7 ms·

Tons of the rolling key systems on the market are based on KeyLoq, and keyloq is a fairly well designed system with a big lynch pin. It has something called a

by kj4ips 1y ago

Tons of the rolling key systems on the market are based on KeyLoq, and keyloq is a fairly well designed system with a big lynch pin. It has something called a 'manufacturer key', which needs to be available to any device that allows field pairing of remotes. If that manufacturer key is known, it only takes two samples from an authenticator to determine the sequence key. Absent the manufacturer key, jamming+replay attacks work, but brute forcing a sequence key is generally prohibitively costly. However, since any receiver that supports field programming needs the magic "manufacturer key", one could purchase such a unit, and may be able to extract said key.

deleted 1y ago
[deleted]
userbinator 1y ago
They could've designed a system that doesn't require a fixed secret master key, but instead generates a unique random key for each receiver and requires a physical connection between the fob and the receiver (located inside the locked part of the car) to pair them. Of course such a generic system would be against manufacturer's interests in controlling the repair and aftermarket industry.
- phire 1y ago
  You don't even need a physical connection. As long as you have two-way wireless communication (which any keyless entry/start system does), then you can simply do a Diffie-Hellman key exchange during the pairing process. Diffie-Hellman is designed for exactly this usecase, allowing two parties to derive a shared secret key over a public channel without exposing it.
  - tux1968 1y ago
    That allows the conversation to proceed in secret from listeners, but it provides no authentication to ensure that only legitimate parties are involved. The reason for physical contact is to "prove" that you are legitimately in control of the vehicle, not a random passerby.
    - phire 1y ago
      I'm not sure you should be that concerned about man-in-the-middle attacks. If someone does successfully MITM while walking by the key is going to stop working as soon as they are out of range, and you will notice. I'm just wanting a system that could be implemented with the hardware that's already there. I guess you could use the RFID chip that most keyless start cars already have as a secondary channel. Still Not 100% secure, but the MITM device would need to be physically in your car to intercept the pairing request, and at that point you have bigger problems.
      - tux1968 1y ago
        Sorry, I didn't mean to make it sound like the problem was MITM. The issue is initiating a pairing request, you can't allow just any key to request it, that allows bad actors to pair a key with your car. While I worry that it's not really secure enough, the OP was suggesting that physical contact is a way to "prove" that you are indeed eligible to pair, by excluding everyone who lacks physical contact.
        phire 1y ago
        Modern cars already have a complex sequence to enter pairing mode. You need to press buttons inside the car, buttons on the currently paired key (to prove possession of that) and buttons on the key you want to pair with. So a passer by would have to press a button on their fob at just the right moment. Then when you go to test your new key fob, it wouldn't work, so you would pair again until it was your key that was paired.
        tux1968 1y ago
        Yeah, it's the same for garage door openers today. I took the OP simply to be saying that physical access of some type needs to be available (ie. to stop anyone initiating a pairing). Some cars require the key to be physically inserted into the ignition switch, which requires the key to be correctly cut to match the car, before pairing; which is a nice extra hurdle to stop thieves quickly pairing after they break into your car. Whatever the case, making it easier to pair, shouldn't be the primary focus, no need to help a thief doing it quickly. It would just be nice to have a way to do it, that didn't ultimately require the manufacturer to get involved; but that does remove a big hurdle for thieves, too.
  - conradev 1y ago
    A PAKE scheme with a passcode communicated out of band during pairing feels more appropriate to make sure no one is snooping. A one-time out of band authentication (usually some form of trusted physical interaction) is key if you don’t want to trust intermediaries.
  - theamk 1y ago
    Given how bad the "single master key" idea is, even simple update like "transmit secret key in the open, but with reduced power, during paring mode", would be a great improvement. It'd instantly mean there is 0% chance of someone figuring the key based on day-to-day operation.
nroets 1y ago
Correct. While the original KeeLog cipher is most likely no longer secure, Microchip moved on to AES. KeeLoq is also used for garage door openers. Some KeeLoq receivers have a "learning mode" where it adds the next KeeLoq transmitter it hears provided it uses the same manufacturer key. Learn mode is activated either with a button often on the PCB or with a "master" transmitter. https://en.wikipedia.org/wiki/KeeLoq https://en.wikipedia.org/wiki/KeeLoq
garaetjjte 1y ago
>If that manufacturer key is known, it only takes two samples from an authenticator to determine the sequence key. Not if seed with appropriate length is used. Though I don't know how common that is, back in 2008 authors noted that "We would like to mention that none of the real-world KeeLoq systems we analyzed used any seed" (https://www.iacr.org/archive/crypto2008/51570204/51570204.pdf https://www.iacr.org/archive/crypto2008/51570204/51570204.pd..., section 4.3)

