# What is Rolling Code in cryptographic terms?

My first contact with cryptography was programming Rolling Code keychains. Since then I've been reading about this topic. But is hard to me understand the various types, uses, concerns of cryptography world. Is Rolling Code a type of Authenticated Message? Or is it a Cryptographic method of dispersion? Is it Block or Stream cipher cryptography?

Edit: This Application Note explains how implement a Rolling Code controller. http://www.atmel.com/Images/Atmel-2600-AVR411-Secure-Rolling-Code-Algorithm-for-Wireless-Link_Application-Note.pdf

• Please define what "Rolling Code" is or supply a reference. – kodlu Mar 12 '17 at 21:32
• @kodlu a rolling code is one where the code used changes every time, instead of using the exact same code every time – Richie Frame Mar 13 '17 at 2:54

A Rolling Code is a method to generate short authenticated messages $M_i$, where $i$ is incremental modulo $n$ (thus rolling after $n$ messages), usually with the additional property that when the receiver has last accepted message $M_i$, it will only accept messages $M_{(i+j)\bmod n}$ for $1\le j\le m$, for some $m\ll n$ (perhaps $m=n/2$). This blocks attacks where a passive eavesdropper replays a message she intercepted, if the legitimate receiver has received that message or a later one, and until at least $n$ codes have been generated. Loss of less than $m$ consecutive messages is tolerated without undue message rejection.

A simple form of $M_i$ could be the concatenation of counter $i$ on $k$ bits (with $n=2^k$), and of a MAC of $i$ using a secret key shared by sender and receiver, obtained using HMAC.
Another option could be that $M_i$ is $i$ as a 128-bit block enciphered using one AES-128; $n$ is $2^{128}$ thus roll over never occurs in practice, and messages are authenticated by using a much smaller $m$, say $2^{48}$.

In the context of a door opener using one-way communication and no shared time reference, this gives useful but imperfect protection. An attack against the protocol (rather than the authenticating cryptography) remains possible by an active adversary:

• User wants to open door, activates transmitter, which generates $M_i$.
• Adversary intercepts $M_i$, and jams it (perhaps, by sending a strong signal during some fraction of the frame carrying the message, which can be reconstructed; that can be a header, or any fraction of a message shorter than its CRC if the message is protected by CRC).
• Since the door does not open, user retries, re-activates transmitter, which generates $M_{i+1}$.
• Adversary similarly intercepts and jams $M_{i+1}$.
• Adversary immediately send $M_i$; the door opens, legitimate user is happy.
• Later, adversary send $M_{i+1}$, door opens, adversary is happy.