The most obvious way to mitigate is to have the car require the key to send the first bit of the response at most N nanoseconds after the last bit of the challenge is sent over the air. Because of the speed of light this assures the key is within a certain distance of the car. Ideally you want to constrain this to ~2 meters since passive entry requires the driver to touch the door handle. This limit is not to be confused with remote keyless entry which should work up to ~100 meters as it requires the driver to actively press a button so, like garage door openers, this is not vulnerable to relay attacks. However power-constrained MCUs, especially in the key, have a hard time computing a strong cryptographic challenge within N nanoseconds with N low enough, hence the problem...
After my little foray into garage door openers I am currently looking into implementing relay attacks on the passive entry / passive go system of my car (2012 Audi). Fascinating stuff.
The cryptographic challenge makes it secure, the XORed one-time-pad allows for fast measurement of the round trip time.
The cryptographically secure garage door opener is still susceptible to MITM if the MITM attack is being done purely by amplification of signal, right?
It's almost like the key needs a handshake with the car by some method that is not using radio frequency. I wonder what options that leaves open? So far, I have not thought of one that is convenient (at some point, it is easier to go back to using a physical key to open a physical lock after all).
1. I think there was a post about it here already but I couldn't find it.