How Keyless Car Entry Relay Attacks Actually Work
Try the interactive lab for this articleTake the quiz (6 questions)In November 2024, a high-value SUV was stolen from a residential driveway in Munich in under twenty seconds without physical force or forced lock picking. Closed-circuit television recordings captured two individuals approaching the residence. One individual stood near the front door holding a small messenger bag containing a custom RF transceiver array, while the second individual stood beside the vehicle driver door handle. As the second individual pulled the door handle, the vehicle lights flashed, the mirrors unfolded, the central locking solenoids disengaged, and the engine ignition button illuminated. The thieves opened the door, pressed the engine start button, and drove away.
The attack required no brute-force cryptographic cracking of authentication keys, no OBD-II port memory flashing, and no physical key duplication. It exploited a fundamental physical vulnerability in Passive Keyless Entry and Start (PKES) protocols: the implicit assumption that the physical propagation range of a Low Frequency (LF) magnetic wake-up field corresponds directly to spatial proximity between the vehicle and the key fob.
By extending the physical reach of the LF wake-up signal and relaying the Ultra-High Frequency (UHF) authentication response over a secondary high-frequency radio link, attackers trick the vehicle Body Control Module (BCM) into concluding that an authorized key fob is located within a 1.5-metre radius of the vehicle door handle when it is actually resting inside a house tens or hundreds of metres away.
1. Passive Keyless Entry Protocol Architecture
To understand how relay extension attacks function, one must distinguish between traditional Remote Keyless Entry (RKE) and Passive Keyless Entry and Start (PKES).
Traditional RKE relies on unidirectional active transmission. The user physically presses a button on the key fob, triggering a microcontroller to transmit a radio frequency data packet (typically at 433.92 MHz in Europe or 315 MHz in North America) containing an encrypted rolling code payload.
PKES operates automatically without user interaction on the key fob. The interaction uses a dual-frequency, bidirectional RF protocol spanning two distinct spectrum regions: Low Frequency (LF, typically 125 kHz or 134.2 kHz) for localized physical proximity detection, and Ultra-High Frequency (UHF, typically 433.92 MHz or 868.3 MHz) for long-range data return.
+-------------------+ +-------------------+
| Vehicle (BCM) | | Key Fob |
| | | |
| 1. Door Handle | | |
| Capacitive | | |
| Sensor Touch | | |
| | | |
| 2. LF Driver IC |===== 125 kHz LF Field ===>| 3. 3D LF Coils |
| (NCF29A1) | Inductive Challenge | (NCF2951) |
| Coil Drives | (RAND + Vehicle ID) | Analog Front |
| | | Wake-up |
| | | |
| | | 4. Microcontroller|
| | | AES-128 Engine |
| | | Computes MAC |
| | | |
| 5. UHF Receiver |<==== 433.92 MHz FSK =====| 6. UHF Tx IC |
| BCM Validates | Response Packet | Transmits |
| MAC & Unlocks | (MAC + Counter) | Cryptographic |
+-------------------+ | Response |
+-------------------+The Low Frequency (LF) Proximity Field
Vehicles equipped with PKES integrate several LF ferrite rod loop antennas driven by specialized power amplifier ICs (such as the NXP NCF29A1, Texas Instruments TMS37145, or Microchip ATA5291). These antennas are installed in strategic structural zones:
- Driver door handle assembly
- Passenger door handle assembly
- Rear bumper or tailgate latch assembly
- Interior cabin floor console and boot compartment
When an operator touches a capacitive sensor integrated into the door handle or pulls the mechanical handle latch, the Body Control Module (BCM) initiates an authentication cycle by energizing the corresponding door handle antenna coil with a 125 kHz sinusoidal current.
Because a 125 kHz signal has a wavelength ($\lambda$) of approximately 2,400 metres ($\lambda = c / f = 3 \times 10^8 / 125,000 = 2,400\text{ m}$), an antenna operating within 1 to 2 metres of the vehicle operates entirely within the reactive near-field region ($r \ll \lambda / 2\pi$). In this near-field region, electromagnetic radiation propagation is negligible; communication occurs via quasi-static magnetic induction.
The magnetic field strength $H$ generated by a magnetic dipole antenna decays inversely with the cube of the distance ($r$):
$$H(r) \approx \frac{m}{4\pi r^3}$$
where $m$ is the magnetic dipole moment of the coil antenna ($m = N \cdot I \cdot A$).
This steep $1/r^3$ drop-off profile is the primary physical mechanism intended to guarantee physical proximity. Under normal operation, a 125 kHz magnetic signal with a field strength of 100 dBµA/m at 0.5 metres attenuates below the minimum sensitivity threshold of the key fob receiver (typically 1 to 5 mV/m or ~30 dBµA/m) at a physical boundary of 1.5 to 2.0 metres from the vehicle door handle.
Signal Modulation and Packet Structure
The 125 kHz magnetic transmission carries digital data modulated using Amplitude Shift Keying (ASK) or On-Off Keying (OOK) combined with Manchester encoding. The bit rate on the 125 kHz channel is typically low, ranging between 2 kbps and 4 kbps, to maintain narrow channel bandwidth and preserve receiver sensitivity.
