Honda has a series of key-fobs with the KR5V2X FCC ID that has been used since MY2013.5. It is used in Civic, Clarity, Accord, Odyssey, and others. This post is a summary of what I've been able to figure out based on documentation I've found online. My particular interest is in the availability and compatibility of key fobs, for a MY2018 Honda Clarity Touring: Are key fobs for other subvariants usable with the Clarity Touring? Does the car actually support up to 6 fobs? Can "Driver 1" fobs be programmed as "Driver 2" and vice versa? Does it really not implement rolling codes or other mitigations of replay attacks? (see CVE-2019-20626) Key Fob Variants 72147-TRT-A01: Clarity Fuel-Cell (driver 1) 72147-TRT-A11: Clarity Fuel-Cell (driver 2) 72147-TRW-A02: Clarity Plug-In Base 72147-TRW-A11: Clarity Plug-In Touring, Electric (driver 1), discontinued 72147-TRW-A21: Clarity Plug-In Touring, Electric (driver 2) 72147-TRW-A22: Clarity Plug-In Touring, Electric (driver 1) Key Fob Details The bare PCB for these sub-variants is identical, but they are loaded with different button positions. There are different variants of the fob (KR5V1x, KR5V2x, KR5V3x, KR5V4X). It's unclear if there are firmware differences in the fob's NXP ACTIC-4G 1D (NCF2952) microprocessor. V1x and V3x transmit at 313.55 and 314.15 MHz. V2x and V4x transmit at 433.66 and 434.18 MHz. All use FSK modulation (perhaps with Manchester encoding?). The fob also has a set of three low-frequency antenna coils (one in each axis: X,Y,Z) for short-range detection. I imagine that they used for sensing the distance of the fob from various sensors, but perhaps it can also be used to wirelessly power the fob when it is close to the ignition button (used in case the fob's battery is dead) and disable the immobilizer. Service manual 3323 (Keyless Access System Description) for the Clarity states that "The body control module can store up to 6 remotes with the HDS.", so I guess this applies to all trim levels. AFAIK, key fobs cannot be paired with the car without using an OBD II/CAN diagnostic tool (e.g., with i-HDS software). Replay Attacks https://medium.com/@victor_14768/replay-attacks-en-autos-206481dcfee1 https://nvd.nist.gov/vuln/detail/CVE-2019-20626#vulnCurrentDescriptionTitle https://hackaday.com/2021/08/30/hacker-claims-honda-and-acura-vehicles-vulnerable-to-simple-replay-attack/ https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty The hardware itself is completely capable of rolling codes or more advanced cryptography such as RSA.