by kj4ips 1y ago

deleted 1y ago

[deleted]

userbinator 1y ago

They could've designed a system that doesn't require a fixed secret master key, but instead generates a unique random key for each receiver and requires a physical connection between the fob and the receiver (located inside the locked part of the car) to pair them. Of course such a generic system would be against manufacturer's interests in controlling the repair and aftermarket industry.

phire 1y ago
You don't even need a physical connection. As long as you have two-way wireless communication (which any keyless entry/start system does), then you can simply do a Diffie-Hellman key exchange during the pairing process. Diffie-Hellman is designed for exactly this usecase, allowing two parties to derive a shared secret key over a public channel without exposing it.
- tux1968 1y ago
  That allows the conversation to proceed in secret from listeners, but it provides no authentication to ensure that only legitimate parties are involved. The reason for physical contact is to "prove" that you are legitimately in control of the vehicle, not a random passerby.
  - phire 1y ago
    I'm not sure you should be that concerned about man-in-the-middle attacks. If someone does successfully MITM while walking by the key is going to stop working as soon as they are out of range, and you will notice. I'm just wanting a system that could be implemented with the hardware that's already there. I guess you could use the RFID chip that most keyless start cars already have as a secondary channel. Still Not 100% secure, but the MITM device would need to be physically in your car to intercept the pairing request, and at that point you have bigger problems.
    - tux1968 1y ago
      Sorry, I didn't mean to make it sound like the problem was MITM. The issue is initiating a pairing request, you can't allow just any key to request it, that allows bad actors to pair a key with your car. While I worry that it's not really secure enough, the OP was suggesting that physical contact is a way to "prove" that you are indeed eligible to pair, by excluding everyone who lacks physical contact.
      - phire 1y ago
        Modern cars already have a complex sequence to enter pairing mode. You need to press buttons inside the car, buttons on the currently paired key (to prove possession of that) and buttons on the key you want to pair with. So a passer by would have to press a button on their fob at just the right moment. Then when you go to test your new key fob, it wouldn't work, so you would pair again until it was your key that was paired.
        tux1968 1y ago
        Yeah, it's the same for garage door openers today. I took the OP simply to be saying that physical access of some type needs to be available (ie. to stop anyone initiating a pairing). Some cars require the key to be physically inserted into the ignition switch, which requires the key to be correctly cut to match the car, before pairing; which is a nice extra hurdle to stop thieves quickly pairing after they break into your car. Whatever the case, making it easier to pair, shouldn't be the primary focus, no need to help a thief doing it quickly. It would just be nice to have a way to do it, that didn't ultimately require the manufacturer to get involved; but that does remove a big hurdle for thieves, too.
- conradev 1y ago
  A PAKE scheme with a passcode communicated out of band during pairing feels more appropriate to make sure no one is snooping. A one-time out of band authentication (usually some form of trusted physical interaction) is key if you don’t want to trust intermediaries.
- theamk 1y ago
  Given how bad the "single master key" idea is, even simple update like "transmit secret key in the open, but with reduced power, during paring mode", would be a great improvement. It'd instantly mean there is 0% chance of someone figuring the key based on day-to-day operation.

nroets 1y ago

Correct. While the original KeeLog cipher is most likely no longer secure, Microchip moved on to AES. KeeLoq is also used for garage door openers. Some KeeLoq receivers have a "learning mode" where it adds the next KeeLoq transmitter it hears provided it uses the same manufacturer key. Learn mode is activated either with a button often on the PCB or with a "master" transmitter. https://en.wikipedia.org/wiki/KeeLoq https://en.wikipedia.org/wiki/KeeLoq

garaetjjte 1y ago

>If that manufacturer key is known, it only takes two samples from an authenticator to determine the sequence key. Not if seed with appropriate length is used. Though I don't know how common that is, back in 2008 authors noted that "We would like to mention that none of the real-world KeeLoq systems we analyzed used any seed" (https://www.iacr.org/archive/crypto2008/51570204/51570204.pdf https://www.iacr.org/archive/crypto2008/51570204/51570204.pd..., section 4.3)