Prepared by:

Nesib Eyyubov
Xalid Isgandarov

Keelog technology and its

applications in remote
control systems
Microchip Technology has had a long history as a major supplier in the security
industry primarily utilizing our proprietary, royalty-free KEELOG technology, an
industry proven technology used worldwide by leading manufacturers, to provide
additional security to their applications for more than 15 years. This application note
gives a detailed description of Ultimate KEELOQ technology after reviewing the other
KEELOQ technology offerings from Microchip.

 KEELOQ technology is a “code hopping” technology, which means that each

transmission is unique (changes at every button press). At the core of this “code
hopping” technology is a counter that increments with each button press. An
encryption layer is then added to the packet. Such a system is known as an event-
driven one, the event being the press of a button on the transmitter. A timer is used
instead of a counter in the more advanced implementation of Ultimate KEELOQ
technology. This timer runs at the same rate with a similar timer on the receiver side.
Table 1 below shows a comparison table with all available KEELOQ technology
implementations.
 REVIEW OF CLASSIC KEELOQ TECHNOLOGY

• Synchronization counter - The synchronization counter is the heart of the hopping code
algorithm. It increments every button press. The synchronization information is used at the
decoder to determine whether the transmission is valid or whether it is a repetition of a
previous transmission. Repetitious codes are rejected to safeguard the system against code
grabbers. 
• Typical Packet - A typical Classic KEELOQ technology packet consists of two parts. One part is
being sent in plain text and the other is sent encrypted. Sending part of the message in plain
text allows for backwards compatibility with fixed code receivers. Some of the information that
is being sent in plain text is contained inside the encrypted section and can be used as a post-
decryption check.

• Serial Number - This is a unique number that is specific to each individual encoder. Its main
purpose is to differentiate between encoders. The encoder serial number is transmitted every
time a button is pressed. The serial number is transmitted unencrypted as part of the
transmission
 APPLICATION

• Automotive remote entry systems

• Automotive alarm systems
• Automotive immobilizers
• Gate and garage openers
• Electronic door locks
• Identity tokens
• Burglar alarm systems
• Remote control toys/fixed code applications
 FEATURES

A full perspective of the capabilities of the KEELOQ system would involve describing the
unique features of each device separately. However, the entire product range has certain
characteristics that may or may not be applicable to a specific member of the product
range. The most important characteristics are listed to enable the prospective user to get a
global view of the KEELOQ system. The specifications for a particular encoder or decoder
should be consulted to determine the applicability of these features to that device.
Encoders
Security Operating Other
• Programmable 28/32-bit serial number • One (3.0V) or two (6.0V) Lithium battery • On-chip EEPROM
• Programmable 64-bit encryption key operation • On-chip oscillator and timing
• Each transmission is unique • One (9.0V or 12.0V) Alkaline battery components
• 66/67 bit transmission length operation • On-chip reset circuit
• 32-bit hopping code • 3 or 4 button inputs - 7 or 15 functions • Button inputs have internal pull-down
• 34/35-bit fixed code (28/32-bit serial • Selectable baud rate resistors
number, • Automatic power down after • Current limiting on LED output
4/0-bit function, VLOW, Rpt/2-bit CRC) transmission
• Encryption key is read protectedc • Battery low signal transmitted
• Nonvolatile synchronization data
• IR modulation capability
 Decoders

Operating Decoder
Security • 2.0V to 6.0V operation • Single chip decoder available
• KEELOQ code hopping technology • 4 MHz RC oscillator • On-chip EEPROM
• Secure storage of manufacturers key • Learning indication • Four binary function outputs - 15
• Secure storage of transmitters keys • Auto baud rate detection functions
• Normal learning mode and Secure • One or two wire serial interface
learning mode • Battery low indication
• Four or more transmitters can be
learned

