Transponder question

[GingerMagic]

Hi everybody, I am trying to understand how the transponder works, please correct me if I am wrong.

The transponder ring detects the chip in the key then gives the ECU the 'go-ahead' to turn off the immobiliser, yes?

So, when I program the remote locking to the car, is it the transponder ring that detects the signal or another part of the car?

What is to stop me using the transponder ring, key chip and remote key in another PSA without a remote key? i.e put the non-remote blade into a remote fob with matching chip and ring, then program the remote to the car?

[MixMan]

I believe that the transponder for the imobiliser and the central locking are two seperate things. The transponder chips communicates with the engine ECU and the electronics in the key communicate with the BSI. You would need to take the ECU (The chip is unique to this) and BSI, with the key innards Chip in the key is a one time programable item, however a new key can be coded if you have the 4-digit pin code) and swap the blade over. The transponder ring is not needed to be changed as its just an ariel.

[jonsowman]

This was what I reconstructed as the authentication process from reading datasheets a while back...

Well, since you asked...

The key has the ID46 unit which has an ID number which is unique to each device, and a secret key, which is 48 bits and is written once and can never be modified thereafter.

On the assembly line
The BSI is told the VIN and the 4 digit security code. It uses these two bits of information to generate the secret key, which is transmitted to the ID46 and stored, and thereafter locked. The ID46 sends its ID number back to the BSI, which stores it in a list of authorised keys. The BSI also creates and stores a random 24 bit transponder password which is stored alongside the ID number in the BSI and is also transmitted and stored in the ID46.

In general usage
For start authorisation, the car transmits a "hello" to the ID46, which replies with its ID number. If this ID number matches one of the ones the BSI authorised keys list, the process continues. Otherwise, we abort due to authorisation failure.

Assuming we pass that stage, the BSI calculates and transmits a 32 bit random number and a 32 bit signature. This signature is the random number combined with the secret key in some algorithmic manner. The secret key itself is never transmitted by either party.

The ID46 then uses its secret key to verify the signature - it carries out the same algorithm on the random number using the secret key, and if the result is the signature, then the vehicle is the one we're looking for. If not, authorisation failure and the ID46 will refuse to give any information.

Now both "sides" know that they're talking to an authorised partner. The ID46 transmits a ciphered version of the transponder password, which the BSI decrypts using the secret key. If the result is a transponder password that the BSI has stored alongside the corresponding ID number, then we have an authorised vehicle start.

PP2000 reprogramming regenerates the list of authorised ID46 ID numbers that can start this vehicle. The SK cannot be overwritten, but it is the same, since it is a pure function of the VIN and the 4 digit code.

Well, you did ask...

[gumby6371]

A friend swapped the ring and barrel on a 306 after the barrel broke and that worked so can't see why just changing the ring wouldn't if you have the transponder chip.