Best algorithm for cracking keyless entry

Factual Questions
1

I started wondering this since I bought my Supercoupe with keyless entry and didn’t know the code for it. I’ve since figured out the code but am still curious how secure these things are. I’m not trying to steal other people’s cars but rather would like to unplug my keyless entry module if it’s really easy to steal mine.

Let’s explain the system I have first. It’s an 89 Ford Thunderbird Supercoupe. It has the buttons 1/2, 3/4, 5/6, 7/8, and 9/0, which I just refer to as 1, 2, 3, 4, and 5 to make it more comprehendible as a base 5 number system. The code has 5 digits. So basically there are 3,125 possible codes. The code has to be typed in sequence with no more than I think a 2 second gap between numbers. It doesn’t reset with every 5 keys you press, thus it’ll still unlock the door if you finished the combination in the middle of one of your tries.

The purpose of this thread is I’ve figured out a couple of ways to take shortcuts to cracking the code. The first is pretty simple and not very helpful. Instead of pushing 11111 and then 11112, you can just do 111112 (an extra 1) and knock both codes out at once. I know this works with every code that’s the same 5 digits. So that’s really only 4 buttons saved each time, or a total of 20, not much compared to 15,625 buttons pressed for all codes. The other thing I’ve figured out has a bit more effect. You needn’t press any codes where the second digit is less than the first. If the code is, for instance, 31454, you would unlock the door when you pressed 14543 1454(5)… That comes a lot quicker than 31454 does. That manages to weed out 1,250 combinations to try if my calculations are correct. There’s still over half the codes left, but I have a feeling there are more tricks to this. What do you guys think? I may make a computer program that determines how many guesses it would take for an intelligent criminal to crack it (or just someone who didn’t know their code as I once didn’t).

2

I think what you need is a base 5 version of a maximal length sequence generator. That would generate a sequence of length (5^5)-1 that would contain all 5-digit combinations, except for 00000.

3

Not really an algorithm, but an observation. Won’t the keys that are used most show more wear? Especially on a fifteen year old car.

4

Unless the keyless entry module gives information about the correct answer when you put in an incorrect one, keying in the de Bruijn sequence of order 5 on the alphabet {1, 2, 3, 4, 5} is the quickest way to crack it. At 3125 keystrokes long and assuming you could hit a key every half-second, it would take you more than 26 minutes to type it in. So I wouldn’t worry too much.

5

If you want to try it, you can find a Java applet for generating De Bruijn sequences here, or a simpler CGI-based version .here.

6

Even theoretical discussions of how to break a U.S. law are not what the board allows.

Closed.

samclem GQ moderator