The LF challenge frame transmitted by the vehicle consists of five primary field sections:
+---------------+---------------+--------------------+------------------+---------+
| Preamble | Vehicle ID | Random Challenge | Command Code | CRC-16 |
| 8-16 bits | 32 bits | (RAND) 64-128 bits | (Unlock/Start) | 16 bits |
| (Sync 0xAA) | (VIN Hash) | Cryptographic Seed | 8 bits | ISO 3309|
+---------------+---------------+--------------------+------------------+---------+- Preamble: A square wave sequence (e.g.,
0xAAor0x55) allowing the key fob receiver Automatic Gain Control (AGC) and phase-locked loop (PLL) clock recovery circuits to stabilize. - Vehicle Identifier (VIN Hash): A 32-bit identifier derived from the vehicle unique identification number to prevent key fobs belonging to neighboring vehicles from processing irrelevant challenges.
- Random Challenge (RAND): A 64-bit or 128-bit pseudo-random number generated by the vehicle Hardware Random Number Generator (HRNG) inside the BCM.
- Command Payload: An 8-bit instruction specifying the requested operation (e.g.,
0x01= Driver Door Unlock,0x02= Passenger Door Unlock,0x05= Ignition Start Enable). - Cyclic Redundancy Check (CRC-16): A 16-bit checksum (using standard polynomials such as CRC-16-CCITT) protecting against magnetic noise corruption.
Key Fob Architecture and Internal State Transitions
Inside the key fob, a 3D Low-Power LF Receiver IC (such as the NXP NCF2951 or Atmel ATA5279) is connected to a 3D orthogonal coil array containing three mutually perpendicular ferrite-wound inductors ($L_x, L_y, L_z$). This 3D orientation ensures that the key fob can detect incoming magnetic flux vectors regardless of spatial orientation inside a pocket, bag, or glove.
Z-Coil (Vertical Axis)
^
| +------------------------+
| | Key Fob Enclosure |
| | |
| | [Y-Coil] |
+--------+--+---> X-Coil (Horizontal)|
/ | | |
/ | +------------------------+
Y-Coil (Lateral Axis)The signal path and internal state machine transition of the key fob follow a strict low-power execution sequence:
+-------------------------------------------------------------------+
| DEEP SLEEP STATE |
| Microcontroller in stop mode (< 0.8 uA current draw). |
| 3D LF Analog Front-End (AFE) listening for 125 kHz preamble. |
+-------------------------------------------------------------------+
|
| 125 kHz field detected > 1.5 mV/m
v
+-------------------------------------------------------------------+
| WAKE-UP AND DEMODULATION |
| AFE asserts wake-up interrupt pin to MCU. |
| Demodulates ASK/OOK Manchester data stream into RX buffer. |
| Verifies Preamble, Vehicle ID, and CRC-16 checksum. |
+-------------------------------------------------------------------+
|
| Vehicle ID matches stored VIN
v
+-------------------------------------------------------------------+
| CRYPTOGRAPHIC CALCULATION |
| MCU initializes AES-128 hardware accelerator block. |
| Loads secret key K_secret from tamper-resistant EEPROM. |
| Calculates Ciphertext = AES-128-ECB(K_secret, RAND). |
+-------------------------------------------------------------------+
|
| Computation completes (< 3 ms)
v
+-------------------------------------------------------------------+
| UHF RESPONSE TRANSMISSION |
| MCU powers on 433.92 MHz / 868.3 MHz FSK RF transmitter. |
| Transmits response frame containing MAC, Fob Serial, Counter. |
| MCU returns to DEEP SLEEP STATE. |
+-------------------------------------------------------------------+The response packet transmitted by the key fob over the 433.92 MHz or 868.3 MHz UHF radio link uses Frequency Shift Keying (FSK) or Gaussian Frequency Shift Keying (GFSK) at data rates between 10 kbps and 50 kbps:
+---------------+---------------+--------------------+------------------+---------+
| UHF Preamble | Fob Serial ID | Cryptographic MAC | Monotonic Count | CRC-16 |
| 16-32 bits | 32 bits | (AES-128 Output) | (Rolling Counter)| 16 bits |
| (Sync Pattern)| Unique Fob ID | 64-128 bits | 24 bits | Checksum|
+---------------+---------------+--------------------+------------------+---------+Upon receiving this UHF transmission, the vehicle UHF receiver module forwards the frame over a Local Interconnect Network (LIN) or Controller Area Network (CAN) bus to the BCM. The BCM executes identical AES-128 calculations using its copy of $K_{secret}$. If the computed MAC matches the received MAC and the monotonic rolling counter exceeds the previously accepted counter index, authentication passes and door lock actuators unlock.
