UDS SecurityAccess: how seed-key challenge protects the ECU and why "hacking" isn't that simple

Reading Coolant Temp via OBD-II — any ELM327 without a password. But writing a new VIN, resetting adaptation, calibrating ADAS won’t work. The difference is UDS SecurityAccess ($27) — the seed-key challenge mechanism. Below: how it works and why “cracking” it legally isn’t always right.

What SecurityAccess is

UDS (ISO 14229) defines service $27 SecurityAccess — client authorization before performing potentially dangerous ops. Logic:

1. Client (scanner): “Give me seed for level X”
2. ECU: generates 16-32-byte random seed, sends it
3. Client: computes key = f(seed, secret) where f and secret are manufacturer-secret
4. Client: “Here’s my key”
5. ECU: verifies (recomputes the same key from same seed), if match — grants access

The secret lives in the manufacturer, baked into diagnostic software (VW ODIS, BMW ISTA, Mercedes Xentry).

What requires SecurityAccess

Doesn’t require (default access):

• Read Data ($22) — standard PIDs
• Read DTC ($19)
• Clear DTC ($14) — mostly open
• Live monitoring

Requires SecurityAccess:

• Write Data ($2E) — writing VIN, coding, injector IMA
• Routine Control ($31) — ADAS calibration, DPF forced regen, ABS bleed
• ECU Reset ($11)
• Upload/Download ($34-$37) — ECU reflash
• Communication Control ($28) — disabling CAN messages

SecurityAccess levels

Manufacturers define several levels:

• Level 0 — default (Read-only)
• Level 1 — Basic Service (Reset, clear adaptations)
• Level 3 — Programming (flash ECU)
• Level 5 — Development (calibration parameters)

Each level has its own seed-key algorithm. Vice versa: Level 3 doesn’t grant Level 5 (even if ECU answers Level 3 seed, doesn’t mean you can flash calibration tables).

Seed-key reverse engineering

Legal:

• Research your own car for DIY mods
• Publish research (Bosch, Chris Valasek — well-known researchers)

Not legal:

• Selling “mileage rollback” via SecurityAccess bypass — odometer fraud is illegal
• Bypass for disabling anti-theft (criminal statute in many countries)
• Publishing specific manufacturer seed-key algorithms (DMCA takedown, hardware maker sues)

Known seed-key algorithms

Publicly known (leaked / reverse-engineered):

• VW / Audi Level 3 — old MED17: XOR-shift on 5 bytes (cracked in 2009)
• BMW E9x DDE (diesel ECU): CRC-16 based (cracked ~2015)
• Mercedes W204 EIS — HMAC-SHA1 with fixed secret (partially cracked)
• Modern (2020+): AES-128 with rotating key — practically unbreakable

What OBD-II gives without SecurityAccess

Everything a car owner usually needs:

• DTC read + Freeze Frame (see Freeze Frame post)
• Live parameters — LTFT, MAP, MAF, O2 (see Best PIDs post)
• Mode 06 — self-monitoring test results (see Mode 06 post)
• Read Coding info (no write)
• Clear codes (Mode $14 scope)

That’s ~95% of diagnostic volume.

What requires SecurityAccess (authorised shops only)

• ECU firmware
• Writing VIN (e.g. after ECU replacement)
• Injector IMA (see injector coding)
• ADAS calibration (see ADAS post)
• Active DPF regen (at least on VAG)

What Car Diagnostics does

We don’t do SecurityAccess bypass — it:

• May be illegal
• Not supported by stock ELM327
• Risk of bricking ECU

Our approach — maximum available without SecurityAccess: 95% of user diagnostics covered. Coding, flash, ADAS calibration — only at specialized shops with ODIS / ISTA / Xentry.

Try on free tier — pair an ELM327 adapter. Everything without SecurityAccess — available immediately. Deep diagnostics via Mode 22 (also no Security) — on paid tier.