There are plenty of offline hardware based solutions already on the market especially for unlocking computers with MFA. It needs to be offline generation for computers for NIST DFARS 800-171 compliance.
Not necessarily. Relay attacks are very hard to defeat, regardless of your crypto scheme:
https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can...
Is there any reason a challenge/response protocol with proper timing filtering isn't safe against relay attacks?
Yes, you can do this. I have done this (restricted the negotiation to about 12 meters)--you're essentially racing the speed of light, see DE102012104955A1. Most of the reasonable approaches are patented by NXP.
Signals from an RFID device don't travel very far. So, (here's the error) if the keys can receive and respond to a signal from the car they must be very close to the car.
But signals can be relayed. Crook A stands next to your car. Crook B walks up to your front door.
Crook B is relying on the fact that most people leave their car keys on a key hook, or in a bowl, or maybe even in their outside jacket, which they leave by the door because that's convenient. You have done this.
The car is sending radio pulses. "Hey, are you my key?". Crook A has a relay transceiver, it doesn't need to understand this pulse, just relay it to Crook B. Crook B has another transceiver, and when it says "Hey, are you my key?" the key, on the far side of a locked front door, says "Yes! I'm the right key, see! 023483109" and Crook B's transceiver sends that right back to Crook A. "Yes! I'm the right key, see! 023483109" the one-time code from the key matches, the car unlocks. Crook A gets into the car and starts it. Crook B walks over and gets into the passenger seat.
In a few seconds the car will discover that the key, which was apparently right there, has somehow vanished. But for safety reasons it is unsafe to suddenly lock everything and shut off. The thieves will ensure that by the time it decides it would be safe to lock itself, it's inside a chop shop and that's too late.
So no, the attacker doesn't "have" the key, they just need to be able to stand relatively close to it.
Otherwise the attack seems arbitrary. If my key keeping bowl at home physical security is compromised I have someone in my house.
I generally dont leave my keys out anyway, but a nefarious plumber/home contractor could potentially gain access.
- superglue and baking soda in the lock tumblers
- 10 lbs / 4.5 kg of sugar in the gas tank
- pulling the fuel pump relays and spark plug wires
- unhooking the starter positive solenoid wire
- slashing the tires' sidewalls so they can't be repaired.
DoS complete. :) Maybe a swift kick in the bumper to set off the alarm at that point. ;)