2. Physical Relay Attack Vector: Mechanics and Hardware Architecture
The security model of PKES relies entirely on the physical limitation of the 125 kHz LF magnetic field range. The cryptographic algorithm (AES-128) guarantees message authenticity and freshness, but it provides no inherent information regarding spatial location. A challenge-response sequence evaluates:
$$\text{Valid} = \begin{cases} 1 & \text{if } \text{Response} == \text{AES}_{K}(\text{RAND}) \ 0 & \text{otherwise} \end{cases}$$
This equation contains no variable bound to geographic coordinates or physical range. If an attacker can transport the 125 kHz LF magnetic challenge from the vehicle door handle to the key fob, and transport the resulting 433.92 MHz UHF response back to the vehicle, the authentication check outputs 1 (Valid).
Dual-Transceiver Relay Hardware Architecture
A physical relay attack system consists of two distinct electronic transceiver units connected via a high-frequency wireless bridge link: the Initiator Unit (Attacker A) and the Responder Unit (Attacker B).
+-----------------------------------------------------------------------------------+
| VEHICLE LOCATION |
| |
| +--------------+ +--------------------------------------+ |
| | Vehicle Door | | INITIATOR UNIT (Attacker A) | |
| | Handle Antenna | | |
| | (125 kHz LF) | | [125 kHz LF Receiver Coil] | |
| +-------+------+ | | | |
| | | v | |
| | 125 kHz LF | [Low-Noise Amplifier & Demodulator] | |
| | Inductive Field | | | |
| v (1.5m limit) | v | |
| +-------+------+ | [2.4 GHz / 5.8 GHz RF Transmitter] | |
| | Attacker A | +------------------+-------------------+ |
| | Antenna Coil | | |
+--+--------------+----------------------------------|------------------------------+
|
| 2.4 GHz / 5.8 GHz
| Secondary Relay Link
| (100 - 300 Metres)
v
+-----------------------------------------------------------------------------------+
| VICTIM RESIDENCE / DISTANT LOCATION |
| |
| +--------------+ +--------------------------------------+ |
| | Attacker B | | RESPONDER UNIT (Attacker B) | |
| | Coil Driver | | | |
| +-------+------+ | [2.4 GHz / 5.8 GHz RF Receiver] | |
| | | | | |
| | Re-synthesized | v | |
| | 125 kHz LF Field | [125 kHz Power Amp Coil Driver] | |
| v (1.5m to key fob) | | | |
| +-------+------+ | +-------------------------+ |
| | Victim Key | | | |
| | Fob | | | |
| +-------+------+ +--------------------------------------+ |
| | |
| | 433.92 MHz UHF Response Payload |
| | (Transmitted by key fob upon receiving relayed LF challenge) |
| v |
| +-----------------------------------------------------------------------------+ |
| | DIRECT UHF RETURN PATH (If within 50-100m) | |
| | OR SECONDARY UHF RELAY LINK BACK TO ATTACKER A | |
| +-----------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------+Initiator Unit (Attacker A - Vehicle Side)
The Initiator unit is held within 0.5 to 1.0 metres of the vehicle door handle. When the handle is pulled, the Initiator unit detects the 125 kHz magnetic pulse.
- LF Pick-up Antenna: A high-Q resonant ferrite core inductor tuned to 125 kHz ($L = 1.0\text{ mH}$, $C = 1.62\text{ nF}$).
- Analog Front-End (AFE): A low-noise bandpass preamplifier stage followed by an envelope detector or direct digital sampler.
- Bridge Transmitter: A high-frequency radio module operating on an unlicensed ISM frequency band (such as 2.4 GHz or 5.8 GHz) or custom ultra-wideband link. The 125 kHz demodulated baseband data (or upconverted carrier) is modulated onto the 2.4 GHz carrier using FSK or PSK.
Responder Unit (Attacker B - Key Fob Side)
The Responder unit is placed near the physical location of the target key fob (for example, held near a building front window, outer wall, or apartment entry door).
- Bridge Receiver: Captures the 2.4 GHz high-frequency relay stream from Attacker A.
- LF Power Driver: Feeds the recovered baseband signal into a push-pull H-bridge coil driver circuit operating at high peak voltage (typically 12 V to 24 V DC supply).
- High-Power LF Transmitting Coil: A large air-core loop or multi-turn ferrite rod antenna designed to project an amplified 125 kHz magnetic field.
While the original vehicle LF antenna emits a low-power field designed to attenuate within 1.5 metres, the Responder unit coil amplifier can generate a magnetic field strength of over 120 dBµA/m, forcing the victim key fob to wake up even if it is positioned 3 to 5 metres away from Attacker B inside a hallway or drawer.
Analog Relaying vs Digital Decode-and-Forward
Relay attack architectures fall into two primary technical implementation categories: Analog Heterodyne Relaying and Digital Decode-and-Forward Relaying.
