undefined | Better HN

0 pointsfc417fc8027mo ago0 comments

That isn't the problem, at least not the major one that lead to this discussion. It's that the algorithm used is broken. It's example number 9001 of why you should never roll your own crypto for a commercial application. (Amusingly example 9002, TETRA radios, was also on the HN frontpage around the same time).

0 comments

the_mitsuhiko7mo ago

First of all they did not roll their own crypto, it's just not the most modern crypto any more. Secondly while this particular permutation of the issue is related to bad crypto, it's cascading a completely different issue which is that it's just fundamentally possible to pair a key with physical access which is easy to get.

fc417fc802OP7mo ago

From Wikipedia:

> KeeLoq is a proprietary hardware-dedicated block cipher that uses a non-linear feedback shift register (NLFSR).

Pretty much any proprietary encryption algorithm is going to qualify as "rolling your own".

"Not the most modern" is a gross understatement.

I can forgive the original authors since it dates to the 1980s and AES wasn't standardized until 2001. (Only just barely though given that DES dates to 1977.) I can't forgive vehicle manufacturers that are _still_ using it (or things significantly like it) 25 years later.

I hope that products manufactured post 2005 use strong publicly available cryptography. After 2010 I fully expect it. After 2015 I view any failure in that regard as gross negligence that ought to be legally actionable.

> it's just fundamentally possible to pair a key with physical access which is easy to get.

I don't follow?

the_mitsuhiko7mo ago

> Pretty much any proprietary encryption algorithm is going to qualify as "rolling your own".

It came out of a university and was acquired.

> I hope that products manufactured post 2005 use strong publicly available cryptography.

A lot of the challenges are related to key pairing and relaying of wireless information in combating with jamming. It’s a tricky thing to secure given the circumstances.

> I don't follow?

Cars stand around 99% of the time and easy to get into. pairing protocols assume that physical access is restricted / not possible. That’s why it’s so much harder to secure car key pairing. What would make it more secure is delegating the security to a remote service which is secured. Eg: what Tesla does with their keys.

1 more reply

j / k navigate · click thread line to collapse

0 comments

the_mitsuhiko7mo ago

fc417fc802OP7mo ago

From Wikipedia:

> KeeLoq is a proprietary hardware-dedicated block cipher that uses a non-linear feedback shift register (NLFSR).

Pretty much any proprietary encryption algorithm is going to qualify as "rolling your own".

"Not the most modern" is a gross understatement.

> it's just fundamentally possible to pair a key with physical access which is easy to get.

I don't follow?

the_mitsuhiko7mo ago

> Pretty much any proprietary encryption algorithm is going to qualify as "rolling your own".

It came out of a university and was acquired.

> I hope that products manufactured post 2005 use strong publicly available cryptography.

A lot of the challenges are related to key pairing and relaying of wireless information in combating with jamming. It’s a tricky thing to secure given the circumstances.

> I don't follow?

1 more reply

j / k navigate · click thread line to collapse