not an issue. You can do this with write-once memory, so you don't even need flash. Manufacture the device with FF bytes, load keys into it by clearing bits, and then dispose of keys by clearing the rest of the bits. The same could apply to the car, or that could be different. Billions of keys could fit on a key fob. Wearing out the car door hinges will happen long before wearing out the key fob storage. Timing... well I don't know, but common ethernet chips have registers that tell the OS how long the cable is. Cars also ship with radar that has much tighter time measurement requirements.
    - Slartie 8y ago
      > Never seen a fob or smartcard that has memory which is written with every individual transaction. Actually every SIM card does this. At least when used by a phone to join a mobile network, a SIM writes some timestamp or counter to persistent internal memory. This caused a funny case of SIM cards with very limited lifetime for a German provider (I think it was Congstar), who had a problem in its network that caused frequent authentications of handsets, thereby having them chew through the write cycles of their SIM cards way faster than projected for normal use. The cards became "dead" afterwards. If I remember correctly, all chip enabled payment cards also have a transaction counter that is updated on every successful transaction.
zamalek 8y ago
There is no reason why FIDO U2F wouldn't work here. Encryption was likely invented to guarantee vendor lock-in - you wouldn't want anyone buying a relatively cheap fob instead of your premium key. Don't invent crypto.

by tropo 8y ago

FullyFunctional 8y ago

Exactly (the last part). There's a fundamental weakness here. Fixing the obvious weakness in the single sided authentication and weak crypto isn't enough to fundamentally solve it. Not sure there's _any_ way to fully make this secure. AFAIK, Model 3 doesn't have this feature & vulnerability.

tropo 8y ago
Proposal for expensive cars that don't require a button press: The key fob and car contain identical pre-shared random data. (could be gigabytes) Each transaction uses 4 tokens, 2 going in each direction, with each token being 128 bits. Upon a button press, the key fob selects and destroys the next 1-time-use token it contains. It begins to transmit. First the key fob sends a token. The car must respond with the correct token, which is checked by the key fob. Failure causes radio silence. After a few padding bits to allow for that checking, the car sends another token. The key fob XORs this one with the key fob's second token, which is then transmitted. The car takes note of the latency. Each 100 ns delay (a single bit at 10 megabit/second) is worth about 30 meters at the speed of light. The car can use this to exclude key fobs that are excessively distant. Now consider the repeater attack. The key fob is somehow mistakenly activated. The attacker forwards the signal over a microwave relay to the car, and does likewise for the signal going back to the key fob. Responses arrive late, causing rejection. You don't much need crypto here. It's just XOR with a 1-time pad. Cheaper cars should just to that alone, with 1-way transmission. Expensive cars should do 2-way and measure the timing, but they don't need fancier crypto.
- walrus01 8y ago
  This is not a bad idea but I can think of two problems in real world execution: a) Car companies won't want to hand out fobs that have any sort of writable memory, takes battery, and risks write memory wearout. Never seen a fob or smartcard that has memory which is written with every individual transaction. Having the fob do a computation on every transaction means it will need a lot more battery (in Wh per year) compared to a regular remote-unlock key fob for an ordinary passenger car. b) High precision RF travel/distance timing, onboard computer system in the car capable of reliably determining to within 100ns timing interval, taking into account randomness in the real world environment such as reflections from nearby low-e class windows, metal structures, and such, may not be cheap or easy to implement.
  - burfog 8y ago
    I think the battery/memory/computation issues work out fine. Remember, the normal alternative is heavy-duty crypto like AES or a public-private key pair. This is just XOR. Write memory wearout is not an issue. You can do this with write-once memory, so you don't even need flash. Manufacture the device with FF bytes, load keys into it by clearing bits, and then dispose of keys by clearing the rest of the bits. The same could apply to the car, or that could be different. Billions of keys could fit on a key fob. Wearing out the car door hinges will happen long before wearing out the key fob storage. Timing... well I don't know, but common ethernet chips have registers that tell the OS how long the cable is. Cars also ship with radar that has much tighter time measurement requirements.
  - Slartie 8y ago
    > Never seen a fob or smartcard that has memory which is written with every individual transaction. Actually every SIM card does this. At least when used by a phone to join a mobile network, a SIM writes some timestamp or counter to persistent internal memory. This caused a funny case of SIM cards with very limited lifetime for a German provider (I think it was Congstar), who had a problem in its network that caused frequent authentications of handsets, thereby having them chew through the write cycles of their SIM cards way faster than projected for normal use. The cards became "dead" afterwards. If I remember correctly, all chip enabled payment cards also have a transaction counter that is updated on every successful transaction.

zamalek 8y ago

There is no reason why FIDO U2F wouldn't work here. Encryption was likely invented to guarantee vendor lock-in - you wouldn't want anyone buying a relatively cheap fob instead of your premium key. Don't invent crypto.