3 ms·

How would you deal with spare parts, then? If every spare part you swap on your car is able to check and sign messages, then this defeats the purpose. If every

How would you deal with spare parts, then? If every spare part you swap on your car is able to check and sign messages, then this defeats the purpose. If every spare part needed to be programmed with the private keys, this significantly increases the cost of maintenance and prohibits non-dealers from making such changes. Besides, are the private keys really private when dealers can access them? ECUs are already tightly paired with immobilizers and dashboards, so they already need to be swapped together. Let's not do this with other parts which frequently break such as lights, locks and windows, please.

sidewndr46 3y ago
Easy, only an authorized dealer can make repairs to the vehicle. After a period of time the manufacturer may elect to no longer authorize any repairs, so as to incentivize the purchase of safer and cleaner automobiles.
- tough 3y ago
  Right to not repair
boromisp 3y ago
You could allow to pair the part to some central control unit, when the car is unlocked. I don't speak car or cryptographer so so I have no idea about how to go about it, but this seems like a workable solution.
rhn_mk1 3y ago
You don't need to sign all messages. Only those coming from the critical component, like the key fob, and the only parts that need to check signatures are the critical ones from the perspective of theft. Once you replace the key fob, you must reprogram your engine ignition. What prevents a thief from reprogramming the engine ignition for some other key? The same thing that prevents the thief from starting ignition manually: it's buried in the car. Notice that in this case, thieves rely on CAN buses running in easily accessible places. If the thief can access your car's ignition directly, you can't stop them anyway.
londons_explore 3y ago
New spare parts can begin unprogrammed, and then program themselves on first use. This first use wouldn't be secure (it would be vulnerable to MITM attacks), but I believe that would be acceptable to the threat model of a thief attacking a parked car. Reprogramming of 2nd hand components to a different vehicle might also be possible, but using some procedure which is hard to do from outside the car. For example, short two pins on the back of the lock.
- TheLoafOfBread 3y ago
  How does that part know that it is being unprogrammed in the car and not in the thieves yard with cracked diagnostic tool? So basically I need to pretend to be a new part to steal a car. Some common key as an attack vector.
  - vladvasiliu 3y ago
    Presumably, if you're able to replace the lock on a locked car with your own, you don't need to fool anything, you're already inside the car. I guess the attack vector would rather be some unscrupulous mechanic replacing the part with a bogus one that would accept every unlock command, and the thief, in cahoots with said mechanic, would show up and unlock the car once the owner got it back from the shop.
    - TheLoafOfBread 3y ago
      Well the thing is that this is how cars with encrypted immobilizer gets stolen today (deffo not the case of RAV4) - Open a hood - Connect new, unprogrammed ECU (no immobilizer loaded) - You can now start the car without chip in your key As I see, people are reinventing wheel here, and are creating same problems as OEMs did 10-15 years ago.
      - vladvasiliu 3y ago
        Assuming they're willing to break a window or sacrifice the hood and related bodywork to pop it open without a key, is it really so easy to swap an ECU without having to take half the car apart? My dad used to have a Citroën that would require taking out the whole front bumper assembly to change a freaking light, so it would be beyond stupid to have the ECU easily accessible...
labcomputer 3y ago
This... seems like a relatively trivial problem to solve? Each device that needs to sign messages (which probably should be only the ECU) is provisioned with a certificate signed by the carmaker. The device is also provisioned with a public-key pair, which is signed by the certificate (so you have chain of trust back to the manufacturer). The public key pair could be either programmed when the firmware is first flashed or generated at first boot. A new door BCM accepts the first broadcasted public key from the ECU which is correctly signed. This would happen inside the factory for a new car, or when a new BCM is installed to replace a faulty one. A used door BCM from a junk yard car could be programmed to accept a different (signed) public key by: 1. Being in the unlocked (and perhaps window-down) state; and 2. Pressing some combination of door buttons; and 3. Sending an appropriate command over the CANbus It, of course, then verifies that the new key is correctly signed and reprograms itself to the new key.

sidewndr46 3y ago

Easy, only an authorized dealer can make repairs to the vehicle. After a period of time the manufacturer may elect to no longer authorize any repairs, so as to incentivize the purchase of safer and cleaner automobiles.

tough 3y ago
Right to not repair

boromisp 3y ago

You could allow to pair the part to some central control unit, when the car is unlocked. I don't speak car or cryptographer so so I have no idea about how to go about it, but this seems like a workable solution.

rhn_mk1 3y ago

You don't need to sign all messages. Only those coming from the critical component, like the key fob, and the only parts that need to check signatures are the critical ones from the perspective of theft. Once you replace the key fob, you must reprogram your engine ignition. What prevents a thief from reprogramming the engine ignition for some other key? The same thing that prevents the thief from starting ignition manually: it's buried in the car. Notice that in this case, thieves rely on CAN buses running in easily accessible places. If the thief can access your car's ignition directly, you can't stop them anyway.

londons_explore 3y ago

New spare parts can begin unprogrammed, and then program themselves on first use. This first use wouldn't be secure (it would be vulnerable to MITM attacks), but I believe that would be acceptable to the threat model of a thief attacking a parked car. Reprogramming of 2nd hand components to a different vehicle might also be possible, but using some procedure which is hard to do from outside the car. For example, short two pins on the back of the lock.

TheLoafOfBread 3y ago
How does that part know that it is being unprogrammed in the car and not in the thieves yard with cracked diagnostic tool? So basically I need to pretend to be a new part to steal a car. Some common key as an attack vector.
- vladvasiliu 3y ago
  Presumably, if you're able to replace the lock on a locked car with your own, you don't need to fool anything, you're already inside the car. I guess the attack vector would rather be some unscrupulous mechanic replacing the part with a bogus one that would accept every unlock command, and the thief, in cahoots with said mechanic, would show up and unlock the car once the owner got it back from the shop.
  - TheLoafOfBread 3y ago
    Well the thing is that this is how cars with encrypted immobilizer gets stolen today (deffo not the case of RAV4) - Open a hood - Connect new, unprogrammed ECU (no immobilizer loaded) - You can now start the car without chip in your key As I see, people are reinventing wheel here, and are creating same problems as OEMs did 10-15 years ago.
    - vladvasiliu 3y ago
      Assuming they're willing to break a window or sacrifice the hood and related bodywork to pop it open without a key, is it really so easy to swap an ECU without having to take half the car apart? My dad used to have a Citroën that would require taking out the whole front bumper assembly to change a freaking light, so it would be beyond stupid to have the ECU easily accessible...

labcomputer 3y ago

This... seems like a relatively trivial problem to solve? Each device that needs to sign messages (which probably should be only the ECU) is provisioned with a certificate signed by the carmaker. The device is also provisioned with a public-key pair, which is signed by the certificate (so you have chain of trust back to the manufacturer). The public key pair could be either programmed when the firmware is first flashed or generated at first boot. A new door BCM accepts the first broadcasted public key from the ECU which is correctly signed. This would happen inside the factory for a new car, or when a new BCM is installed to replace a faulty one. A used door BCM from a junk yard car could be programmed to accept a different (signed) public key by: 1. Being in the unlocked (and perhaps window-down) state; and 2. Pressing some combination of door buttons; and 3. Sending an appropriate command over the CANbus It, of course, then verifies that the new key is correctly signed and reprograms itself to the new key.