A relay attack does not break the crypto — it shortens the distance. For keyless entry and access, the question is not how far away the device is but whether an attacker can convince the system it is closer. Channel Sounding answers that with phase-based ranging and round-trip timing engineered to resist being spoofed.
Keyless entry, secure access and payment-adjacent proximity all rest on one claim: the trusted device is genuinely near. An attacker who can relay the radio signals between a key and a lock can make the lock believe the key is present from across a car park, without touching the cryptography at all.
Bluetooth Channel Sounding attacks this directly. It combines phase-based ranging across many frequencies with round-trip timing between an initiator and a reflector, and it is designed so that the physical measurements an attacker would have to forge are bound to the exchange rather than replayable after it.
The engineering is in the resistance, not the measurement: initiator and reflector roles, phase-coherent multi-frequency capture, round-trip time that a relay cannot shorten, and a distance decision that fails closed when confidence drops.
Stated before any of them had an answer.
A relay leaves the cryptography intact and simply makes the device appear closer. Defending the crypto does nothing; the distance itself has to be trustworthy.
Phase-based range across frequencies gives centimetre resolution but is sensitive to multipath and to any latency an attacker can inject.
Round-trip time bounds distance only if the reflector's turnaround is tightly controlled; slack in the timing is slack an attacker exploits.
Under jamming or ambiguity the system must refuse rather than guess, without becoming unusable in ordinary conditions.
Measuring distance is the easy half. The value is a measurement an attacker cannot replay, relay or shorten — which is a system property, not a radio spec.
The scope of the work, rather than a capability list.
Rarely the subsystem that sounds difficult.
Ordinary ranging optimises for accuracy; secure ranging optimises against an attacker who is actively trying to shorten the result, which is a different discipline.
Every microsecond of loose turnaround is distance an attacker can steal; tightening it without breaking interoperability is delicate.
A system that refuses too readily is unusable; the boundary between honest ambiguity and genuine attack has to be set carefully.
Showing the distance is right is easy; showing it cannot be faked requires modelling and testing the attacks themselves.
A range measurement bound to the exchange, so a relayed or replayed signal cannot shorten it.
Phase and time fused for fine resolution where the security decision needs it.
Refuses under attack conditions without denying legitimate users in ordinary use.
Validated against relay and replay attack models rather than clean-room accuracy alone.
Customer projects are presented at property, capability, outcome and integration level. Customer names, internal architecture, confidential deliverables and commercial terms are not disclosed. Where a detail would identify a customer it is omitted rather than approximated. More is available under a non-disclosure agreement, within the limits the customer has agreed.
Every item links to its own page.
The wireless platform.
TECHNOLOGYLink budget to antenna.
TECHNOLOGYIdentity behind the ranging.
SOLUTIONAngle-of-arrival positioning.
SERVICEFirmware to application.
PLATFORMTrust across the device.
In a relay attack, an attacker forwards the radio exchange between a key and a lock so the lock believes the key is nearby when it is far away — the cryptography is untouched. Secure ranging stops it by measuring the actual distance in a way that is bound to the exchange, so a relayed signal, which necessarily adds delay, cannot make the device appear closer than it is.
It uses two complementary methods: phase-based ranging, which reads the phase of the signal across many frequencies for fine resolution, and round-trip timing between an initiator and a reflector, which bounds distance by how long the exchange takes. Fusing the two gives both precision and a measurement that is hard to forge.
Because the safe default for an access decision is to refuse. Under jamming, heavy multipath or an active attack, the confidence in the distance drops, and a secure system treats low confidence as a denial rather than a guess — while being engineered so that ordinary conditions do not trip that denial and frustrate legitimate users.
Written for engineers. Share it with one.
Tell us the specification, the constraint and the deadline. Programmes that cross silicon, radio, embedded and AI are where Faststream is strongest.