Hacker News Reader

Comment by ghaff | Hacker News Reader

> it should be absolutely trivial to detect how far away the key is based on the response time

Is that true? Accurate, very low power distance detection has a lot of potential applications (e.g. your phone straying too far away) but BLE (for example) doesn't really work for measuring distance--through signal strength--at all. If it's possible, I'd be very curious how to build such a distance detector.

View on HN

I think the timing method relies on a challenge response. In short, one side sends something and the other side expects a reply within some amount of time.

If you just simply add distance to the system with no additional overhead. The time it takes for the ack should go up in a measurable amount of time.

And if you did anything more -- like some of the system do today -- where they make a generic pipe that pipes it over the internet via LTE and back -- then for sure we would have a ack way out of the time tolerance.

Method 1

(car){signal amplifier}<-------->{signal amplifier}(keyfob)

Method 2

(car){transceiver}[LTE]<-------->[LTE]{transceiver}(keyfob)

To my knowledge most of these systems work but using some sort of out of band transmission over other wireless means such as WIFI/LTE/or simply another band.

The second method they use has to do with rolling codes. Where they jam the signal and intercept your keyfob code, preventing it from reaching the car. They store this and when the target realizes they did not actually lock/unlock they car they attempt to unlock it again. This time they jam the signal from the keyfob to the car, but replay the code they intercepted the first time, and saving the last code sent from the keyfob for later when the target is not around. This method works for more than just cars, it can be used for most rolling code systems.

Apparently UWB [1] is being touted as the solution to determining indoor location given that BLE and WiFi based on signal strength don't really work well. But development is still ongoing.

[1] https://locatify.com/blog/in-practice-precise-indoor-locatio...

I used some Decawave UWB hardware years ago and even in somewhat complicated environments (though walls, multipath, other RF stuff going on) they were accurate within 5-10%.

If you are processing data with nanosecond precision(which is not difficult with modern microchips) then you can tell the distance to the key by just measuring the number of nanoseconds elapsed since the request was sent(accounting for amount of time taken to calculate the response). If you can measure the time in nanoseconds that's good enough to tell the difference between the key being 1m and 10m away.

What about reflections?

I think that assumes that all the processing the key fob does internally is reliable constant-time down to the nanosecond. I don't know if that's true but my first guess is that it's doubtful.

Well, those chips are designed for this one purpose and nothing else - it should be possible to design them in such a way that the encryption/decryption process always ends in constant time.

Keep in mind that amplitude of signal is cut by four as the distance doubles. Elapsed time is linear with distance.

Most of these automotive chips only have timing accuracy of microseconds

I know how the mechanism would work. I am just not aware of what hardware would be needed to support this type of digital tether using only a small battery for perhaps a year.

Reply on news.ycombinator.com