ANALOG HETERODYNE RELAY:
125 kHz LF Signal ---> Up-mixer (125 kHz -> 2.4 GHz) ---> RF Amp ---> [AIR]
|
125 kHz LF Signal <--- Down-mixer (2.4 GHz -> 125 kHz) <--- LNA <-------+
(Preserves exact analog timing waveforms, zero baseband decoding required)
DIGITAL DECODE-AND-FORWARD RELAY:
125 kHz LF Signal ---> ASK Demodulator ---> UART/SPI ---> 2.4 GHz Packetizer ---> [AIR]
|
125 kHz LF Field <--- 125 kHz Modulation Generator <--- UART/SPI <--- RX Packet <--+
(Decodes bits into digital memory buffers before re-transmitting)Analog Heterodyne Relaying
The 125 kHz LF analog waveform is directly mixed (heterodyned) up to a higher RF band (such as 2.4 GHz or 5.8 GHz) without decoding the underlying digital bits:
$$f_{\text{relay}} = f_{\text{carrier}} + f_{\text{LF}} = 2,400,000\text{ kHz} + 125\text{ kHz} = 2,400,125\text{ kHz}$$
At the Responder unit, the high-frequency RF signal is down-mixed back to 125 kHz and amplified to drive the output coil.
Advantages:
- Near-Zero Latency: Group delay through mixer, filter, and amplifier stages is governed by passive component phase delay and RF propagation speed, accumulating less than 1 microsecond ($< 1\text{ }\mu\text{s}$) total hardware latency.
- Protocol Agnostic: Functionally independent of LF bit rate, Manchester encoding variants, or proprietary preamble structures.
Digital Decode-and-Forward Relaying
The Initiator unit demodulates the 125 kHz ASK/OOK signal into a raw digital bitstream, packs the bits into digital network frames, transmits the frames over a standard wireless protocol (such as Wi-Fi or custom 2.4 GHz Nordic nRF24L01+ packets), and regenerates the 125 kHz ASK waveform using a local signal generator at the Responder unit.
Advantages:
- Noise Immunity: Digital error checking eliminates background ambient RF noise accumulation over the 2.4 GHz link.
- Selectivity: Allows filtering and payload inspection prior to re-transmission.
Disadvantages:
- Processing Latency: Microcontroller packetization, buffering, and RF frame preamble insertion introduce fixed processing delays between 2 milliseconds and 15 milliseconds.
3. Challenge-Response Cryptographic Limitations
A common misconception regarding keyless vehicle theft is that the attack relies on weak or broken cryptographic ciphers. While early transponder systems from the late 1990s used vulnerable proprietary ciphers (such as Keeloq 66-bit, Hitag2 48-bit LFSR, or Texas Instruments DST40 40-bit cipher), modern PKES systems utilize standard AES-128 symmetric encryption.
The success of a relay attack is independent of the cipher security margin. The attack operates entirely at Layer 1 (Physical Layer) of the OSI model, rendering higher-layer cryptographic protections transparent.
+-------------------------------------------------------------------+
| OSI LAYER ABSTRACTION IN RELAY ATTACKS |
+-------------------------------------------------------------------+
| Layer 7: Application | Vehicle Unlock Command (Evaluated by BCM) |
| Layer 6: Presentation | AES-128 MAC Authentication Payload |
| Layer 3-5: Session/Net| Challenge-Response RAND / Counter State |
+-----------------------+-------------------------------------------+
| Layer 1-2: Physical/ | 125 kHz LF Magnetic Field & |
| Data Link | 433.92 MHz UHF RF Signals |
| | *** EXTENDED VIA PHYSICAL RELAY LINK *** |
+-------------------------------------------------------------------+Cryptographic Invariants and Relayed Execution
Consider the execution flow of the AES-128 authentication handshake during a relay attack:
Vehicle BCM Initiator / Responder Key Fob
| | |
|--- 1. Pull Door Handle --------------->| |
| | |
|--- 2. 125 kHz LF Challenge ---------->| |
| RAND = 0x8F92A13B4E... |=== 3. Relay 2.4 GHz Bridge ===========>|
| | (Latency delay: +1.2 us) |
| | |
| |--- 4. Re-transmit 125 kHz LF -------->|
| | RAND = 0x8F92A13B4E... |
| | |
| | | 5. Execute AES-128:
| | | Resp = AES_K(RAND)
| | |
|<======================================|=== 6. 433.92 MHz UHF Response ---------|
| Resp = 0x3C71F9... | Resp = 0x3C71F9... |
| | |
| 7. Validate: | |
| AES_K(RAND) == Resp | |
| RESULT: TRUE | |
v v v
[DOOR UNLOCKED]At Step 5, the key fob receives a bit-for-bit identical challenge vector ($\text{RAND}$). It reads its internal secret key $K_{\text{secret}}$ from secure storage and computes:
$$\text{MAC}{\text{fob}} = \text{AES-128-ECB}(K{\text{secret}}, \text{RAND})$$
Because $K_{\text{secret}}$ is unmodified and $\text{RAND}$ is identical to the challenge generated by the BCM, $\text{MAC}{\text{fob}}$ is mathematically valid. When the BCM receives $\text{MAC}{\text{fob}}$ at Step 7, its internal calculation confirms equivalence:
$$\text{MAC}{\text{BCM}} \equiv \text{MAC}{\text{fob}}$$
The cryptographic protocol operates correctly. The system fails because the protocol design equates cryptographic validity with local physical presence.
Protocol Timeout Windows in Legacy BCM Firmware
Why do BCM state machines accept relayed authentication responses despite the additional propagation time over the relay link?
