You press a button on a plastic fob, and a 4,000-pound car unlocks from 50 feet away. Strip away the shell, though, and you’ll find not magic but an RF node juggling microamp power budgets, sub-GHz transmissions, and cryptographic handshakes in real time. Keyless fobs are more than convenience—they’re a masterclass in blending RF engineering, low-power microcontrollers, and applied math into something you can slip into your pocket.
Each fob press launches an encrypted dialogue at the speed of light. Here’s how your fob speaks to your car and the clever security engineering that keeps thieves from listening in. But before that, a quick note on terminology. While terms like remote keyless entry (RKE) transmitter, smart key, and keyless fob are often used interchangeably, standard RKE relies on manual button presses, whereas passive smart keys operate handsfree via proximity.
RF transceivers and frequency dynamics
Keyless fobs live in the invisible world of radio waves, and their choice of frequency bands is no accident. In North America, most operate around 315 MHz, while Europe primarily uses 433.92 MHz and 868 MHz. These sub-GHz allocations sit apart from the crowded 2.4 GHz ISM band used by Wi-Fi and Bluetooth, giving fobs a quieter spectrum neighbourhood with less interference.
The physics of propagation makes sub-GHz especially attractive. Longer wavelengths penetrate car bodies, walls, and even the fabric of a pocket with lower path loss compared to 2.4 GHz signals. That means reliable unlocks even when the fob is buried in a jacket or handbag. The trade-off is bandwidth—sub-GHz channels are narrower—but for the short bursts of encrypted data a fob needs, efficiency matters more than throughput.
Antenna design is where the engineering artistry shows. Inside the cramped plastic shell, designers squeeze in helical trace antennas or PCB loop antennas, each tuned to resonate at the chosen frequency. For passive proximity detection and wakeup signals, cars rely on low-frequency magnetic coupling at 125 kHz. Rather than carrying heavy data over long distances, these 125-kHz inductive fields act like a local handshake, waking the fob’s microcontroller, so the primary sub-GHz transceiver can handle the main transmission.
Balancing antenna aperture with ultra-compact form factors is the key takeaway. A larger antenna would improve efficiency, but the fob must remain pocket-sized and durable. Engineers compensate with clever geometries, impedance matching, and dual-frequency antenna strategies that let a tiny device reliably talk to a steel-encased automobile.
In short, every unlock click is a lesson in frequency dynamics: sub-GHz bands chosen for reach, antennas sculpted for size, and low-frequency magnetic coupling layered in for wakeup precision. It’s RF engineering distilled into a device small enough to hang from your keychain.
Figure 1 Opening of a remote keyless entry transmitter reveals its internal electronics assembly. Source: Go Parts
The math of rolling codes and cryptography
Early RF remotes—like those used in legacy garage doors—relied on fixed codes. Each button press transmitted the same binary sequence, which meant an attacker could simply record the signal once and replay it later. This replay attack was trivial to execute, exposing the fundamental weakness of static codes: predictability.
Keyless fobs solved this vulnerability with rolling codes, ensuring that no two transmissions are ever identical. The landmark scheme that pioneered this transition was KeeLoq, a block cipher that encrypts a synchronized counter. Each button press increments the fob’s internal counter, running it through the cipher to produce a unique 32-bit encrypted transmission. While classical KeeLoq has largely been superseded by modern AES-128 algorithms to resist cryptanalysis and power-analysis attacks, the core synchronization logic remains the same.
The car’s receiver maintains synchronization by tracking a counter window. If you press the button while out of range, the fob advances its internal count; when you return, the receiver still accepts the code as long as it falls within a defined forward-looking window. This prevents accidental desynchronization while permanently invalidating past codes, effectively eliminating replay attacks.
For provisioning and root of trust, before a fob can participate in challenge-response handshakes, it must undergo initial provisioning. During manufacturing or dealership pairing, the vehicle’s Vehicle Identification Number (VIN) serves as a primary index to pull or derive the vehicle’s unique master cryptographic key from a secure database.
This seed, along with the fob’s unique secret key, is flashed into the microcontroller’s secure EEPROM or hardware security module (HSM). This binds the physical RF node permanently to the vehicle’s engine control unit (ECU) and body control module (BCM).
In bi-directional smart keys (PKE), security goes a step further with challenge-response protocols. Instead of the fob transmitting unprompted, the vehicle initiates contact by issuing a random cryptographic challenge. The fob calculates a response using its secret key and returns it over sub-GHz RF. Because the challenge is unique every time, intercepting a single transmission gives an attacker zero ability to predict the next valid response.
The elegance of these cryptographic schemes lies in their efficiency: optimized to run on microcontrollers with microamp power budgets, yet mathematically resilient against eavesdropping. Linear algebra, probability, and modern block ciphers converge to turn a simple radio transmission into a secure handshake.
