Does the project implement the applet part?

[coderjingluo]

Does the project implement the applet part?

[baka3k]

No, applet did not include in this project

[coderjingluo]

No, applet did not include in this project

I have successfully run this project, and then I have a question to ask, is this project actually simulated after the real vehicle has already created the CCC key?

[baka3k]

I hope so. This project offers a standardized emulator transaction, which I believe is effective in certain scenarios.
Of course, we will have to make quite a few adjustments to meet the specific customization requirements in reality.

[coderjingluo]

I hope so. This project offers a standardized emulator transaction, which I believe is effective in certain scenarios. Of course, we will have to make quite a few adjustments to meet the specific customization requirements in reality.

When using the app to simulate the digital key and interact with the real vehicle, I guess the interaction should break at some point because some data is unique to the real digital key. What do you think?

[baka3k]

Essentially, the vehicle and mobile device require a prior pairing phase to exchange keys as I mentioned in the document.
This ensures that the data transmitted between the vehicle and mobile device is unique, which is self-evident

[coderjingluo]

Essentially, the vehicle and mobile device require a prior pairing phase to exchange keys as I mentioned in the document. This ensures that the data transmitted between the vehicle and mobile device is unique, which is self-evident

If this project is regarded as a relay attack scheme, only data forwarding, do you think it is feasible?

[baka3k]

Could you elaborate on that idea?

[coderjingluo]

Could you elaborate on that idea?

Similar to NFC relay, a mobile phone analog digital key is close to the real vehicle, a mobile phone analog car is close to the real digital key, and the data between the two mobile phones is forwarded

[baka3k]

In my understanding, nfc replay attack might not be feasible. Payload included ephemeral key which generated foreach transaction, you have no ephemeral private key to create shared key

[coderjingluo]

This is not an NFC playback attack, but an NFC relay attack, which is to forward NFC data between a real car and a real mobile phone.

[baka3k]

Is your mean MitM attack?

[coderjingluo]

Is your mean MitM attack?

Yes, do you think it is feasible not to tamper with data in the process of forwarding data? Although the ccc technical specification mentions that it can prevent man-in-the-middle attacks, I think the specification means man-in-the-middle attacks to prevent data tampering. what do you reckon ?

[baka3k]

Short answer: No(at least in my poor understanding, i haven't found any vector that can do that)
Data is signed by long term key pair(from paring phase) that ensure any injection to original payload will be rejected

[coderjingluo]

Short answer: No(at least in my poor understanding, i haven't found any vector that can do that) Data is signed by long term key pair(from paring phase) that ensure any injection to original payload will be rejected

Relay attacks do not require injection, they simply forward data

[baka3k]

Humm... What do you do with that package?

[coderjingluo]

Humm... What do you do with that package?

What does package mean, data packet?

[baka3k]

Yes, data package transfers between vehicle & mobile

[coderjingluo]

Yes, data package transfers between vehicle & mobile

Don't modify the content of the data packet, just forward the data packet. I don't know if you have used the NFCGate tool. This tool has the function of relay attack.

[baka3k]

I just want to know: what do you do with that data package? Replay For what? Do you know that data package from replay action will be rejected ?

[coderjingluo]

I just want to know: what do you do with that data package? Replay For what? Do you know that data package from replay action will be rejected ?

If the attack can be successfully relayed, the distance limit can be circumvented, which can prove that CCC is not absolutely safe.And I have tried to carry out a relay attack in the first NFC pairing process, which can be carried out before the mobile app creates a digital key. During this process, the data of the NFC interaction between the two parties can be obtained through the relay attack