Hacker News Reader

Fully baking an individualized key into each car is certainly possible, but would require exquisite record keeping and distribution to allow dealers to create new keys to replace lost keys. So instead the individual code is generated based on some information about the car.

View on HN

Why not both fully unique and based on information of the car? I could easily imagine a system where [one-way algorithm X] is used to transform the car's VIN into a good cryptographic key, and the dealers then just use some piece of software to program a blank fob with the appropriate key. Done correctly, it would be extraordinarily difficult to reverse engineer.

That's what it sounds like they do just with an added secret. They have some function which maps VINs to key-codes. Just doing that though doesn't prevent someone from uncapping whatever processor is used to do that mapping and then everything is broken. So doing that is still relying on obscurity of the mapping function and isn't any better. Hashes aren't meant to be cryptographically secure, they're meant to protect against corruption.

I don't think such record keeping qualifies as "exquisite" these days, more like trivial. If Apple can store all relevant info for checking the warranty and unlock status of every iPhone they sell, a car manufacturer can pull it off without too much trouble.

Reply on news.ycombinator.com