4 ms·

«it should be absolutely trivial to detect how far away the key is based on the response time» It's not possible. A keyfob has a relatively slow R/F communicat

by mrb 8y ago

«it should be absolutely trivial to detect how far away the key is based on the response time» It's not possible. A keyfob has a relatively slow R/F communication channel, less than 1 Mbit/s (at best) because it's constrained by power. Thus the "length" of a bit transmitted over the air is 300 meters or more. The receiver needs to demodulate "300 meters" of R/F signal to recover a single bit. A difference of +/- 10 meters when these thieves boost the signal across your front yard is therefore indistinguishable from R/F noise and not demodulable by the receiver. You can visualize this as a 300 meter bit that has a noisy beginning and a noisy end. That's why the distance-bounding techniques (term we use in the field) used by car manufacturers are instead pretty primitive, such as measuring the strength of the R/F signal (which is easily defeated by a proper signal booster.)

wglb 8y ago
A BOEC here: https://news.ycombinator.com/item?id=18609103 https://news.ycombinator.com/item?id=18609103
kalleboo 8y ago
Is there any reason that keyfobs couldn't use 2.4 GHz (aside from cost)? Apple claims to be detecting if your Apple Watch is close enough to unlock your computer using Bluetooth at that frequency. Bluetooth LE also seems to claim battery life that is competitive.
- ghaff 8y ago
  BLE beacons do a crap job of detecting distance and battery life is just OK (a few months typically). BLE can obviously be used to differentiate between in-range and out-of-range which is useful for some applications but you can't really use it to measure distance more granularly.
  - kalleboo 8y ago
    You just need BLE for proximity to wake up a smarter portion of the fob for an instant to do the time-of-flight check I'm just trying to think of any reason the keyfobs NEED to use low frequencies, and all I can come up with is cost
jwr 8y ago
It is absolutely possible. As I wrote elsewhere in the comments, you need to use radios with timestamping that can measure the distance (10cm accuracy is achievable). See for example Decawave DW1000 radios. Use those and you can base your distance estimation on time measurement, rather than signal strength. Amplifiers won't help.
- mrb 8y ago
  Nope, DW1000 can't work in an adversarial scenario. Their ranging algorithm critically depends on the receiver time-stamping the "leading edge" of the first bit of the first byte of the PHY header. This bit is either always 0 or always 1 (it's part of the 802.15.4 data rate field), so an attacker can easily cheat by preemptively sending a 0 or a 1 just before the signal booster can relay the first legitimate bit from the keyfob. This legitimate bit will be received (by the booster) while the preemptive bit is still being transmitted, so the booster can smoothly transition to sending the subsequent legitimate bits, and the receiver will have been completely fooled that the keyfob is nearby. DW1000 is nice but it only works in scenarios where both transmitters and receivers are being honest to each other.

by mrb 8y ago

wglb 8y ago

A BOEC here: https://news.ycombinator.com/item?id=18609103 https://news.ycombinator.com/item?id=18609103

kalleboo 8y ago

Is there any reason that keyfobs couldn't use 2.4 GHz (aside from cost)? Apple claims to be detecting if your Apple Watch is close enough to unlock your computer using Bluetooth at that frequency. Bluetooth LE also seems to claim battery life that is competitive.

ghaff 8y ago
BLE beacons do a crap job of detecting distance and battery life is just OK (a few months typically). BLE can obviously be used to differentiate between in-range and out-of-range which is useful for some applications but you can't really use it to measure distance more granularly.
- kalleboo 8y ago
  You just need BLE for proximity to wake up a smarter portion of the fob for an instant to do the time-of-flight check I'm just trying to think of any reason the keyfobs NEED to use low frequencies, and all I can come up with is cost

jwr 8y ago

It is absolutely possible. As I wrote elsewhere in the comments, you need to use radios with timestamping that can measure the distance (10cm accuracy is achievable). See for example Decawave DW1000 radios. Use those and you can base your distance estimation on time measurement, rather than signal strength. Amplifiers won't help.

mrb 8y ago
Nope, DW1000 can't work in an adversarial scenario. Their ranging algorithm critically depends on the receiver time-stamping the "leading edge" of the first bit of the first byte of the PHY header. This bit is either always 0 or always 1 (it's part of the 802.15.4 data rate field), so an attacker can easily cheat by preemptively sending a 0 or a 1 just before the signal booster can relay the first legitimate bit from the keyfob. This legitimate bit will be received (by the booster) while the preemptive bit is still being transmitted, so the booster can smoothly transition to sending the subsequent legitimate bits, and the receiver will have been completely fooled that the keyfob is nearby. DW1000 is nice but it only works in scenarios where both transmitters and receivers are being honest to each other.