Remote Car Starter: How Does Keyless Entry Work?

Remote keyless entry lets you lock, unlock or start a car from a few meters away. Pressing a button on the key fob sends a coded radio signal (315 MHz in North America, 433.92 MHz in Europe) to a receiver in the car, which decodes it and triggers the action. A rolling code that changes with every press blocks anyone from recording and replaying the signal.

A remote keyless entry system consists of a remote, which, when activated within a certain range, can lock, unlock and perform various other functions within a car. Such a remote consists of a short-range radio transmitter that sends radio waves to a receiver unit inside the car, which triggers the aforementioned functions.

Unless you’ve been living under a rock all these years, you have surely seen people exiting their cars and pressing a button on their remotes (often called “fobs”), which makes their cars produce a distinctive chirping sound and makes their lights flash.

Similarly, people do the same thing when returning to their vehicles. Press a button, hear a chirp and see a flash of lights – and voila! The car is unlocked!

You likely know that such a ‘car remote’ helps to lock and unlock a car, but do you know how it works? How can it tell the car to lock/unlock doors from a distance of a dozen feet or more?

How Does A Remote Keyless System Work?

A remote keyless system works with the help of radio waves, which are a type of electromagnetic radiation. A ‘car remote’ works on the same principle as a regular TV remote.

In the case of a TV remote, all you have to do is press a few buttons to power it up/down, change the channel, increase/decrease volume and do a bunch of other stuff. Similarly, a car remote helps you to lock or unlock your car, pop open its trunk, start its ignition, and do some really fancy stuff (in high-end models) at the touch of a few buttons.

The Role Of Electromagnetic Radiation

In the old days, when telecommunication technology was in its nascent stages, we communicated and transferred information over long distances primarily through wires. Needless to say, all of that has changed now. In the modern world, the state of affairs is such that a majority of the entire world’s digital communication is conducted without wires; instead, electromagnetic radiation plays a critical role. In fact, it would be fair to say that electromagnetic radiation is the backbone of almost all exchanges of digital information that takes place wirelessly.

You may recall from your high school science classes that there is something known as the ‘electromagnetic spectrum’, which is composed of different types of electromagnetic radiation.

As you can see from the image above, radio waves occupy the first spot in the spectrum, meaning that they have the longest wavelengths. Radio waves are used in many different devices, and keyless remotes for cars are no exception.

The Keyless Remote Is Actually A Radio

The tiny ‘car remote’ for your car consists of a short-range radio transmitter. When the remote is within a specific range (typically, 5-20 meters) of your car and you press one of its buttons, a coded signal, embedded in radio waves, is sent to a receiver unit installed inside your car. The receiver unit then decodes and translates that signal, which consequently locks/unlocks the doors of the car.

Most remote keyless entry systems operate at a frequency of 433.92 MHz for European, Japanese and Asian cars and 315 MHz for North American cars (Source). These are unlicensed low-power bands, so the fob can chirp away without you ever needing a radio license.

Now, if every press simply sent the same fixed code, a thief could sit nearby with a cheap radio receiver, record that code once, and replay it later to waltz into your car. To stop exactly this, manufacturers switched to rolling codes (also called hopping codes). The fob and the car each run a synchronized counter and a shared secret key; every button press generates a fresh encrypted code that is only valid once. The car accepts a code, then advances its counter and refuses to accept that same code again. So even if someone captures the signal, replaying it gets them nowhere. Microchip's KeeLoq algorithm, built around a 32-bit block cipher, was for years the workhorse behind this scheme.

Passive Keyless Entry (PKE)

There is a separate variety of keyless car remotes that fall under the category of Passive Keyless Entry (PKE) systems. First developed by Siemens in 1995 and introduced by Mercedes-Benz as “Keyless-Go” in 1998 on the W220 S-Class, it is considered to be a step up from RKE systems. A remote of this category is commonly referred to as a smart key (also called an ‘advanced key’ or ‘hands-free’ key).

Unlike regular RKE remotes, PKE devices don’t typically require you to push any buttons to lock/unlock your car. This is because, in addition to a radio transmitter, the fob also contains a receiver, so the car and the key carry on a two-way conversation. As you approach, the car broadcasts a low-frequency “challenge”; the fob wakes up, listens, and answers back over the higher-frequency band, all in a fraction of a second. (A smart-key fob does carry a small battery for this back-and-forth, though most cars also embed a battery-free immobilizer chip in the key as a backup that draws its tiny bit of power from the reader itself.)

It allows the user to keep the key fob in their pocket while approaching the car, as the transponder inside the fob communicates with the receiver system of the car to open the doors and even activate the ignition from a distance. Furthermore, it does the latter without requiring the user to put the key in the ignition! To lock the car, the user can press a button on one of the door handles, touch a capacitive area on a door handle, or simply walk away from the car.

How Does A Remote Engine Starter Work?

So far we’ve talked about locking and unlocking, but a lot of people really want to know about the other trick: firing up the engine from inside the house so the cabin is warm (or cool) by the time they climb in. This is the job of a remote engine starter, and it’s worth knowing that it’s a separate system from the door lock, even though both can sit on the same fob.

When you hold the start button, the remote sends a coded radio signal to a small control module wired into the car. That module mimics the sequence your own hand would perform: it switches on the ignition circuit and cranks the starter motor, so the engine turns over without anyone sitting in the driver’s seat. Many cars also let you trigger this through a smartphone app over the cellular network, which is why you can warm up the car from across the parking lot, or even from bed.

There’s one catch. Almost every car built since the late 1990s has an immobilizer, a security chip that refuses to let the engine run unless it detects the correct key transponder nearby. To let a remote starter work around this safely, installers add a small bypass module that confirms the car’s own key is present, so the engine will start on command but a thief still can’t simply drive off. As a safeguard, remote-start systems also keep the doors locked and the transmission in park, and the car typically shuts the engine back down if the brake pedal isn’t pressed before someone tries to drive.

How Secure Is Keyless Entry? The Relay Attack Problem

Rolling codes did a fine job of killing off simple record-and-replay theft, but convenience has opened a new door. The very feature that makes passive keyless entry so pleasant, the car quietly listening for a nearby fob, is also its weak spot. Enter the relay attack.

Here’s how it plays out. Your fob is sitting on a hallway table near the front door, while your car waits in the driveway. Two thieves work as a pair: one stands near your house with a device that picks up the faint signal your fob is always ready to send, amplifies it, and beams it to an accomplice standing by the car. The car is fooled into thinking the key is right beside it, unlocks, and lets the engine start. Researchers at ETH Zurich demonstrated exactly this back in 2011 on cars from eight manufacturers, and the trick still works because it relays the genuine signal rather than cracking the encryption. In the UK, relay-style methods now account for a large share of keyless car thefts, and the whole operation can take under a minute.

Carmakers have started fighting back with ultra-wideband (UWB) ranging, which measures the true distance to the key precisely enough that a relayed signal stretched across a driveway gives the game away. In the meantime, the simplest defense is delightfully low-tech: keep your fob in a Faraday pouch (a metal-lined sleeve that blocks the radio signal), or just store it well away from doors and windows. Some fobs can also be switched into a “sleep” mode that stops them from chattering when they sit still.