'Thiefproof' car key cracked
Researchers have discovered cryptographic vulnerabilities in the RFID technology used in high-security car keys and petrol pump payment systems. The attack against Texas Instruments DST tags used in vehicle immobilisers and ExxonMobil's SpeedPass system was identified by experts at Johns Hopkins University and RSA Laboratories.
The algorithm used in TI's DST tags is an unpublished, proprietary cipher that uses a 40-bit key. Using a black-box reverse-engineering method, the team were able to unravel the algorithm used in the DST tags. This information allowed them to programme a commercial microchip costing less than $200 to find the secret key of a gasoline purchase tag owned by one of the researchers. Using 16 of these PFGA devices in parallel allowed researchers to reduce search time from 10 hours to around 15 minutes.