In legacy BCM implementation code, the software state machine enforces a global timeout parameter ($\Delta t_{\text{timeout}}$) between transmitting the LF challenge frame and receiving the complete UHF response packet. This timeout compensates for worst-case hardware variations:
- Microcontroller wake-up latency from deep sleep (< 1 µs to 5 ms).
- Key fob Automatic Gain Control (AGC) settling time.
- FSK carrier frequency acquisition and clock synchronization.
- RF re-transmissions caused by transient environmental noise.
A representative C implementation of a legacy vehicle BCM challenge-response authentication routine illustrates this window:
/* Legacy BCM Authentication Function (Vulnerable to Relay Delay) */
typedef enum { AUTH_FAILED = 0, AUTH_SUCCESS = 1 } AuthStatus_t;
#define MAX_AUTHENTICATION_TIMEOUT_MS 100 /* 100 ms global window */
AuthStatus_t BCM_AuthenticateDoorUnlock(uint8_t door_id) {
uint8_t rand_challenge[16];
uint8_t received_response[16];
uint8_t expected_response[16];
uint32_t start_timestamp_ms;
/* 1. Generate 128-bit hardware random challenge */
HRNG_GenerateBytes(rand_challenge, 16);
/* 2. Record start timestamp */
start_timestamp_ms = System_GetTickCountMs();
/* 3. Transmit 125 kHz LF Challenge Frame via Door Antenna Driver */
LF_Driver_TransmitFrame(door_id, rand_challenge, 16);
/* 4. Poll UHF Receiver buffer until packet arrives or timeout expires */
while ((System_GetTickCountMs() - start_timestamp_ms) < MAX_AUTHENTICATION_TIMEOUT_MS) {
if (UHF_Receiver_IsPacketAvailable()) {
UHF_Receiver_ReadPayload(received_response, 16);
/* Compute expected MAC using vehicle stored secret key */
AES128_Encrypt(rand_challenge, VEHICLE_SECRET_KEY, expected_response);
/* Verify cryptographic match */
if (memcmp(received_response, expected_response, 16) == 0) {
return AUTH_SUCCESS; /* Unlocks vehicle door */
} else {
return AUTH_FAILED; /* MAC mismatch */
}
}
}
return AUTH_FAILED; /* Timeout expired */
}In this system, the timeout window (MAX_AUTHENTICATION_TIMEOUT_MS) is set to 100 milliseconds.
An analog heterodyne relay system introduces less than 10 microseconds ($0.01\text{ ms}$) of propagation delay. Even a digital decode-and-forward relay link operating over Wi-Fi introduces only 5 to 15 milliseconds of latency. Because $15\text{ ms} \ll 100\text{ ms}$, the relayed transaction finishes inside the accepted window.
4. Time-of-Flight (ToF) and Distance-Bounding Defenses
To eliminate relay vulnerabilities, modern automotive architectures rely on physical distance measurement using physical bounds that cannot be accelerated by an external circuit: the speed of light.
According to special relativity and classical electromagnetics, radio signals propagate through air at approximately the speed of light in a vacuum ($c \approx 299,792,458\text{ m/s}$, or roughly $0.3\text{ metres per nanosecond}$).
Distance-Bounding Mathematical Principles
In a distance-bounding protocol, the verifier (Vehicle BCM) measures the exact Round-Trip Time (RTT) of an RF challenge-response sequence to calculate an upper bound on the physical distance ($d$) separating it from the prover (Key Fob):
$$d \le \frac{c \cdot (t_{\text{RTT}} - t_{\text{processing}})}{2}$$
where:
- $t_{\text{RTT}}$ is the total elapsed time measured by the vehicle clock between sending the challenge pulse and receiving the response pulse.
- $t_{\text{processing}}$ is the fixed, deterministic execution delay spent by the key fob hardware processing the challenge.
- $c$ is the speed of light ($3 \times 10^8\text{ m/s}$).
Vehicle (Verifier) Key Fob (Prover)
| |
|--- Send Challenge Pulse (t_start) ------------------------------->|
| |
| | [Hardware Delay: t_proc]
| |
|<-- Send Response Pulse (t_stop) ----------------------------------|
|
Calculates: t_RTT = t_stop - t_start
Distance: d = c * (t_RTT - t_proc) / 2If an attacker intercepts the challenge and relays it over a secondary wireless link of physical length $L_{\text{relay}} = 100\text{ metres}$, the extra distance traversed by the radio signal is $2 \times L_{\text{relay}} = 200\text{ metres}$. The minimal physical propagation delay added by this path is:
$$\Delta t_{\text{relay}} = \frac{200\text{ m}}{3 \times 10^8\text{ m/s}} = 667.12\text{ nanoseconds}$$
To enforce a strict physical proximity boundary of $d \le 1.5\text{ metres}$, the vehicle must verify that:
$$t_{\text{RTT}} - t_{\text{processing}} \le \frac{2 \cdot 1.5\text{ m}}{3 \times 10^8\text{ m/s}} = 10.0\text{ nanoseconds}$$
If $t_{\text{RTT}} - t_{\text{processing}} > 10.0\text{ ns}$, the vehicle rejects the authentication attempt, regardless of whether the cryptographic MAC is valid.
