Using remote controls to switch something on or open your garage is a piece of cake.
Doing this automatically without touching anything is a little bit cooler. And doing
it like James Bond, with an ESP32 Watch and completely encrypted? Let s have a closer
look at how this can be done and how we can build secure transmissions for other projects.
Gr ezi YouTubers. Here is the guy with the Swiss accent. With a new episode and fresh ideas around
sensors and microcontrollers. Remember: If you subscribe, you will always sit in the first row.
Influencing things over distance is covered in many videos. This is why we will look at
three not so standard methods to do so: - Switch something automatically when a
Smartphone is in its proximity - Use ESP32s or ESP8266s
to build an encrypted Wi-Fi remote with AES128 - And package the transmitter James Bond like
It all started with a comment from David Chatting where he announced his Approximate library
for building proximate interactions between your Internet of Things and the ESP8266 or ESP32 .
In video #163, I did a similar thing, but for detecting intruders in your home.
For that, an ESP32 monitors Wi-Fi frequencies and, if a foreign address appears too close,
creates an alarm. David does the contrary: He searches for known devices and, if close enough,
switches a light on, for example. The library supports different scenarios.
I built myself the most obvious one: A simple Sonoff switched on when my Smartphone appears in
its proximity a perfect switch for a dark stair or a basement. It works very well but has some flaws:
Because it uses an ESP chip, it only works on 2.4GHz. If you have a 5G network in your home,
you would have to switch your Smartphone to the 2.4GHz net. And I already hear the
voices of my security-sensitive viewers: A MAC address easily can be faked.
If used to switch the basement light, I would not be too concerned. But I would not use it
to open my garage door, for example. Because of these two flaws, I started
to think about what could be done. Most remote controls shown on YouTube
use the same technology as old garage door openers. They transmit a code
to open the door. If we receive and hack this code, we can build a fake transmitter,
as I did in video #44. This fake remote still works under the saddle of my Harley and opens the
garage whenever I approach it. My fellow riders always are astonished why the door knows me
This is called a simple replay attack and is a significant security flaw.
Modern garage door openers use rolling codes. This is a simple encryption. The basic
idea is that the transmitter changes its code with every transmission and encrypts it. The
receiver decrypts the received code and, if it is what it expects, opens the garage.
This works perfectly when the transmitter and the receiver are synchronized.
With remote controls, packets can get lost if you press open away from the receiver, for example.
Then the transmitter numbering is ahead of receiver numbering.
This is why these receivers typically accept codes that are up to 256 places ahead.
I wanted to build a similar system with ESPs. But, as usual on this channel, we want more.
Because the ESPs are potent processors, I decided to use a full-blown AES128 encryption for our
project. This is a very safe encryption and probably an overkill for a garage door opener
because it takes a few million years to crack it with current computers.
But maybe you can use it for other projects where encryption is more important.
How can we build such a system? For transmission, I decided to use ESP Now.
It creates an ad-hoc connection between two nodes and is entirely independent of a Wi-Fi network.
And I found an AES128 encryption library. ESP now also works between ESP8266 and ESP32s. It
is based on the MAC address of the transmitter and the receiver. If we use the example sketch of the
ESP8266, we have to add the MAC addresses in our sketches. With the example sketch of the ESP32,
we even get auto-discovery, and we do not need to add MAC addresses into our sketches.
As a first test, we transport this Hello world from the remote control to the
receiver and trigger an LED when received. Already something. Not secure, for sure, because a bad guy
just has to wait behind the garage and record the MAC address and the keyword and replay it
when we are away. What about encrypting the Hello World message? Would that help? Not at all. The
attacker would just replay the encrypted string, and the garage door would open without a problem.
What to do? If the transmitter encrypts a different message for each transmission, recording
messages will not help because, as we said, every message is different. Right? Let s try. But how
does the receiver know which message was sent to decide if it came from the right transmitter?
I used a straightforward concept: The transmitter has a counter, encrypts the number, and transmits
it to the receiver. The receiver decrypts it and compares this number with the last one it
received. Suppose it is higher than the one before it opens the garage. If it is the same as before,
it knows it is a replay attack. The counter is an unsigned long variable.
So you can open your garage many times before your remote will transmit the same code again.
The attacker now has to be more sophisticated and also needs your help to hack your garage.
He could milk your remote controller when you are away from your garage and get messages which
are not yet known by the garage door opener. Later he could use it for a replay attack. But
as said, somebody has to press the open button on your remote for this attack.
I stick with this method because it is good enough for the girls I go out with
And I am sure we will get enhancement proposals in the comments. For example,
to use two-way communication between the receiver and the transmitter for synchronization.
So the remote controller counts up, encrypts the number, transmits it to the garage door opener,
and saves it to EEPROM. As usual with Arduino sketches, we need some transformations between
the different formats of the variable. And, because the AES128 library expects a multiple
of 16 bytes, we have to fill or pad the array with zeros before encryption.
I created a file called AES128, which includes more or less the simple example file of the
library. Like that, the transmitter, as well as the receiver sketch, uses the same key. And,
if you want, you can change the initialization vector to make it even more secure.
The receiver decrypts the message and compares it with its last received value.
This value is also stored in EEPROM to protect against power outages. If the new value is bigger
than the last one, it stores the latest value in EEPROM and opens the garage. This goes on
for the next 1000 years or so till the counter reaches its end and has to be resynchronized.
You do not need to start with a counter value of zero if you feel safer. If you connect the
pairing pin with GND, the receiver stores the following number and synchronizes the two.
You can use any ESP8266 or ESP32 as a transmitter. A simple solution could be to use an ESP-01,
as shown in video #101 or #108. Both have a button to open your garage and a long battery life.
But let s assume you are Q and wanted to create a cool gadget for James Bond?
Then such a simple button for sure is not the right thing. We need at least a watch
with integrated AES128 encryption. Fortunately, I have one shown in my last mailbag.
It is no Swiss watch, but because it has a built-in ESP32, we can create a similar sketch
and use it as a remote controller. How cool is that? Of course, you could integrate the sketch
into the full-fledged smartwatch project. I leave you a link in the description to its Github.
And anyway, you find a link to all sketches used here. They are not very polished because I am sure
you will use these technologies for much more creative applications than just a garage door
opener or to switch an IKEA lamp. So comes the last question:
What should we remember? - David s Approximate library
is helpful to detect Wi-Fi devices around you and monitor their behavior. It even can be connected
to your MQTT broker - Using it for
switching things is not very secure - Simple remote controls are prone to replay
attacks because they always use the same code - Remotes using rolling code are much better
in this respect because the effort for a hack is much higher. Unfortunately,
if you want to integrate them into your home automation system, it will not work
- We used the powerful AES128 encryption to create a very secure rolling code and built a transmitter
and a receiver based on an ESP32 or an ESP8266 - After synchronization,
the system works pretty safely - You can use a cheap ESP-01 as a transmitter
or a T-watch if you want to show off. The newest model has built-in GPS, and you can
create a geofence. Unfortunately, battery life is probably not too long in this application
That was all for today. As always, you find all the relevant links in the description.
I hope this video was useful or at least interesting for you.
If true, please consider supporting the channel to secure its future existence. Thank you! Bye