<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">> > > Secure Key Fob</div><div class="">> > > </div><div class="">> > > Each ORWL comes with a key fob that uses the same authentication</div><div class="">> > > technology as smart-cards, with an added ability to detect</div><div class="">> > > proximity. After the initial pairing of the key fob with the ORWL to</div><div class="">> > > generate a shared secret, the key fob’s near field communication (NFC)</div><div class="">> > > is used to authenticate the user, at which point the key fob’s uses</div><div class="">> > > Bluetooth (BLE) to monitor whether or not the user is within</div><div class="">> > > range. Once a user goes out of range, ORWL will lock, requiring the</div><div class="">> > > key fob’s NFC authentication to unlock.</div><div class="">> > </div><div class="">> > That seems vulnerable to a relay attack.</div><div class="">> </div><div class="">> Not if they're using latency to determine range; you can't fake the speed of</div><div class="">> light.</div><div class="">> </div><div class="">> I'm not sure if ORWL is in fact using time-of-flight distance measurement</div><div class="">> instead of the more common received-signal-strength distance measurement, but</div><div class="">> it is possible to do with Bluetooth BLE and some products implement it.</div><div class=""><br class=""></div><div class="">I doubt they are doing any distance measurement at all. If they did</div><div class="">they would mention it. When people talk about proximity and refer to</div><div class="">being in or out of range they mean being within signal reach or not.</div><div class="">The distinction between proximity detection and distance measurement</div><div class="">is spelled out in</div><div class=""><a href="http://electronicdesign.com/communications/what-s-difference-between-measuring-location-uwb-wi-fi-and-bluetooth" class="">http://electronicdesign.com/communications/what-s-difference-between-measuring-location-uwb-wi-fi-and-bluetooth</a> :</div><div class="">> First, it’s important to distinguish iBeacons and their role, namely</div><div class="">> proximity detection, from the more general problem of measuring</div><div class="">> location and distance. Proximity sensing is when a device detects that</div><div class="">> it’s within range of another device, such as when a phone enters range</div><div class="">> of a beacon. Detecting proximity doesn’t necessitate measurement of</div><div class="">> distance; rather, it only requires detecting a steady signal. Some of</div><div class="">> these systems distinguish being “in range” of a beacon and being</div><div class="">> “close” to a beacon by distinguishing weak and strong signal</div><div class="">> strengths. However, this still isn’t the same as measuring precise</div><div class="">> distance or tracking location.</div><div class=""><br class=""></div><div class="">In any case, it is not necessary to fake the speed of light or achieve</div><div class="">Warp Speed Factor 1 or exploit the higher dimensions of String Theory :-)</div><div class="">to mount a relay attack againt time-of-flight distance bounding. One</div><div class="">can instead attack the transmission channel as described in</div><div class=""><a href="http://www.rfidblog.org.uk/Hancke-Wisec2008.pdf" class="">http://www.rfidblog.org.uk/Hancke-Wisec2008.pdf</a> .</div><div class=""><br class=""></div><div class="">Francisco</div><div class=""><br class=""></div></body></html>