Field Guide · protocol

Also known as: RKE, remote keyless entry, key fob

Remote keyless entry (RKE) is the short-range radio link from a car key fob to the vehicle that locks, unlocks, and opens the trunk at the press of a button.1 It is a one-way transmission in a sub-GHz ISM band — 315 MHz in North America, 433.92 MHz in Europe — using simple on-off keying, but with a crucial security twist: instead of sending a fixed code, each press sends a different rolling code, so an attacker who records one transmission cannot simply replay it later.

fob car OOK packet: serial · button · rolling counter counter advances every press → replay rejected
An RKE fob sends an OOK packet holding its serial and a rolling counter that increments each press; the car accepts only codes ahead of the last one it saw.

Overview

Pressing an RKE button transmits a short packet containing the fob’s serial number, the button pressed, and a counter (or cryptographically hopping) value. The vehicle keeps the last accepted counter and accepts only codes within a forward window of it, so an old, recorded packet is stale and ignored. Classic implementations use Microchip’s KeeLoq hopping-code cipher; newer systems use stronger keyed algorithms.

Technical characteristics

Property Value
Bands 315 MHz (US), 433.92 MHz (EU) ISM
Modulation OOK/ASK; some FSK
Line coding PWM or Manchester
Security Rolling code (e.g. KeeLoq)
Direction One-way fob → vehicle
Payload Fob serial + button flags + rolling counter

RKE is distinct from passive keyless entry (PKE) and immobilizer transponders, which add a bidirectional LF challenge-response so the car unlocks or starts just by proximity.

History

Remote keyless entry appeared on cars in the 1980s and became near-universal in the 1990s. Early systems sent fixed codes and were trivially replayable; the rolling-code approach — popularized by KeeLoq — was adopted to defeat simple record-and-replay attacks.2 Researchers have since shown weaknesses in some implementations, driving a move to stronger ciphers.

Deployment

RKE fobs are ubiquitous on passenger vehicles and share the 315/433 MHz ISM bands with TPMS sensors, garage remotes, and other short-range devices — a busy slice of spectrum for anyone surveying it.

Decoding it with GopherTrunk

RKE is out of scope for GopherTrunk, which decodes trunked land-mobile voice, not key-fob control packets. The raw OOK bursts can be observed with a general SDR and generic 433 MHz decoders, but the rolling code means a captured packet is not reusable, and GopherTrunk implements neither the fob framings nor any of this. It is included here for context on the sub-GHz device signals a scanner operator encounters, not as a target GopherTrunk decodes.

Sources

  1. Remote keyless system — Wikipedia, for the RKE fob link, bands, and relationship to passive keyless entry. ↩

  2. Rolling code — Wikipedia, for the hopping-code scheme (KeeLoq) that defeats replay of captured transmissions. ↩

See also