Cryptanalysis of KeeLoq with COPACOBANA

Martin Novotný1,2, Timo Kasper1

1Horst Görtz Institute for IT-Security Ruhr University Bochum

2Faculty of Information Technology Czech Technical University in Prague Case Study Access Control

Simple access controls: fixed code (“password”)

code

eavesdropper duplicates key (cloning)

but the industry learned… Case Study Access Control advanced theft control: rolling code

code = ek(ni) rolling code (or hopping code) e () is often a code = e (n) k k block cipher code = ek(n+1) code = ek(n+2) …. KeeLoq HoIpNpCRinEMgE CNToSde GeneCOraNtSiToAnNT

Synchronization Counter Discrimination Value Func

32

Device 64 KEELOQ Key encryption Derived from Manufacturer Key 32

Hopping Code So what can we do now?

If we have access to a remote Recover device key and clone the device

People usually do not lend their keys to unknown people

In a shop If we have access to a receiver Recover manufacturer key and generate new remotes Identical for all GGaarraaggeeOOppeenneerrss22000000 and corresponding remotes Device Key Derivation

Serial Number / SEED

32 32 Manufacturer KEELOQ Key KEELOQ decryption/ decryption/ /XOR 64 64 XOR

32 32

Device Key MS 32 bits Device Key LS 32 bits So what can we do now?

After extracting of manufacturing key: Remotely eavesdrop on 1-2 communications & clone key!

Serial Number, KeeLoq(n+1) Device Key Derivation

0h SSNe r–ia 1l 2n ubmbSeer r–i a2Sl8 SeN bEruiiaEtmslD nSb u–Eem Er6 bD0/ e Sb–rSiE tE4sE8E DDbi t–s 32 bits scheme #1234

Sniffed from communicatio 32 32 n Manufacturer KEELOQ Key KEELOQ decryption/ decryption/ /XOR 64 64 XOR Retrieve d via 32 DPA 32

Device Key MS 32 bits Device Key LS 32 bits

2P12r68e cccaaonnmddpididuaatedttee vvinaa lulSueeWs 2P3r2e ccaonmpdiduatteed vina lSueWs KeeLoq Cracker KeeLoq Cracker

2 (consecutive) hopping codes sniffe d Hopping Code #1 Hopping Code #2

KEELOQ Device Key KEELOQ decryption Generator decryption

Counter1 Discrim1 F1 Counter2 Discrim1 F2

(Counter2 – Counter1) < 7 ? Discrim1F1 == Discrim2F2 ?

KEY CANDIDATE Device Key Derivation

0h SSNe r–ia 1l 2n ubmbSeer r–i a2Sl8 SeN bEruiiaEtmslD nSb u–Eem Er6 bD0/ e Sb–rSiE tE4sE8E DDbi t–s 32 bits scheme #1234

32 32 Manufacturer KEELOQ Key KEELOQ decryption/ decryption/ /XOR 64 64 /XOR

32 32

Device Key MS 32 bits Device Key LS 32 bits

Precomputed in SW P(r2e1268c coamndpiduattede v ainlu eSsW) PGreecnoempratuetde din i nH SWW KeeLoq Cracker

Hopping Code #1 Hopping Code #2

KEELOQ Device Key KEELOQ decryption Generator decryption

Counter1 Discrim1 F1 Counter2 Discrim1 F2

(Counter2 – Counter1) < 7 ? Discrim1F1 == Discrim2F2 ?

KEY CANDIDATE Device Key Generator

Host computer

32

32 bit register 32 bit counter

64 KeeLoq Cracker

Hopping Code #1 Hopping Code #2

KEELOQ Device Key KEELOQ decryption Generator decryption

Counter1 Discrim1 F1 Counter2 Discrim1 F2

(Counter2 – Counter1) < 7 ? Discrim1F1 == Discrim2F2 ?

KEY CANDIDATE KeeLoq – The Algorithm

State Registe,ry 7 3 2 42 0 1 1 0 1 0

NLF

XOR

Key Registe,r k 7 6 5 4 3 2 1 0 0

64 bit key, 32 bit block length NLFSR comprising a 5x1 non-linear function Simple key management: key is constantly rotated 528 rounds, each round one key bit is read  Lightweight cipher – cheap and efficient in hardware KeeLoq Encryption

• 32 bit block length, 64 bit key • NLFSR comprising a 5x1 non-linear function • Simple key management: key is constantly rotated • 528 rounds, each round one key bit is read  Lightweight cipher – cheap and efficient in hardware

source: Wikipedia KeeLoq Decryption

like encryption, but in reverse order 

source: Wikipedia KeeLoq Decryption

32 bit state

NLF

64 bit key KeeLoq Decryption

32 bit state 64 bit key

NLF KeeLoq Decryption

32 bit state 64 bit key

NLF KeeLoq Decryption

32 bit state 64 bit key

NLF KeeLoq Decryption

32 bit state 64 bit key

NLF Unrolled KeeLoq Decryption

32 bit state 64 bit key

NLF Unrolled KeeLoq Decryption

32 bit state 64 bit key

NLF … … … … Unrolled KeeLoq Decryption

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF Unrolled KeeLoq Decryption

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF … … … … Unrolled KeeLoq Decryption

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF Unrolled KeeLoq Decryption

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF … … … … Unrolled KeeLoq Decryption

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF 528 x … … … …

32 bit state 64 bit key

NLF … … … … Unrolled KeeLoq Decryption

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF 528 x … … … … th 32 bit state each 464 briot kueny d registered NLF … … … … Unrolled KeeLoq Decryption

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF … … … … Unrolled KeeLoq Decryption

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF … … … …

32 bit state 64 bit key

NLF … … … … unrolled decrypter KeeLoq Cracker with 132 pipeline stages

Hopping Code #1 Hopping Code #2

KEELOQ Device Key KEELOQ decryption Generator decryption

Counter1 Discrim1 F1 Counter2 Discrim1 F2

(Counter2 – Counter1) < 7 ? Discrim1F1 == Discrim2F2 ?

KEY CANDIDATE Results

fmax = 110 MHz 110 million keys/s verified in 1 FPGA Spartan 3-1000

32 bit seed: 39 seconds / 1 FPGA 48 bit seed: 5.9 hours / 1 COPACOBANA 60 bit seed: 1011 days / 1 COPACOBANA