2
$\begingroup$

I have seen a lot of articles and research papers about breaking the Keeloq algorithm. My understanding is that the hardest part is getting the 64 bit manufacturer key. Some methods use crypto-analysis and some use power analysis to get the key. Once the manufacturer - and other parameters - have been obtained it is trivial to create an arbitrary number of remotes to your garage, car, or whatever.

I have two questions about that :

  1. Do manufacturers in general (cars or garages) still use Keeloq as their algorithm after these attacks and vulnerabilities have been exposed? Or are other algorithms used, for instance manufacturer specific ones?

  2. If the manufacturer key is not public and is stored in the receiver, how do some Chinese manufacturers sell some car remotes (specifically some older models)? Do the original manufacturers publish their keys after the car is out of production? Do the keys get leaked?

Because honestly I don't think Chinese mass production companies would go through all the trouble of breaking the cipher to get the key.

$\endgroup$
1
$\begingroup$

There have been several attacks against Keeloq. I cannot speak to the specific algorithm changes through the years to make it stronger against brute force; however, I am knowledgable in the hardware changes as of discussions I was privy to in 2009. The Keeloq ICs were changed shortly after the power attacks came out to make them immune from power attacks through the use of dual rail encoding. At the time, the core of the Keeloq ICs are based on the PIC12, which are very simple and could allow power attacks if you could instruction step them. Through dual rail encoding, you use the same amount of power in all data cases, but not necessarily instruction cases. Even though the PIC12s are only one-time-programmable, you can still hook them onto a debugger to single-step them. If you are interested on how this could be done, see if you can get the course notes from Tom Collins for his lab.

$\endgroup$
  • $\begingroup$ So Do you mean that Keeloq is still the main algorithm used by car manufacturers? Even after all the mentioned modifications on the hardware, I believe that Keeloq is miles away from being actually secure. $\endgroup$ – Tareq Sulaiman Aug 6 '18 at 13:06
  • 1
    $\begingroup$ @TareqSulaiman I have no idea how they Keeloq algorithm is used in practice. I only know about the semiconductors. $\endgroup$ – b degnan Aug 6 '18 at 18:20
  • $\begingroup$ Well thank you very much indeed for your answer that was very useful info. $\endgroup$ – Tareq Sulaiman Aug 6 '18 at 22:49
  • $\begingroup$ And since you are experienced in the hardware used in the process, do you think that it is practically feasible for the companies who make copycat remotes to use such ways to get the key? $\endgroup$ – Tareq Sulaiman Aug 6 '18 at 23:09
  • $\begingroup$ @TareqSulaiman Most likely, the keys would be stolen from a database. The cost of attack is likely greater than the item. There's some attack information here: security.stackexchange.com/questions/190600/… $\endgroup$ – b degnan Aug 7 '18 at 0:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.