ENCODER
FUNCTIONS

General Description Unidirectional Authentication Bi-directional Authentication

The KEELOQ code hopping remote control Unidirectional authentication is used where it is Bi-directional authentication is used where a bi-
encoders are intended for secure remote control impractical or cost prohibitive to use a bi- directional link such as a direct connection is
systems. They are suitable for use in remote directional link such as remote keyless entry. In available. Bidirectional authentication mode
control applications using infrared (IR), this mode, an encoder functions as a code implements an IFF (Identification Friend or Foe)
microwave or other radio frequency (RF) generator for a transmitter. A suitable transmission system. In this mode, a 16/32-bit string (the
transmitters. The encoders have several basic medium (RF, ultrasonic, microwave, infrared, or challenge) is sent to the KEELOQ device. In the
modes of operation. Some of these modes may magnetic coupling) must be provided in addition device, an encryption operation is performed on
be combined in a particular device, and the to the KEELOQ encoder to implement a complete the challenge, using a 64-bit key. The resultant
means of selecting the mode may differ, but the link. The encoder is activated by a push button or 16/32-bit string (the response) is then transmitted.
principle of operation remains the same. by a magnetic field in the case of a transponder.. This 32-bit string is unique for a given challenge
and key. KEELOQ devices may contain several keys
 Decoders

Transmitter Activation

The encoder has an internal power switch which turns on when any of the button inputs are taken high. When a button is pressed, the encoder is turned on and the
inputs are sampled after a debounce delay. The encoder then transmits a code, based on the correct key, synchronization information, and function codes. If the time-out
option is selection, the encoder will shutdown after a complete transmission. This mode prevents battery depletion when a push button is inadvertently activated for an
extended period. To activate the device again, the buttons have to be released and activated again.

With 28-bit serial number selected:

With 32-bit serial number selected:

Three data rates are used: 833, 1667, and 3333 bits per second. At the lower transmission rate, a complete transmission requires approximately 100ms, at the higher rate
50ms, and at the highest rate 25ms. All encoders will transmit the codes repeatedly while the transmitter is activated.
 DECODER FUNCTIONS

General Description
The KEELOQ decoders can be used for secure remote
control systems. To gain a full understanding of the
modes of KEELOQ decoder operation, several concepts
have to be understood.
Decoder Features

Output Activation Learning

The function information contains information on the Learning is a feature of KEELOQ decoders that allows
buttons that were activated. The function code is the addition of new transmitters to the system without
embedded in the encrypted portion of the transmission having to reprogram the system from outside.
and is also transmitted in the clear if selected. The The decoder's learning capability simplifies replacement of lost transmitters.
decoder will activate the switch outputs corresponding When a transmitter is lost, the
to the switch inputs on the encoder as long as the transmitter is user can “teach” the decoder the key of a new transmitter. The previous
activated. A minimum activation time of 500ms transmitter's key will be written over,
is used to allow for dropout in the signal. Buttons are thereby excluding that transmitter from the system.
usually assigned to different functions. In a vehicle Once the self learning procedure has been followed,
alarm system one button might be used for arming and the receiver has learned the new transmitter's identity
locking, another for disarming and unlocking and a third and (if applicable) the output functions that have to be
for trunk release. If any button is activated for more than activated for that transmitter. The new transmitter may
say 2 seconds a panic siren can be activated. then be used normally to activate the decoder
 Decoder
Normal learning mode (Serial Number Derived)
• Transmission format in normal learn mode.

With 28-bit serial number selected:

With 32- bit serial number selected:

Operation The user places the decoder in learning mode. When the first code word is received, the serial number is used to generate the transmitter’s secret key that
was programmed into the transmitter during the production stage. The secret key is used to decrypt the hopping code. The decoder then waits for a second
transmission (must be activated a second time). The serial number is compared to the first received serial number. If equal the hopping code is decrypted and the
validation checks performed. The final check is to check that the codes are sequential. All the transmitter information is then stored.
 Decoder
Secure learn mode (Seed Derived)
• Transmission format in secure learn mode

With 32 bit serial number selected:

With 32- bit serial number selected:

Operation The user places the decoder in learning mode. During the first stage of learn, the user must press a specific button. The hopping code part of the
transmission will be replaced by the 32/48-bit seed stored in the encoder. The key is derived from the seed instead of the serial number in this case. During the second
stage of learning, any other button combination can be pressed. A normal hopping code transmission is sent during the second stage. The generated key is used to
decrypt the hopping code, and all the transmitter information is stored. Since the seed is only transmitted during the learning process, and is required to generate the
key a normal transmission cannot be intercepted, a key generated and the hopping code decrypted to predict the next hopping code. As a further security measure,
the transmission of the random seed can be disabled after 1 to 128 operations of the transmitter once the transmitter has been learned. That means that even if
someone had physical access to the encoder, it would not be possible to get the random seed which is needed for key generation. The disadvantage is that a
transmitter cannot be relearned at a later stage.
END