4 ms·

> Every contactless unlock technique is vulnerable to relay attacks. > - No amount of encryption prevents relay attacks. This isn't true, and I have the patent

> Every contactless unlock technique is vulnerable to relay attacks. > - No amount of encryption prevents relay attacks. This isn't true, and I have the patent(s) to show it. I developed (along with some truly talented security professionals and cryptographers) the active RFID security system for KIWI, a residential access control system here in Germany. One of the requirements, aside from not keeping a central log of access, was that the system should not work if you were further than 10 meters from the door you were trying to open. Things like measuring signal strength, etc. were not an option, as you might imagine repeaters render that moot. Ultimately, it comes down to fairly tight timings, the speed of light and the rules of physics, but we could restrict things such that the cryptographic handshake would fail if you were more than about 30 meters away, corresponding to a timing window of about 0.0000001 seconds. We offered to license the technology to car companies, but they weren't interested.

oblio 4y ago
> We offered to license the technology to car companies, but they weren't interested. Well, I'm sorry for your tech, but you're kind of making OP's point: > Yes, 99.9% of consumers really like keyless entry and don't care too much about the potential of theft. For most, that is what insurance is for.
- rekoil 4y ago
  I think the point is we can have both, but it requires more expensive hardware to be able to do the handshake fast enough that it doesn't cause accidental failures and ultimately irritation for the user.
- sodality2 4y ago
  It refutes the part where they said: "No, we can't solve this"
jart 4y ago
I agreed with the GP but you certainly made them sound like a bag of hot air. What a pleasant reminder that security can be bona fide engineering. It's too bad we live in a world that doesn't always want problems solved.
lloeki 4y ago
> I have the patent(s) to show it. > I developed > Ultimately, it comes down to fairly tight timings, the speed of light and the rules of physics, but we could restrict things such that the cryptographic handshake would fail if you were more than about 30 meters away, corresponding to a timing window of about 0.0000001 seconds. Prior art! ;) https://web.mit.edu/jemorris/humor/500-miles https://web.mit.edu/jemorris/humor/500-miles
- yc-kraln 4y ago
  (Yes, I realize your comment was tongue-in-cheek) There are actually a lot of patented ways to prevent relay attacks, mine is only one of them. And most of them are patented by NXP :) Ultimately, this is a failure of prioritization on behalf of the car companies, or a sacrifice of security for usability, or both.
pbronez 4y ago
Where can I learn more about this technology and explore licensing opportunities?
- yc-kraln 4y ago
  I am no longer involved in the company. Here is one of the related patents: DE102012104955A1; send me a message/email and I could potentially make a connection.
moduspol 4y ago
IIRC this is how the Apple Watch's feature that unlocks your Mac works. It's not vulnerable to repeaters and only works within ~3 feet of the watch and the Mac.
- eric_h 4y ago
  I’ve found the range for unlocking your phone with the watch is even tighter. When I’m on the subway it’s less than six inches, presumably because of local radio noise.
  - moduspol 4y ago
    Yep. The reference I saw actually says ~3 meters, but even in seemingly ideal conditions, I don't see it reliably work except within probably just one.
excuses_ 4y ago
I was trying to learn more about the problem as two of my colleagues were victims of relay attacks, allegedly. Stolen cars were Mazda and Kia. I found claims that only Jaguars and Land Rovers have been resistant to that kind of attack thanks to precise time measurement - similar solution to your description. I don't have any links and found only [1] this one quickly. [1] https://teamtalk.jaguarlandrover.com/news/jaguar-land-rover-models-are-the-only-cars-immune-to-keyless-entry-attacks https://teamtalk.jaguarlandrover.com/news/jaguar-land-rover-...
deleted 4y ago
[deleted]
gentleman11 4y ago
Try selling it to insurance companies? Manufacturers who refuse to use it could have their drivers paying higher insurance rates
tlb 4y ago
How hard is it to integrate the key into phones? If it uses a separate UWB radio it must add some cost and power drain.

oblio 4y ago

> We offered to license the technology to car companies, but they weren't interested. Well, I'm sorry for your tech, but you're kind of making OP's point: > Yes, 99.9% of consumers really like keyless entry and don't care too much about the potential of theft. For most, that is what insurance is for.

rekoil 4y ago
I think the point is we can have both, but it requires more expensive hardware to be able to do the handshake fast enough that it doesn't cause accidental failures and ultimately irritation for the user.
sodality2 4y ago
It refutes the part where they said: "No, we can't solve this"

jart 4y ago

I agreed with the GP but you certainly made them sound like a bag of hot air. What a pleasant reminder that security can be bona fide engineering. It's too bad we live in a world that doesn't always want problems solved.

lloeki 4y ago

> I have the patent(s) to show it. > I developed > Ultimately, it comes down to fairly tight timings, the speed of light and the rules of physics, but we could restrict things such that the cryptographic handshake would fail if you were more than about 30 meters away, corresponding to a timing window of about 0.0000001 seconds. Prior art! ;) https://web.mit.edu/jemorris/humor/500-miles https://web.mit.edu/jemorris/humor/500-miles

yc-kraln 4y ago
(Yes, I realize your comment was tongue-in-cheek) There are actually a lot of patented ways to prevent relay attacks, mine is only one of them. And most of them are patented by NXP :) Ultimately, this is a failure of prioritization on behalf of the car companies, or a sacrifice of security for usability, or both.

pbronez 4y ago

Where can I learn more about this technology and explore licensing opportunities?

yc-kraln 4y ago
I am no longer involved in the company. Here is one of the related patents: DE102012104955A1; send me a message/email and I could potentially make a connection.

moduspol 4y ago

IIRC this is how the Apple Watch's feature that unlocks your Mac works. It's not vulnerable to repeaters and only works within ~3 feet of the watch and the Mac.

eric_h 4y ago
I’ve found the range for unlocking your phone with the watch is even tighter. When I’m on the subway it’s less than six inches, presumably because of local radio noise.
- moduspol 4y ago
  Yep. The reference I saw actually says ~3 meters, but even in seemingly ideal conditions, I don't see it reliably work except within probably just one.

excuses_ 4y ago

I was trying to learn more about the problem as two of my colleagues were victims of relay attacks, allegedly. Stolen cars were Mazda and Kia. I found claims that only Jaguars and Land Rovers have been resistant to that kind of attack thanks to precise time measurement - similar solution to your description. I don't have any links and found only [1] this one quickly. [1] https://teamtalk.jaguarlandrover.com/news/jaguar-land-rover-models-are-the-only-cars-immune-to-keyless-entry-attacks https://teamtalk.jaguarlandrover.com/news/jaguar-land-rover-...

deleted 4y ago

[deleted]

gentleman11 4y ago

Try selling it to insurance companies? Manufacturers who refuse to use it could have their drivers paying higher insurance rates

tlb 4y ago

How hard is it to integrate the key into phones? If it uses a separate UWB radio it must add some cost and power drain.