3 ms·
RTT measurements can give proof-of-proximity (due to relavity), but I think they're quite hard to get right (you'd need nanosecond RTT resolution in a cheap key
by darkmighty 8y ago
RTT measurements can give proof-of-proximity (due to relavity), but I think they're quite hard to get right (you'd need nanosecond RTT resolution in a cheap keyfob) -- I think analog signal repeaters would't add significant RTT. It's not impossible though, GPS decoders work in a similar fashion.
Requiring user iniciation seems like the adequate solution here...
- kazinator 8y agoIt's the vehicle side system that measures RTT, not the fob. The fob just has to have consistent response latency so as not to perturb the RTT.
- xenadu02 8y agoThe Apple Watch manages to handle RTT measurements to prevent exactly this attack. You don't need complexity in the FOB; the car starts the clock, sends the signal, measures the time taken to reply. If it exceeds some threshold ignore the response. There is no way to spoof this if the request/response itself is using proper cryptography.