Car key fob programming, the mechanics
- ✓A UK fob transmits 66 data bits on every button press
- ✓34 bits travel in the clear, 32 bits travel encrypted
- ✓The encrypted block carries a 16-bit counter that increments every press
- ✓UK vehicles transmit at 433.92 MHz
- ✓AES-128 fobs cannot be cloned. OBD programming is the only route
What happens electronically when a key fob is programmed?
Programming writes a fob serial number and counter value into a receiver memory slot. The receiver then accepts transmissions carrying that serial and rejects every other serial on the same frequency.
The operation runs in 5 stages. Each stage completes in milliseconds once the enrolment window opens.
The receiver enters learning mode
An ignition sequence or a diagnostic command opens a time-limited enrolment window. The window runs 10 to 30 seconds on onboard systems.
The fob transmits its identity frame
A button press sends 66 data bits. The first 34 travel in the clear and carry the serial number. The remaining 32 travel encrypted and carry the counter.
The receiver decrypts the rolling portion
The shared 64-bit key inside the receiver decrypts the 32-bit block and reads the counter value the fob transmitted.
The receiver stores serial and counter
Both values write into a memory slot. The receiver now expects the next transmission from that serial to carry a higher counter.
The immobiliser handshake runs separately
The transponder answers a challenge from the vehicle coil. That exchange authorises the engine and runs independently of the button transmission.
Stage 5 explains the most common post-programming complaint. Button locking and engine authorisation run as separate exchanges, so a fob paired to the receiver still leaves the engine immobilised until the transponder half completes.
What does a key fob actually transmit?
A KeeLoq fob transmits 66 data bits per button press. Thirty-four bits travel unencrypted and carry the serial number. Thirty-two bits travel encrypted and carry the rolling counter.
The Microchip HCS301 encoder defined this structure and became the dominant automotive implementation. The table below lists each portion of the transmission and whether encryption covers it.
| Portion of the transmission | Bits | Contents | Encrypted |
|---|---|---|---|
| Serial number | 28 | The unique identity of that fob | No |
| Button code (plain) | 4 | Which button was pressed | No |
| Status bits | 2 | Repeat flag and low-battery flag | No |
| Button code (encrypted) | 4 | The same button code, verified | Yes |
| OVR bits | 2 | Counter overflow extension | Yes |
| Discrimination value | 10 | Usually the low bits of the serial number | Yes |
| Synchronisation counter | 16 | Increments on every button press | Yes |
The serial number travels in the clear deliberately. The receiver reads the serial first to identify which stored key is transmitting, then decrypts the counter block using the key held against that serial.
How does a rolling code stop a replay attack?
A rolling code stops a replay attack because the counter increments on every transmission and the receiver rejects any value it has already seen. A captured code expires the moment the vehicle accepts it.
Both fob and receiver hold a 16-bit counter. The fob increments on each press. The receiver stores the last value accepted and expects a higher value next time.
A recording of yesterday transmission carries a counter below the stored value. The receiver discards it without responding, which is why passive recording produces no result against a rolling-code vehicle.
From the workshop
Drivers occasionally press a fob repeatedly in a pocket, out of range of the vehicle. The fob counter advances while the receiver counter stays still. Enough presses push the fob beyond the acceptance window, and the fob stops working while the battery reads full. Resynchronisation restores it in minutes.
Why does a fob stop working after too many button presses?
A fob stops working after excessive presses because the counter advances beyond the receiver acceptance window. That window runs between 16 and 256 increments depending on the implementation.
The window exists to tolerate normal out-of-range presses. A counter inside the window resynchronises automatically on the next successful transmission.
A counter beyond the window requires deliberate resynchronisation. The KeeLoq protocol handles this by replacing the encrypted 32-bit block with a 32-bit seed value, which re-establishes the shared position.
What frequency does a UK car key fob use?
UK car key fobs transmit at 433.92 MHz. North American vehicles use 315 MHz, and a small number of European systems use 868 MHz.
Frequency mismatch is the single most common fault in imported replacement fobs. The table below lists each band and the market that uses it.
| Region | Frequency | Used by |
|---|---|---|
| United Kingdom and Europe | 433.92 MHz | Every UK-market vehicle |
| Some European systems | 868 MHz | Selected premium and aftermarket systems |
| North America | 315 MHz | US and Canadian market vehicles |
| Japan domestic market | 315 MHz | JDM imports |
A 315 MHz fob fitted to a UK vehicle produces a specific symptom pattern. The transponder pairs normally and the engine starts, because the transponder communicates through a coil at 125 kHz rather than over the radio band. The buttons never operate the locks.
What is the difference between cloning and programming a key fob?
Cloning copies the output of one fob onto another without involving the vehicle. Programming enrols a new fob into the receiver cryptographically. Rolling-code systems accept programming only.
The table below separates the four operations by whether the receiver participates and whether rolling code permits the method.
| Operation | What happens | Receiver involved | Works on rolling code |
|---|---|---|---|
| Cloning | The output of one fob is copied onto another | No | No |
| Learning mode | The receiver enrols a new fob and stores its serial and counter | Yes | Yes |
| OBD programming | A tool writes the fob identity into the immobiliser database | Yes | Yes |
| Transponder cloning | A chip is copied onto a blank transponder | No | Fixed and crypto chips only |
Transponder cloning sits apart from fob cloning. A fixed 4C or a crypto 4D chip copies onto a blank transponder, which produces a working start key without touching the immobiliser. AES-128 chips resist that copy entirely.
Why can AES key fobs not be cloned?
AES-128 fobs resist cloning because the secret key never leaves the protected memory of the chip. The key space runs to 2 to the power 128, which places brute-force recovery beyond any available computing capacity.
KeeLoq dominated automotive remotes between 1996 and 2010. AES challenge-response replaced it as the standard from roughly 2010 onward.
The practical consequence appears at replacement time. A Hitag AES or equivalent chip offers one route only: OBD programming through the vehicle diagnostic port, using a tool that holds manufacturer-level access.
Why must lost keys be erased from the receiver?
A lost key stays valid in receiver memory until an erase command removes it. The vehicle continues to accept that serial number and counter indefinitely.
Receiver memory holds a fixed number of slots, commonly between 4 and 8 depending on the make. A stolen key occupies a slot and authorises entry and ignition for as long as the slot stands.
Erasing rewrites the entire slot table, which is why every remaining key must be present during the session. Any key absent from that session loses its slot permanently.
