Disclaimer & Responsible Disclosure
Published solely for academic study and defensive security research. System identifiers (`V1004XXX`) and key metadata are partially redacted. No working exploits, key-recovery tools, or unlock-emulation code are provided. The author assumes no responsibility for unauthorized exploitation.
Black-box cryptographic analysis of the ASSA ABLOY VERSO® CLIQ 1-Wire protocol. By analyzing captured unlock sessions across multiple keys, we definitively identified the authentication primitives (SHA-1 MAC and AES-128 stream encryption), proved the statistical uniformity of the challenge-response engine, and uncovered high-impact structural vulnerabilities — including real-time radio relay susceptibility with zero distance bounding.
Every observed unlock attempt takes approximately 7.6 milliseconds end-to-end (255 total bytes) across a strict 4-phase transaction sequence. Command packets increment sequence markers from 01 to 04:
CMD 0x01)V1004XXX in unencrypted ASCII, followed by 7 static padding bytes and a 6-byte counter/key-ID region. The lock echoes its own identity block to establish mutual recognition.
CMD 0x08)CMD 0x0A)00 00 00 00 00 00 00 00). If valid, the lock returns an accept status 0x11; if invalid, it immediately rejects with 0x21.
CMD 0x80)Command 0x80 and the exact 20-byte hash + 2-byte device status match the Maxim/Dallas DS28EC20 hardware engine. MAC entropy across sessions reaches 6.55 bits/byte with 20/20 dynamic bytes.
ASSA ABLOY documents 128-bit AES. Our observation of exactly 24 bytes ciphertext + 8 bytes plaintext zero framing rules out standard CBC + PKCS#7, pointing to CTR, CBC-zero-pad, or CBC-CTS mode.
Mean Hamming distance across paired MAC outputs is exactly 50.04% with a per-bit flip probability of 0.5004 — demonstrating ideal avalanche behavior across random multi-bit differentials.
Every packet concludes with a trailing byte. Extensive brute-force over the entire 2^17 CRC-8 parameter space returned zero matches, indicating a non-standard checksum or truncated hash used strictly for error detection.
To verify whether the SHA-1 MAC leaks input correlations or exhibits structural bias across challenge nonces, we conducted exhaustive statistical testing using exact Student's t distributions (df=4):
When challenge nonces differ by 8 to 73 bits, the resulting MAC output change consistently falls between 31% and 51% (averaging 50.04%). The correlation between input differential magnitude and output differential magnitude is virtually zero (r = -0.069), confirming that output differences are statistically independent of how many nonce bits changed.
Testing all 176 pairwise byte combinations between Nonce[0..7] and MAC[0..21] yielded 7 uncorrected p-values below 0.05 (expected false positives: 176 × 0.05 = 8.8). When subjected to rigorous **Bonferroni correction** (α = 0.000284) and Benjamini-Hochberg FDR (q = 0.05), zero correlations survive.
Statistical power transparency: At sample size n=6, the power to detect a correlation of |r| = 0.9 is 14%, and 80% power requires |r| ≥ 0.989. This proves that while no linear correlations exist above 0.99, larger capture sets (50+ sessions) are recommended for high-resolution side-channel/correlation bounds.
Even with solid SHA-1 and AES-128 primitives, protocol-level architectural decisions expose critical vulnerabilities in real-world physical security deployments:
The complete four-phase transaction requires ~7.6 milliseconds with no round-trip timing enforcement. An attacker operating two low-latency radio transceivers (e.g., 433 MHz or fast WiFi bridge) placed near the key and lock can relay the entire challenge-response in real time. This unlocks the door without breaking or knowing any cryptographic keys.
The System Number V1004XXX and static Key Identifier bytes (positions 27–28) are broadcast in unencrypted ASCII twice during Phase 1. Passive contact eavesdropping allows adversaries to fingerprint enterprise installations and track individual employee key usage across facilities.
Because the DS28EC20 SHA-1 engine computes a deterministic MAC over (secret_key, nonce, page_data), captured real-world pairs enable offline dictionary attacks. If older 32-bit secret keys are deployed, a single GPU can exhaust the entire keyspace in minutes without touching the lock again.
Longitudinal comparison proves that captures recorded in 2014 match the exact framing, command byte sequence, and structure of captures recorded in 2024. Any architectural flaw discovered applies universally across at least a decade of deployed infrastructure.
The ASSA ABLOY VERSO CLIQ protocol implements mutual challenge-response authentication using Maxim DS28EC20 SHA-1 and AES-128 stream encryption with excellent statistical independence. However, the lack of distance bounding leaves the physical lock vulnerable to real-time relay attacks, while plaintext system and key identifiers expose deployments to tracking risks.