Rolling code

A rolling code (or sometimes called a hopping code) is used in keyless entry systems to prevent replay attacks, where an eavesdropper records the transmission and replays it at a later time to cause the receiver to 'unlock'.

Such systems are typical in garage door openers and keyless car entry systems. The most widely spread algorithm for code hopping systems today is KeeLoq.^{[citation needed]}

Techniques

Common PRNG (Pseudo Random Number Generator) — preferably cryptographically secure — in both transmitter and receiver
Transmitter sends 'next' code in sequence
Receiver compares 'next' to its calculated 'next' code.
A typical implementation compares within the next 256 codes in case receiver missed some transmitted keypresses.

Application in RF Remote Control

A rolling code transmitter is useful in a security system for providing secure encrypted radio frequency (RF) transmission comprising an interleaved trinary bit fixed code and rolling code. A receiver demodulates the encrypted RF transmission and recovers the fixed code and rolling code. Upon comparison of the fixed and rolling codes with stored codes and determining that the signal has emanated from an authorized transmitter, a signal is generated to actuate an electric motor to open or close a movable component.

Rolling code vs. fixed code RF remote control

this is a typical inner photo of audi a6 car keyless entry remote, which uses rolling-code technology chip HCS301 to enhance transmission security.

Remote controls send signals in code. When the sending code is the same as the code which is expected by the receiver, then the receiver will actuate the relay, unlock the door, or open the barrier. Remote controls with a fixed code always send the same fixed code. Remote controls with a rolling code (or hopping code) always send out a different code from the one previously sent.

Typical Rolling code System - Keeloq

Microchip HCS301 is once the most widely used system on garage and gate remote control and receivers, for example, BFT / ATA / Nice all employs HCS301 keeloq system to encode the transmitter data, we can see the HCS301 keeloq system has 66 data bits which consists of 32 bit serial number and 32 bit rolling data, and other 2 bits are used for additional data on oscilloscope.^[1]

References

^ "HCS301 Rolling Code Remote Control on Oscilloscope" Solidremote Blogs

External links

How Remote Entry Works; cites successful attack on KeeLoq.
Atmel Inc.'s application note AVR411

[1] "HCS301 Rolling Code Remote Control on Oscilloscope" Solidremote Blogs

[1]