"Broken" is correct, but arguably too strong of a term. It is a man-in-the-middle attack, where the "man" in the middle is relaying the signals without modification and with an extremely short delay between the "key" and the car.

The article notes that their system specifically delays the challenge/response by nanoseconds vs. milliseconds by staying in the analog realm because doing a A/D -> Tx -> Rx -> D/A sequence added too much delay.

This implies either the car security system either measures the challenge/response delay or could measure it in which case this MitM attack still will work since attack's nSec delays will be very difficult to detect.

Most relay attacks require the signals to be converted from analog to digital and back, which takes time. The researchers were able to keep the signals in analog format, which reduced their delay from microseconds to nanoseconds and made their attack more difficult to detect.

> Surely car design/manufacture is much harder than implementing proven crypto?

No crypto is broken in this scenario.

Keeping track of your secrets is as essential a part of a crypto implementation as the algorithm used. As I understand it, they could have used something like this: https://secure.wikimedia.org/wikipedia/en/wiki/Socialist_mil...

EDIT: I understand now, having read more carefully, about how this particular MITM attack works. Nasty. The only solution would seem to be to give up some convenience.