6 ms·
I never understood why keyfobs work in a UDP style, when communication between the remote and car would be infinitely better. For instance, instead of just sen
by DanBlake 13y ago
I never understood why keyfobs work in a UDP style, when communication between the remote and car would be infinitely better.
For instance, instead of just sending "12345" and having the doors open since the code was expected, What about if the remote said "hey car, whats your random number" - the car then transmits back "54321" at which point the transmitter sends a hashed reply sha512(54321 + unique-random-id-set-per-car) which the car receives then verifies matches expected output.
The takeaway being that both the car and the remote know what "unique-random-id-set-per-car" is, but nobody else does. It should be randomly set at the factory so each car and the remotes have a unique id.
My only thoughts as to why its not like this is that the logic required to do that type of operation might not be possible without a higher wattage 'processor' in the keyfob which would eat through batteries. Im totally out of the know in that area though.
Also, unrelated- but the passenger door thing is likely just coincidence because they want to get in the glove box. But, there is another thing that could explain it. On my last car (mercedes) when I wanted to reprogram a new keyfob to work with the car, I had to do a long process of certain actions to make it work. It was like "press on brake, release brake, press on brake for 3 seconds then release, open drivers window, open passenger door, close drivers window, press open button on keyfob" So the car CPU is definitely aware and can take actions specific to which door is being opened, so its possible its related.
- jevinskie 13y agoMifare fobs do use a challenge response protocol. Old fobs use small keys though.
- martin-adams 13y agoThat probably means the keyfob needs a receiver (which I suspect they don't by current design). But I agree, a two-way communication would be nice as the keyfob could then report whether the car was locked properly.
- WiseWeasel 13y agoWouldn't you then be able to determine the fob ID by recording multiple car "random number" requests and fob responses?
- stcredzero 13y agoMake the nonce and the secret long enough, and you would have to break SHA512.
- lucb1e 13y agoI think that's part of how Mifare (NFC) was cracked; the entropy of the card's random number generator was very low. When implemented correctly it's a safe method though.
- makomk 13y agoHaving both a transmitter and receiver in the fob used to be a lot more expensive and bulky than having just a transmitter. It isn't really anymore thanks to advances in RF miniturization and integration, but when car keyfobs were first designed it mattered.