Power optimization and microamp budgets
The brilliance of a keyless fob isn’t just in its RF engineering—it’s in how it stretches a tiny coin cell to last for years. Most fobs run on a single CR2032 battery with a capacity of roughly 220 mAh. That modest 3-volt source must power the device reliably for three to five years, despite the demands of encryption, RF transmission, and user convenience.
The secret lies in duty cycling. In deep sleep, the microcontroller sips less than 1 µA, conserving energy while waiting for an event. By contrast, active RF transmission spikes to 10–20 mA—a thousandfold increase. If the fob stayed awake, the battery would drain in weeks. Instead, engineers design the system so that the device spends more than 99% of its life asleep, waking only for a few milliseconds at a time to process and transmit.
Passive keyless entry (PKE) systems add another clever trick with dedicated low-power wakeup circuits. When you reach for the door handle, the car emits an inductive 125-kHz signal. Internal 3D receiver coils in the fob capture this magnetic field, triggering an analog wake pin on the microcontroller. The fob burns zero high-power RF current until the vehicle physically proves it’s nearby.
Figure 2 An aftermarket PKE DIY kit equips a standard vehicle with automated keyless entry and push-button ignition capabilities. Source: Banvie
It’s important to note that while advertised for do-it-yourself/aftermarket installation, wiring this demands tapping into your car’s main ignition lines, central locking relay, and brake switch. If your vehicle has an engine immobilizer (a chip inside your original key), you will also need a separate bypass module to allow the push-start function to work without the physical key inserted.
The key takeaway is optimization under constraint. Every microamp matters, and every wakeup must be intentional. By combining deep sleep states, short active bursts, and inductive triggers, engineers make a 220 mAh coin cell feel almost inexhaustible. It’s power budgeting at its finest, a proof that longevity is engineered, not accidental.
Figure 3 The outline of the signal path highlights hardware functional blocks in a PKE reference design. Source: Microchip
Another side note: While modern smart key fobs rely on a built-in coin battery to send active radio signals for keyless entry and push-button start, they also house an embedded backup transponder key as a fail-safe. Additionally, most smart fobs conceal a mechanical emergency key blade inside the housing—accessible via a small release latch—to manually unlock the car doors if the battery dies.
A transponder key uses a tiny, battery-less chip that communicates directly with your car’s immobilizer via a short-range inductive signal. This means if your fob’s coin battery completely dies, you won’t be stranded. Holding the dead fob directly against the push-to-start button (or placing it in the designated backup slot) allows the car to inductively power and read the backup transponder chip, disabling the immobilizer, so your engine can start.
The vulnerability and next-gen fixes
For all their clever engineering, traditional keyless fobs face a notorious weakness: the relay attack. In this exploit, thieves use paired signal extenders to capture the car’s 125-kHz wakeup signal and relay it over long distances to where the fob is sitting inside a house. The fob responds to the relayed signal, and the extenders push the sub-GHz unlock transmission back to the car. The vehicle believes the key is right next to the door and unlocks on command.
The modern countermeasure is ultra-wideband (UWB), standardized as IEEE 802.15.4z. Unlike traditional narrowband sub-GHz signals, UWB transmits short pulses across a broad spectrum with nanosecond precision. Its critical advantage is time-of-flight (ToF) distance bounding: the vehicle and fob exchange timed pulses and measure distance based on the exact time it takes for light-speed signals to travel between them.
Because ToF is bound by the speed of light, a relay attack cannot fake physical proximity. The latency introduced by capturing, amplifying, and re-transmitting signals over distance adds measurable nanoseconds of delay, causing the ToF check to instantly fail.
This shift from “is the signal present?” to “is the fob physically here?” marks a fundamental leap in automotive security. UWB doesn’t just encrypt data; it verifies physical distance, effectively closing the relay loop that thieves relied on for years.
Figure 4 A UWB proximity sensor module integrates an antenna, SoC, crystal, and SMT solder balls to enable low-latency user-presence detection and fast wakeup. Source: Novelda
Inside every keyless fob, fundamental principles quietly converge: Ohm’s Law governs the coin cell’s microamp budget, Maxwell’s equations shape the antennas and propagation, and modern cryptography secures each transmission. What looks like a simple plastic trinket is really a pocket-sized lesson in applied physics and embedded engineering.
So, here’s the challenge: Don’t just marvel at the convenience. Grab an old key fob, crack it open on your bench, and trace the circuits yourself. You’ll find that everyday security is built on the same timeless laws you test with a multimeter every day.
T. K. Hareendran is a self-taught electronics enthusiast with a strong passion for innovative circuit design and hands-on technology. He develops both experimental and practical electronic projects, documenting and sharing his work to support fellow tinkerers and learners. Beyond the workbench, he dedicates time to technical writing and hardware evaluations to contribute meaningfully to the maker community.
Related Content
- Unlocking the Keyless Car Future
- Fob functionality goes beyond the car
- Passive keyless entry/Go block diagram
- Keyless Car Access: More Options for Drivers
- The wireless design evolution of keyless entry systems in vehicles
The post The secret signals of keyless fobs appeared first on EDN.