Report 227 · Luxury Home Security
"Rolling code" on a garage opener's box is meant to reassure you that a recording of your remote can't open the door later. Against that one attack, it works. But a 2022 university study bought three openers off the shelf and opened two of them from a single recorded press anyway. And the best-known attack on rolling codes doesn't break the code at all. It jams the door so the code never arrives.
For most houses with an attached garage, the garage door is a front door that nobody thinks of as one. The 2022 study I'm leaning on opens with the same observation: almost every house it had in mind can be entered from the garage. So the question of what that remote actually sends is worth ten minutes.
Older openers used a fixed code set by a row of tiny switches inside the remote. The University of Victoria thesis behind this report notes that 12 switches give 4,096 possible codes. Press the button, and the remote says the same thing every time. Anyone who records it can play it back.
You don't even need the recording. In 2015, security researcher Samy Kamkar published OpenSesame, a tool built on a Mattel texting toy. His write-up works the arithmetic. Trying every 8- to 12-bit code the plain way took about 29 minutes. Exploiting how those receivers read bits, with a mathematical trick called a De Bruijn sequence, cut it to about 8 seconds. If your opener still has a little bank of switches inside the remote, that's the number to remember.
A rolling code system, as the thesis describes it, sends an encrypted message containing a counter that goes up with every press. The opener decrypts it and accepts it only if the counter is a bit ahead of the last one it saw, inside a window the manufacturer sets, so a press made out of range doesn't lock you out. A code it has already accepted is dead. Record it, replay it, and nothing happens.
That's a real improvement, and it's the whole of the promise. The label tells you which protocol the designer intended. It doesn't tell you how carefully the product implemented it.
Ahmed Ghanem, working with Riham AlTawy at the University of Victoria, bought three mid-priced openers sold at big Canadian retailers: a Skylink ATR-1722CK, a Mastercraft 046-0265-2, and a Chamberlain 050ACTWF. They recorded the remotes with an inexpensive software-defined radio and analyzed the signals with open-source tools. The results were published at an IEEE conference in 2022 and in Ghanem's master's thesis that December, and the authors say they followed responsible disclosure first.
On the Skylink, the "encrypted" part of the message wasn't very random. Across 15 recordings of their own remote, many of its hex digits took only two or four values instead of sixteen. So the authors generated 129 candidate messages from that pattern and sent them. Nine opened the door.
Their expected rate, if the opener were enforcing a narrow counter window, was about 9 in ten million. They got 9 in 129, and concluded the opener had no receiving window at all. Worse, two of those working messages, sent again and again, kept opening the door roughly half the time, which a rolling code exists to prevent. The Mastercraft, they report, behaved exactly like the Skylink.
The Chamberlain held. Its messages looked far more random, it needed two consecutive packets to respond, and repeated search attempts never got a response. The authors concluded it was enforcing its receiving window. Their summary of the two that failed:
Our results show the invalidity of the claims of such brands that they employ rolling code protocol.
Note what this is and isn't. It's one model of each brand, bought in Canada, tested by one lab in 2022. It is not a ranking of brands today, and I don't know whether those models changed after disclosure. What it shows is the general point: the phrase on the box and the behavior at the door are separate facts.
This is the part I understand from the other side of the radio. Also in 2015, Kamkar presented RollJam at DEF CON. As the thesis explains it, a small device near the garage jams the opener's receiver while recording your remote. You press, nothing happens, and the device keeps your unused code. You press again, it records the second code too, then stops jamming and replays the first one. The door opens. You shrug and drive in. The device still holds a valid code the opener has never seen.
The thesis gives the trick that makes it work: the opener's receiver listens across a fairly wide band, so a jamming signal just off the center frequency drowns it, while the attacker's own receiver filters narrowly and hears your remote fine. That's not a cryptography failure. It's a selectivity mismatch, the kind of thing electronic warfare is built on. A one-way remote has no way to know its message was never received.
The thesis also notes that while many of these systems are one-way, some are two-way, which allows challenge-response authentication: the opener asks a fresh question and the remote has to answer it. My reading, not the thesis's finding, is that this is where the fix for jam-and-replay lives, because a code captured earlier is worth much less when the question changes each time. A one-way rolling code can only hope its message landed.
Many rolling-code products don't design their own cryptography. They use a chip family such as Microchip's KeeLoq. In 2008 Eisenbarth and colleagues showed, using power analysis on several commercial KeeLoq products, that a remote's key could be recovered from about ten power measurements. With more work they extracted the manufacturer key stored in a receiver. Once an attacker has that, their abstract says, a remote can be cloned "just by eavesdropping at most two messages." I've read their abstract, not their full paper, and I'm not claiming any current opener uses the vulnerable designs. The lesson is about what "encrypted" depends on: a secret that has to stay secret on every device sold.
I help design the AI security systems for a veteran-owned (SDVOSB) home-security company run by fellow veterans. I do not own that company and earn nothing from this link. Full policy here.
My background is counter-IED and electronic warfare, where jamming a receiver while listening to the transmitter is ordinary tradecraft, not a hack. The same physics shows up in the report on radios that silence wireless alarms and in the one on hands-free unlock relay attacks. Consumer radio security is usually designed against the eavesdropper. It's less often designed against someone who can also transmit.
Today's products. The test covered three specific models in 2022. I didn't find a public record of how the manufacturers responded, or whether firmware or hardware changed. Don't read this as a statement about any brand's current openers.
One recording versus fifteen. The authors say their attack works after sniffing one open or close signal. They learned the message structure from 15 recordings of their own remote first. Both statements are theirs, and both are in the thesis.
RollJam's details. I describe RollJam from the thesis's account and Kamkar's own page, which confirms he presented it at DEF CON 23. I didn't watch the talk, and I'm not stating which specific products it worked on.
KeeLoq. I read the 2008 paper's ePrint abstract and record, not the full text. I don't know which current openers, if any, use the attacked designs.
Not my research. I didn't test any opener. My published work is in microwave spectroscopy. The measurements here belong to Ghanem and AlTawy, Kamkar, and Eisenbarth and colleagues.
A rolling code is a promise about replays, and against a simple replay it's a good one. It isn't a promise that the product implemented the protocol well, and a 2022 test found two of three that didn't. It was never a promise against someone who jams the door while recording your remote, because a one-way remote can't tell its message didn't arrive. Ask whether your remote is two-way, retire anything with switches inside it, and put a sensor on the garage door so the radio isn't the only thing standing guard.
Scope note: this report summarizes published, responsibly disclosed security research at a general level. It contains no attack instructions and is not a rating of any manufacturer's current products. Jamming radio signals is illegal in the United States. Disclosure: the author helps design AI security systems for a veteran-owned home-security company, as stated in the body of this report, and does not own that company.
U.S. Army combat veteran (Counter-IED / Electronic Warfare), peer-reviewed researcher in microwave spectroscopy, and founder & CEO of Shroombiosis. Consults on laboratory operations, AI, and supplement formulation.