Hacker News Reader

You don't need PKI for this - the car and the key have pre-shared keys.

All you need is to include a counter in the signal that is incremented for each button press. The car remembers the last counter value it receives and ignores any before that. Obviously the counter needs to be encrypted in some way but it's not exactly difficult.

I'm kind of amazed this still happens in 2016. Or maybe it doesn't. The cars could be old.

View on HN

Assume you're getting downvoted instead of commented on because, as above poster pointed out, the weak point is the counter in any one-way scheme. Specifically when the car doesn't see a fob press but the fob is pressed (e.g. out of range / blocked).

Thus, you have a broken keyfob if you ever press it outside the car's range (or require a "re-pairing" handshake to resynchronize the counters). Infeasible due to terrible usability.

Or you widen the window of accepted counters to avoid the above issus. Which is what this attack is preying on.

Err, no. You wouldn't require then counter to go up by exactly one each time. You just wouldn't allow it to go backwards.

This usually that attack method with the added benefit of making a mesh network out of it using LoRa signals.

Reply on news.ycombinator.com