Ultra-Wideband (UWB) IEEE 802.15.4z Architecture
Traditional narrowband signals operating at 125 kHz or 433 MHz cannot achieve nanosecond-level time resolution. A 433 MHz carrier wave has a frequency period of:
$$T = \frac{1}{433.92 \times 10^6\text{ Hz}} \approx 2.3\text{ nanoseconds}$$
Because narrowband modulation envelope rise times span several carrier cycles (often 100 ns to 1 µs), multipath reflections off walls, ground, and metallic structures distort the leading edge of the received waveform. Receiver energy detectors cannot reliably isolate the direct line-of-sight path from reflected waves.
To resolve this limitation, modern automotive architectures implement Ultra-Wideband (UWB) impulse radios adhering to the IEEE 802.15.4z standard.
NARROWBAND WAVEFORM (433 MHz):
Signal Envelope: /-------------------\
/ \
Carrier Wave: /|/|/|/|/|/|/|/|/|/|/|/|\
0 100 ns -> Poor edge resolution
UWB IMPULSE WAVEFORM (IEEE 802.15.4z):
Short RF Pulses: || || || ||
Width: ~2 ns -- -- -- --
Bandwidth: > 500 MHz -> Sub-nanosecond leading-edge timestampingUWB transmits ultra-short RF pulses with pulse durations on the order of 2 nanoseconds across wide frequency channels (typically Channel 5 at 6.4896 GHz or Channel 9 at 7.9872 GHz with a channel bandwidth of 499.2 MHz).
According to the Fourier transform principle, a signal with a narrow pulse width in the time domain ($\Delta t \approx 2\text{ ns}$) expands across a broad spectrum in the frequency domain ($\Delta f \ge 500\text{ MHz}$).
This short duration enables the receiver High-Speed Analog-to-Digital Converter (ADC) and Leading-Edge Detection (LED) algorithms to isolate the direct line-of-sight signal arrival time from secondary multipath reflections.
Amplitude
^
| Direct Path Signal (First Arrival)
| t = 3.2 ns
| |
| +|+ Multipath Reflection 1 (Ground)
| | | t = 8.1 ns
| | | |
| | | +|+ Multipath Reflection 2 (Wall)
| | | | | t = 14.5 ns
| | | | | |
+--+-+--------------+-+-------------+---------+---> Time (ns)
| Threshold MarkerScrambled Timestamp Sequence (STS)
Early UWB specifications were susceptible to Physical Layer Preamble Injection Attacks (such as Cicada attacks or Preamble Injection). An attacker could inject early UWB pulses toward the vehicle receiver, causing the leading-edge detector to register an artificially early arrival timestamp ($t_{\text{stop}}$), counteracting the delay added by the relay bridge.
IEEE 802.15.4z addresses this vulnerability by incorporating a cryptographically generated Scrambled Timestamp Sequence (STS) directly into the UWB PHY packet frame:
+----------------+----------------+-----------------------+--------------------+
| SHR (Preamble) | PHR (Header) | PHY Payload (Data) | STS (Scrambled |
| Sync Pulses | Packet Length | Encrypted Data | Timestamp Sequence)|
| (Unencrypted) | Rate Info | (AES-GCM) | AES-128 PRNG Pulses|
+----------------+----------------+-----------------------+--------------------+The STS field consists of a pseudo-random sequence of BPSK-modulated UWB pulses generated by an AES-128 Pseudo-Random Number Generator (PRNG). The PRNG seed is derived from a shared secret key and a frame counter negotiated during the secure session setup.
- Pulse-level Encryption: The precise spatial polarities and temporal intervals of the STS pulses are unpredictable to an adversary without key access.
- Cross-Correlation Verification: Upon receiving the STS segment, the vehicle UWB transceiver (such as the NXP NCJ29D5 or Qorvo DW3000 series) correlates the digitized incoming RF samples against an internally generated mathematical template of the expected STS pulses.
- Preamble Injection Mitigation: If an attacker attempts to transmit fake early pulses, those pulses will fail the cryptographic cross-correlation check. The receiver discards the corrupted pulse timestamps, preventing physical distance manipulation.
