
CipherLinx
technology protects against the attacks that are commonly used on remote control systems. These include Code Scanning, Code Grabbing, and Copy-Paste attacks.
technology protects against the attacks that are commonly used on remote control systems. These include Code Scanning, Code Grabbing, and Copy-Paste attacks.

Code Scanning, also called a Brute Force attack, is where an attacker tries every possible key to gain access to the system. This is countered by making the key so large that it is not practical to try each one. CipherLinx's 80-bit address would take about 4,789 trillion years to try each address at 8 addresses per second.

A more practical attack is Code Grabbing. This is where an attacker records a transmission from a legitimate transmitter and then replays that transmission at a later date to gain access. This is prevented by making each transmission unique, and not allowing an old transmission to be accepted. Most secure products use a counter that increments each time the button is pressed to make each transmission different. The receiver will not accept any transmission that has a counter value that is less than the previously transmitted value.
This works well until the counter reaches its maximum value, at which point it will "roll over" to 0. The future values that will be accepted by the system must also be considered. The system cannot look only for the next sequential value, as the transmitter may be activated out of the receiver's range (a button could be pressed while in someone's pocket or a child could play with the transmitter). Accepting all future values is not practical, because once the counter nears the rollover point, future values now look like past values. The solution to this is to create a window of allowed counter values. This window will start at the last value that was received and extend by a certain amount. This will ensure that no old values are accepted unless the window has reached the rollover point. This scheme has given rise to the term "rolling code." Most products on the market use 16- to 32-bit counters. Depending on use, they could take months or years to roll over, but the system will still accept an old value. This leaves it vulnerable to attack.
CipherLinx
uses a 40-bit counter that changes with each packet (not just every button press). With continuous use at the fastest baud rate, it would take 890 years for the counter to run out. At this point, the system requires that a new key be learned. Encrypting the same data with a different key gives a different result. This ensures that the same transmission will never be sent twice, so an old transmission will never be accepted.

A Copy-Paste attack is where an adversary records a transmission, replaces part of the transmission with their own data, then sends the modified transmission to try to gain access. This works when existing schemes don't make full use of encryption algorithms.
Encryption algorithms use a key of a certain size to encrypt blocks of data that are a certain size. If the amount of data that the system needs to send is not as large as the block that is required by the encryption algorithm, the system will usually just fill the remaining space with empty characters and will not pay any attention to them. An attacker could modify a part of that message, including the command bits, and the system would not realize anything had happened.
CipherLinx
uses 80 bits for an integrity check. A Copy-Paste attack could modify some of these bits, but since the receiver checks them all to validate the transmission, this kind of attack would be easily detected and the transmission ignored.

If an attack can be successfully made upon the encryption algorithm, then the system is vulnerable. There are currently no known successful attacks on the full Skipjack algorithm. The Skipjack algorithm has been proven secure, and has not been modified. But mixing of the data and multiple calls to the encryption algorithm make the CipherLinx
system more than just Skipjack.



