These cars were made ~5 years ago, but there's still no excuse for using a 40-bit key (which is transformed into a 24-bit response, lol) ~5 years ago.

Fair enough, I think I mentally substituted "Model 3" for some reason. I wonder if these fobs were designed 20+ years ago when the US crypto export control situation was a bit goofier.

There was really no excuse even in 2009, nevermind 2013, if you were doing some sort of proximity card public/private key crypto...

Actually, a very good excuse was provided precisely in 2009 - https://xkcd.com/538/

I don't disagree with the premise of that cartoon, but it's more about the concept of putting full disk encryption on your laptop, crossing the border into Uzbekistan, and then refusing to give up the password.

By that logic, anything that is protected by crypto, if you threaten the owner with violence, it can be stolen from them. Which is just about everything on earth, if you're willing to apply sufficient violence.

I was referring mostly to the concept of "A crypto nerd's imagination".

Seriously, it is unlikely someone would put the money and R&D effort required to replicate the researcher's solution with the goal of stealing these camera systems on the wheels that can be disabled remotely.

So I'd rather advocate for Tesla to continue using inexpensive and secure enough solution to unlock doors. And focus their efforts on making the thing actually safer, like not accelerating into and colliding with concrete barriers.

I can totally see people stealing Teslas, if you bring $100 worth of jamming equipment with you, it won't be disabled remotely. The cellular frequencies that a Tesla uses for M2M connections back to the mothership are not rocket science to jam.

At least not before it's driven into a warehouse somewhere and cut apart to be cannibalized for repair parts, then parts shipped overseas.

Repair parts for what? Who will purchase these?

All the people who have been waiting for months+ for a body shop to find Tesla-approved replacement parts, presumably.

Presumably, the same wholesalers/auto parts trading places I've seen in third-world countries with suspiciously sourced grey market Toyota Land Cruiser/Lexus repair parts.

Or people who want $20,000 worth of 100kWh 18650 battery conveniently packaged with connectors and cooling system.

That doesn't really apply in this situation though, since the crypto can be defeated without taking a wrench to the owner's face.

No amount of perfect encryption will protect against a relay attack.

This is even worse than a relay attack, since AFAIK those require being near the fob and there are other mitigations (even simple things like timing how long it takes to get a response). This attack essentially lets you clone key fobs permanently, not just start a car while the owner is on the other side of a parking lot. And the encryption would work a heckuva lot better if the attacker had to precalculate every challenge and response with, for example 256 bit AES keys instead of 40 bit keys with 24 bit responses.

You should use a key exchange protocol like Diffie Hellman

Doesn't help one iota. The relay attack uses a two way amplifier to effectively increase the reach of the frob. This way the evildoers can steal the car while you are sleeping.

As tropo suggests above, it would have to measure the distance (signal propagation), but I suspect that would drive the cost of the frob up significantly.

EDIT: to be clear, this isn't the attack discussed in the article, but a more serious problem that is already in use today.

Sorry, I mistook your point.

The critical issue for rf keys is the lack of a button to lock/unlock the door.