Cracking cryptographically enabled RFID to bypass automobile imobilizers

Here's proof that rolling your own crypto is not a good idea. Attacking an unpublished proprietary cipher that uses a 40-bit key on the Texas Instruments DST RFID, some students at Johns Hopkins University built a system to break the keys on many vehicle imobilizers and the ExonMobile SpeedPass system for refueling stations. The result? They were able to start a car with a DST simulator and then go get themselves some free gas.

They even have some good videos showing their methods. Their response on what could be done to fix this?

The most straightforward architectural fix to the problems we describe here is simple: The underlying cryptography should be based on a standard, publicly scrutinized algorithm with an adequate key length, e.g., the Advanced Encryption Standard (AES) in its 128-bit form, or more appropriately for this application, HMAC-SHA1.

I love this stuff. I wish I could go back to school and work on this. :)