KeeLoq rolling code

Transmitted code functions like a password. When activated, a transmitter generates and sends a signal containing the password to its paired receiver. The receiver analyses the password to see if it is acceptable. If accepted, the receiver then triggers a relay, allowing the door or barrier to be unlocked and opened.

In a fixed code system, the password never changes. This leaves the system vulnerable to attack, as if someone was able to find out the password, they could use it to gain access without authorisation. Rolling code significantly reduces the risk of unauthorised entry because the password changes every time it is used.

Rolling code transmission systems use methods of encrypting the data that allow the transmitter and the receiver to share passwords, but which make it considerably more difficult for an attacker to discover them. KeeLoq® is a proprietary block cypher that is one of the most commonly used encryption methods for radio frequency transmission.

KeeLoq hopping code utilises a 66-bit transmission code, of which 32 bits are encrypted. In the encrypted section alone, there are almost 4 billion possible code combinations, which would take approximately 17 years to fully scan. The transmitted passwords cannot be re-used regularly, to prevent interception and unlawful access. Once a passcode has been used, it will not be valid again until approximately 65,000 other valid codes have been used. In normal usage scenarios, it would take more than 20 years for a code to become valid again.

A passcode is generated every time the button on the transmitter is pressed, even if it is out of range of the receiver. If it is out of range, the receiver does not generate a code – therefore leaving the transmitter and the receiver unsynchronised.

To overcome this limitation, the receiver stores a list of the upcoming passwords pre-determined by the PRNG. In KeeLoq hopping code, the list is up to 1,000 future passwords. Once the transmitter comes back into range of the receiver and the button is pressed, the receiver can still identify the code as one of the upcoming passwords and allow access. The ‘missed’ codes that were generated by the transmitter while it was out of range are simply invalidated and the codes are synchronised once again.

KeeLoq also benefits from additional synchronisation security measures. If the transmitter button is pressed 16 or more times whilst out of range of the receiver, the receiver will not unlock the door or barrier on the first press of the button once back in range. Re-synchronisation will only occur when the receiver is sent two consecutive matching codes from the list of valid future codes. In a typical system, if the transmitter button is pressed a few thousand times while out of range, it will be permanently locked out of the receiver and must be manually re-synchronised.