/* Conceptual IEEE 802.15.4z UWB Secure RTT Ranging Engine */
typedef struct {
double distance_meters;
bool proximity_valid;
bool sts_authenticated;
} UWBRangingResult_t;
#define SPEED_OF_LIGHT_MPS 299792458.0
#define MAX_ALLOWED_DISTANCE_M 1.50 /* 1.5m spatial proximity limit */
#define HARDWARE_DELAY_FOB_NS 125.40 /* Calibrated key fob internal delay */
UWBRangingResult_t BCM_EvaluateUWBProximity(uint64_t t_tx_challenge_ps,
uint64_t t_rx_response_ps,
uint32_t correlation_score) {
UWBRangingResult_t result;
double rtt_total_ns;
double tof_net_ns;
/* 1. Verify cryptographic STS correlation threshold */
if (correlation_score < STS_MINIMUM_CORRELATION_THRESHOLD) {
result.sts_authenticated = false;
result.proximity_valid = false;
result.distance_meters = 999.0;
return result; /* STS tamper attempt detected */
}
result.sts_authenticated = true;
/* 2. Calculate raw RTT in nanoseconds (picosecond precision conversion) */
rtt_total_ns = (double)(t_rx_response_ps - t_tx_challenge_ps) / 1000.0;
/* 3. Subtract calibrated key fob hardware processing delay */
tof_net_ns = rtt_total_ns - HARDWARE_DELAY_FOB_NS;
/* 4. Calculate one-way physical distance: d = (c * t_net) / 2 */
result.distance_meters = (SPEED_OF_LIGHT_MPS * (tof_net_ns * 1e-9)) / 2.0;
/* 5. Evaluate strict spatial distance invariant */
if (result.distance_meters <= MAX_ALLOWED_DISTANCE_M && tof_net_ns > 0.0) {
result.proximity_valid = true;
} else {
result.proximity_valid = false; /* Distance exceeds 1.5m -> RELAY DETECTED */
}
return result;
}5. Practical Protection Mechanisms
Until UWB IEEE 802.15.4z hardware reaches universal deployment across all vehicle production lines, vehicle owners and fleet operators rely on physical, firmware, and operational countermeasures to prevent keyless relay theft.
Faraday Shielding (RF Attenuation Physics)
A simple physical countermeasure against PKES relay attacks is isolating the key fob within a conductive enclosure known as a Faraday cage.
Incident 125 kHz Magnetic Field H_inc
===============> +-----------------------------------+
| CONDUCTIVE SHIELD (Copper/Silver) |
| |
| Induced Eddy Currents (J_eddy) |
| <--- Generates Opposing H-Field |
| |
| +---------------------------+ |
| | Key Fob | |
| | (H_internal ≈ 0) | |
| +---------------------------+ |
+-----------------------------------+When an external 125 kHz magnetic field ($H_{\text{inc}}$) encounters a high-conductivity metallic mesh or pouch (e.g., silver-coated nylon or copper foil), eddy currents ($J_{\text{eddy}}$) are induced within the conductive layer. These currents generate a secondary magnetic field opposing the primary incident field, attenuating the signal inside the pouch.
The skin depth ($\delta$) defines the depth at which the incident electromagnetic wave amplitude decays to $1/e$ ($\approx 37%$) of its surface value:
$$\delta = \sqrt{\frac{2}{\omega \mu \sigma}} = \sqrt{\frac{1}{\pi f \mu \sigma}}$$
where:
- $f$ is the frequency ($125,000\text{ Hz}$).
- $\mu$ is the magnetic permeability ($\mu = \mu_0 \mu_r$).
- $\sigma$ is the electrical conductivity of the shield material (Siemens/metre).
Because 125 kHz is a low frequency, the skin depth in non-magnetic conductors (such as aluminum or copper) is significantly thicker than at microwave frequencies ($\delta \approx 0.24\text{ mm}$ for copper at 125 kHz vs $\delta \approx 0.0013\text{ mm}$ at 2.4 GHz). Effective low-frequency Faraday pouches utilize high-permeability, multi-layered metal fabric to achieve field attenuation greater than $-60\text{ dB}$, dropping the incoming 125 kHz field below the sensitivity limit of the key fob receiver.
Motion-Sensing Battery Key Fobs
To reduce reliance on passive Faraday enclosures, automotive OEMs (including BMW, Mercedes-Benz, Audi, and Porsche) incorporate 3-axis Ultra-Low Power MEMS Accelerometers (such as the Bosch BMA400 or STMicroelectronics LIS2DW12) directly onto the key fob printed circuit board.
Key Fob Acceleration Tracking Logic:
[Key Fob In Motion] ---> Accelerometer measures dynamic G-vectors ---> Keep LF Receiver Enabled
|
[Key Fob At Rest] ---> Static G-vector (1.0g gravity only) |
(Placed on table) Duration > 120 seconds v
---> Assert Disable Pin to LF AFE IC ---> [LF Receiver Powered OFF]
Relay Wake-up ImpossibleState Logic
- The MEMS accelerometer continuously monitors motion vectors while drawing under $1.5\text{ }\mu\text{A}$ of current.
- If no dynamic acceleration vectors (outside constant $1.0g$ gravitational force) are registered for a designated interval (typically 120 seconds), the key fob microcontroller enters an inactive sleep state.
- The microcontroller disables power to the 3D LF analog front-end IC.
If an attacker approaches a residence two minutes after the owner sets the key fob down on a hall table, the Initiator unit relay fails: the key fob LF receiver is turned off and ignores the re-transmitted 125 kHz wake-up pulse. The key fob re-enables its LF receiver only when picked up by the user.
Disabling Passive Keyless Entry via Vehicle Configuration
Many modern vehicles permit drivers to deactivate passive entry functions via the infotainment system (MMI/iDrive) or through key fob button combinations.
