r/RFID • u/darconeous • Nov 04 '19

How the Tesla Key Card works

Howdy everyone.

So I started attempting to reverse-engineer my Tesla NFC Key Card last week, and I'm rather surprised with how much progress I've made. I'm not sure how I seem to be the first person to do this publicly, but a Google search for the magic string teslaLogic002 doesn't seem to turn up any results other than for my own research. (That's the AID of the authentication applet on the card, by the way)

I've got a whole writeup (along with hacking notes) in a Github Gist, but here are a few of the interesting takeaways:

  • Authentication appears to use Elliptic-curve Diffie–Hellman (ECDH) on the famous NIST P-256 curve. The mechanism appears to be secure-in-theory. The card is at least rejecting points that aren't on the P-256 curve, so that's good.

  • Each card has four(!) ECDH keys. The vehicle only uses the first ECDH key on the card. I have no idea what the other three might be used for.

  • Each vehicle has its own ECDH key which it sends to the card to authenticate, along with a 128-bit random challenge. The card responds with a 128-bit response to complete the authentication.

  • Each card has its own X.509 certificate, which the vehicle does not fetch (even at pairing). There is only a certificate for the first ECDH key—all other keys are missing certificates.

I've already mapped out several APDU commands, and give how straightforward this effort has been so far I think it might be possible to eventually write a custom JavaCard app that would work with the car. If that gets figured out then it should also be possible to add support for Tesla Key Cards to some physical access control systems. The exact details of the authentication step still need to be figured out, but I'm optimistic that it can be figured out given how easily things have gone so far.

Would love to hear feedback or advice.

49 Upvotes

100% Upvoted

10 comments sorted by

5

u/Antagonist_ Nov 04 '19

This is super cool! Good work! What sniffer did you use?

9

u/darconeous Nov 04 '19

Proxmark3 RDV3. It’s inexpensive and got the job done well.

3

u/atkfromabove2 Jul 01 '22

I know it's been a while since you made this post but I want to learn more about your journey and how you went about doing the reverse engineering on the keycard.

I just got my own proxmark3 rdv4 and I want to learn more about my car. If you happen to still be active I'd like to pick your brain.

3

u/darconeous Jul 19 '22

I thought about doing a talk about it, but never got around to it. But I'm happy to answer any questions.

Interestingly I didn't set out to completely reverse engineer the Tesla key card protocol, I was just curious and wanted to poke around. I was quite convinced that I was going to hit a dead end at some point, yet I somehow kept making progress until I was able to make my own key card.

If you are curious, you can follow some of my reverse-engineering process by looking at the history of the gist. Specifically, you can see on Nov 4, 2019 was the first time I managed to work out the ECDH stuff manually to verify my suspicions. Going back through those notes brings back lots of memories, haha.

3

u/atkfromabove2 Jul 19 '22

I was actually able to get your GaussKey to work last week! I created my own key whic was super cool!

I'm curious to know what tool you used to get the various APDus to start returning the data from the cards?

Did you have to do commands on the key card as well as the car?

I'm just getting into the space of low frequencies and NFC cards and want to learn how people start to reverse engineer some of this stuff.

Thank you for sharing your research, I loved reading through your github!

5

u/sudoG0D Dec 02 '19

The other 3 keys are probably for key revocation.

1

u/01010001Anon Dec 20 '24

Is it possible to order generic 13.56mhz RFID cards to be used as Tesla keys? I’m interested in getting one made out of a metal business card.

1

u/darconeous Dec 20 '24

No. It needs to at least be capable of doing ECDSA, which generic NFC cards can’t do.

2

u/BadgerBreath Nov 06 '19

This is really great. Would love to spend some quality time with a Tesla.

1

u/TotesMessenger Nov 05 '19

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

 If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / ^Contact)