4 ms·
If you have control of the opener, couldn’t you use the door’s learning mode and make it into a real opener?
by ec109685 3y ago
If you have control of the opener, couldn’t you use the door’s learning mode and make it into a real opener?
- Eji1700 3y agoI thought so at first by my initial reading left me somewhat confused on if there's a private key that only certain remotes have or something like that?
- abcd_f 3y agoIt's less of a private key and more a random per-remote prng seed that gets set both on the remote and the door controller when they are paired. When you press the button, remote increments its sequence number and send this number, its ID and a hash of all that and the seed to the controller. Controller checks the hash, then checks that seq number is more than last seen for this remote and opens the door. This protects against replay attacks and fairly uncomplicated to implement.
- tkems 3y agoThis sounds a lot like the KeeLoq algorithm [0] (minus the hashing part). From my research into the rolling code space, I think most remotes don't quite have the CPU/featureset to support a real, secure crypto system with things like SHA, AES, and RSA/ECC. Would love to see one though! [0] https://en.wikipedia.org/wiki/KeeLoq https://en.wikipedia.org/wiki/KeeLoq
- tkems 3y agoFor Chamberlain brands [0] there is some research that shows that their rolling code system (Security+ and Security+ 2.0) is quite easy to decode/decrypt [1]. This feature is supported in the flipper firmware, but is restricted (you can't create a custom remote, only clone is supported) without custom firmware. However, I'm sure you could decode a raw capture file if needed in a pinch. [0] https://chamberlaingroup.com/our-brands https://chamberlaingroup.com/our-brands [1] https://github.com/argilo/secplus https://github.com/argilo/secplus