For instance, on several Japanese vehicle architectures (such as Toyota and Lexus), holding the key fob Lock button while pressing the Unlock button twice turns off the LF receiver transceiver. The key fob LED flashes twice to confirm deactivation.
Disabling passive entry shifts the vehicle back to standard Remote Keyless Entry (RKE) operation. To open the car, the driver must press a button on the fob, forcing manual interaction and rendering physical relay range extension ineffective.
6. Vulnerability Comparison Matrix
The following matrix compares common keyless access vulnerabilities, operational mechanisms, root causes, and primary engineering mitigations across automotive generations:
| Vulnerability Vector | Frequency Bands | Primary Exploitation Mechanism | Cryptographic Status | Primary Engineering Mitigation |
|---|---|---|---|---|
| PKES Relay Attack | 125 kHz (LF) / 433 MHz (UHF) | Physical range extension of magnetic field via dual-transceiver RF bridge link. | Cryptography Valid (AES-128 MAC matches). | UWB IEEE 802.15.4z Scrambled Timestamp Sequence (STS) RTT Distance Bounding. |
| Rolling Code RollJam | 433.92 MHz / 868.3 MHz | Dual-radio jam-and-capture of RKE button presses to store unspent rolling code sequence counters. | Cryptography Bypassed (Valid past codes captured & replayed). | Dual-band simultaneous transmission; time-stamped counter validity windows. |
| Transponder Cipher State Recovery | 125 kHz (LF) | Mathematical cryptanalysis of weak proprietary ciphers (e.g. Hitag2 48-bit LFSR state recovery via sniffed traces). | Cryptography Broken (48-bit key recovered via algebraic attack). | Migration to standardized AES-128 / ECC public-key transponder chips. |
| OBD-II Key Programming | ISO 15765 CAN Bus | Direct memory access via diagnostic port to bypass IMMO and write new transponder keys to ECU EEPROM. | Authentication Defeated (Diagnostic session privileged escalation). | Secure Boot, CAN FD SecOC (Secure Onboard Communication), AUTOSAR MAC verification. |
| CAN Injection Attack | High-Speed CAN (500 kbps) | Physical access to exterior headlight/bumper CAN bus wires; injection of fake Unlock CAN frames to BCM. |
Protocol Lacks Integrity (Unauthenticated bus messages). | Hardware Cryptographic Transceivers (SecOC); ECU gateway isolation of exterior nodes. |
7. Protocol Sequence & Hardware Timings
The following structural diagram details the exact frame structures, frequency shifts, and hardware execution phases of an active relay attack sequence versus an UWB distance-bounded sequence:
VULNERABLE LEGACY PKES RELAY SEQUENCE:
Vehicle (BCM) Initiator (Attacker A) Responder (Attacker B) Victim Key Fob
| | | |
|-- Door Handle Pulled ---------->| | |
| | | |
|-- 125 kHz LF Challenge -------->| | |
| (ASK Modulation, 2 kbps) | | |
| RAND = 128 bits |=== 2.4 GHz Relay Link ===>| |
| | (FSK, 2 Mbps) | |
| | Added Delay: ~10 us |-- 125 kHz LF Re-transmission -->|
| | | (Amplified H-Field) |
| | | RAND = 128 bits |
| | | |
| | | |-- Compute AES-128
| | | | MAC = AES_K(RAND)
| | | |
|<==============================================================================================|-- 433.92 MHz UHF Response
| MAC Payload Received | | | (Direct RF Return Path)
| Total Elapsed Time: 18.2 ms | | |
| Window Limit: 100.0 ms | | |
| | | |
|-- [VERIFICATION SUCCESS] ------->| | |
| Locks Disengaged | | |
v v v v
SECURE UWB IEEE 802.15.4z DISTANCE-BOUNDING SEQUENCE:
Vehicle (UWB Transceiver) Initiator (Attacker A) Responder (Attacker B) Victim Key Fob
| | | |
|-- Door Handle Pulled ---------->| | |
| | | |
|-- Send UWB Pulse (t_tx) -------->| | |
| (Center Freq: 7.98 GHz) |=== 2.4 GHz Relay Link ===>| |
| Width: 2 ns | Added Delay: 667 ns |-- Transmit Relayed Pulse ------>|
| | | |
| | | |-- Processing Delay
| | | | t_proc = 125.4 ns
| | | |
|<==============================================================================================|-- Transmit UWB Response
| Received Pulse at t_rx | | | Contains Encrypted STS
| Measured RTT = 794.4 ns | | |
| Net ToF = 794.4 - 125.4 | | |
| Net ToF = 669.0 ns | | |
| | | |
| Distance = (c * ToF) / 2 | | |
| Calculated Dist = 100.35m | | |
| | | |
|-- [DISTANCE BOUND VIOLATED] ---->| | |
| Req: <= 1.5m, Measured: 100.35m| | |
| RESULT: AUTHENTICATION REJECTED| | |
v v v vBy binding physical authentication state to the invariant speed of light through Ultra-Wideband impulse timing, distance-bounding protocol architectures eliminate the vulnerability that has enabled physical keyless entry relay theft.