Ultra-wideband technology is transforming keyless-car security by measuring the precise distance between a vehicle and its authorized device, solving the relay-attack vulnerability that plagues conventional passive entry systems. By combining cryptographically protected time-of-flight measurements with location-aware access policies, UWB enables vehicles to verify not only that a valid key is present but also that the key is physically close enough to authorize unlocking, engine start, and other functions.

Key Takeaways

• Relay attacks exploit traditional keyless systems by forwarding signals between a car and distant key fob, making the vehicle believe the key is nearby even when it's inside a home.

• UWB measures time of flight with centimeter-level accuracy, verifying the physical distance between the vehicle and authorized device to prevent signal relaying.

• Digital Key 3.0 combines Bluetooth Low Energy for discovery, UWB for secure ranging, and NFC for backup access, enabling smartphones to function as passive car keys.

• Multiple vehicle-mounted UWB sensors enable location-aware authorization, allowing context-specific actions like unlocking only the nearest door or preventing engine start when the key is outside.

• UWB is a major improvement against proximity fraud, but comprehensive security requires defense-in-depth architecture including secure elements, encrypted communications, and firmware integrity checks.

UWB's Precision Distance Measurement Solves the Relay-Attack Problem That Plagues Conventional Keyless Entry

Traditional passive keyless-entry systems verify that a valid key signal exists without accurately measuring how far away the key is. Vehicles equipped with these conventional systems authenticate the cryptographic credentials broadcast by a fob but rarely confirm the fob's actual physical proximity. This fundamental limitation creates an opening for attackers who can exploit the gap between signal authentication and distance verification.

Criminals exploit this weakness through relay attacks, also known as keyless car theft or RF relay attacks. In a typical scenario, one attacker positions a device near the parked vehicle while an accomplice stands close to the owner's key fob, which may be resting on a table inside a home. The two devices capture and extend the communication between the car and key, making the vehicle believe the fob is nearby even though it remains dozens of meters away. Signal relaying doesn't require breaking encryption or cloning credentials—it simply forwards legitimate exchanges between the car and its authorized key.

Ultra-wideband is a short-range wireless technology that measures the time of flight, which is the time required for a signal to travel between a vehicle and a key fob or smartphone. The system transmits precisely timed radio pulses across a broad frequency range, records when each pulse is sent and received, and converts that travel time into a distance measurement using the known speed of light. This approach transforms vehicle access from a simple presence check into a verified proximity confirmation.

The Car Connectivity Consortium identifies UWB secure ranging as a core technology in Digital Key 3.0, achieving accuracy better than 5 centimeters in typical applications. Conventional systems ask "Is a valid key signal present?" while UWB adds the critical follow-up question: "Is the key physically close enough?" Vulnerability still depends on system architecture, cryptography, distance checks, and implementation—not every non-UWB system is automatically insecure, and some manufacturers have deployed additional protections within traditional RF frameworks.

How UWB Cryptographically Secures Distance Verification Using IEEE 802.15.4z and Protected Timestamps

UWB uses extremely accurate timing to measure propagation delay, sending a signal and recording when it is transmitted and received to calculate distance using the fact that radio waves travel at approximately the speed of light. The basic calculation follows the formula: Distance ≈ (signal travel time × speed of light) / 2 for a round-trip measurement. Because the calculation is performed in tiny time intervals, even delays of a few nanoseconds indicate that a device is farther away than claimed.

Secure two-way ranging measures communication in both directions, using round-trip time, time of flight, and distance bounding to establish whether a device is within an allowed proximity zone. This bidirectional verification makes it significantly harder for an attacker to manipulate timing data, because the vehicle and key must exchange signals in a tightly synchronized sequence. An attacker attempting to relay or delay those signals introduces measurable latency that falls outside the permitted distance threshold.

The IEEE 802.15.4z standard provides enhanced UWB physical-layer security and protected ranging capabilities. Scrambled Timestamp Sequences protect timing information from manipulation by encrypting the timestamps themselves, making it difficult for attackers to modify the timing exchange without detection. These cryptographic protections address the fact that relay attacks don't necessarily require decrypting the key's secret credentials—they can succeed simply by forwarding legitimate exchanges if distance verification is absent or weak.

Security still depends on correct implementation, secure firmware, protected keys, tamper resistance, and the vehicle manufacturer's complete architecture. UWB ranging significantly raises the bar against relay attacks, but it doesn't make every attack impossible. Manufacturers must combine accurate distance measurement with secure elements, authenticated firmware, and intrusion monitoring to build a complete defense-in-depth system.

Car Connectivity Consortium Digital Key 3.0 Enables Smartphone-Based Passive Access With UWB, BLE, and NFC

The Car Connectivity Consortium developed an open Digital Key specification that enables smartphones and other smart devices to function as vehicle keys. Digital Key 3.0 adds passive, location-aware keyless access using Bluetooth Low Energy together with UWB, allowing drivers to unlock and start compatible vehicles without removing a smartphone or smartwatch from a pocket or bag. This approach combines the convenience of traditional passive entry with the security advantages of cryptographic distance verification.

Bluetooth Low Energy handles discovery, initial communication, and establishing trusted connections between the vehicle and authorized device. After the device is discovered and authenticated over BLE, UWB performs the precise ranging and positioning step to confirm physical proximity. Near-field communication provides close-contact access and may remain useful when a phone battery is low, depending on the vehicle and digital-key implementation.

The three technologies serve complementary roles in the access sequence:

• BLE manages discovery and low-power communication.

• UWB delivers precise distance and location verification.

• NFC offers very short-range backup access and low-battery functionality.

Digital Key 3.0 supports a range of features including key creation, authentication, sharing, transfer, revocation, termination, secure-element storage, and location-aware vehicle functions. Compatibility depends on the vehicle model, smartphone hardware, operating system, UWB chipset, and manufacturer implementation. Not every vehicle supports Digital Key, and not every phone includes the necessary UWB radio and secure-element components.

Multi-Sensor UWB Positioning Enables Context-Aware Vehicle Access and Location-Based Authorization

A single UWB sensor can measure the distance between the vehicle and the authorized device, but multiple vehicle-mounted UWB transceivers can estimate the device's position relative to the vehicle. This multi-anchor approach enables the car to distinguish whether the device is outside near the driver's door, near the trunk or rear hatch, inside the cabin, or outside but too far away for authorization. Spatial awareness transforms access control from a binary yes-or-no decision into a context-sensitive authorization framework.

Location awareness supports context-specific actions that improve both convenience and security. The vehicle can unlock only the nearest door when the driver approaches from the side, open the trunk automatically when the device is detected behind the vehicle, or prevent engine authorization when the key remains outside the cabin. These location-based policies reduce the risk of accidentally starting the vehicle when the authorized device is outside, which can help prevent the driver from leaving the key behind.

According to the Car Connectivity Consortium, UWB maintains highly precise ranging in fog, smoke, rain, and multipath reflective environments. Vehicle interiors and exteriors create challenging radio conditions because metal surfaces generate reflections and multiple signal paths. Multipath propagation means the receiver detects signals that reflected off the vehicle body or nearby objects in addition to the direct signal, requiring advanced signal processing, careful antenna placement, calibration, and multiple measurements to maintain reliable accuracy.

The "better than 5 centimeters" accuracy figure is a typical Digital Key application standard cited by CCC, not a universal guarantee across all conditions and implementations. Compare UWB's centimeter-level ranging with ordinary signal-strength methods, which estimate proximity indirectly and can be affected by walls, body position, antenna orientation, and environmental interference. UWB's time-based measurement provides a fundamentally more accurate and attack-resistant foundation for spatial authentication.

Complete Security Architecture Combines UWB Ranging With Authentication, Encryption, and Access Policies

UWB ranging is one layer of a secure vehicle-access system that requires defense-in-depth automotive cybersecurity. A complete architecture combines device and vehicle mutual authentication, secure elements or trusted execution environments, encrypted communications, fresh session keys and anti-replay protections, cryptographically secured time-of-flight measurements, firmware integrity checks, access authorization policies, and key revocation and lifecycle management. Each layer addresses a different class of threat, and removing any single protection can reintroduce vulnerability.

According to CCC materials, ranging keys can be derived from the Digital Key authentication handshake and stored securely in a secure element. The vehicle should authorize an operation only when both conditions are met: the digital credential is valid, and the device is within the permitted physical zone. This dual-gate approach ensures that proximity alone cannot grant access, and valid credentials alone cannot bypass distance verification.

The typical access sequence follows this flow:

• BLE discovers the device and initiates communication.

• The system authenticates the candidate digital key using cryptographic credentials.

• UWB activates for secure distance and location verification.

• The vehicle authorizes the requested action if policy and proximity requirements are satisfied.

Ranging is triggered selectively after a trusted BLE car-device relationship is established, limiting unnecessary ranging activity and conserving battery power. UWB is designed for precise measurements without continuous high-power transmission, but power consumption varies by chipset, duty cycle, antenna design, software implementation, and device type. Selective ranging ensures that the UWB radio operates only when needed, balancing security, accuracy, and energy efficiency.