How software-defined radio exposed weak wireless keyboard security
Long before Bluetooth Low Energy keyboards became standard, many wireless keyboards communicated over simple radio links in unlicensed bands, with encoding schemes designed for reliability rather than security. That combination, convenient for the manufacturer and largely invisible to the user, left keystrokes travelling through the air with little standing between them and anyone who could receive the signal.
Why the radio layer mattered
Many of these devices used a simple line-coding scheme, such as Miller encoding, to represent bits as radio transitions. That scheme is well documented and was never intended as a security measure; it is a way of representing data reliably over a noisy radio channel, not a cipher. Decoding it correctly reveals the raw keystroke data, because there was little or nothing encrypting it underneath.
What software-defined radio changed
Before affordable, general-purpose radio receivers existed, intercepting this kind of transmission needed hardware built specifically for the frequency and modulation in use. Software-defined radio paired with open signal-processing toolkits moved that work into software: tune the receiver to the right frequency, apply the known line-coding scheme in software, and the keystroke stream falls out the other end. The research effort shifted from building specialised hardware to writing software against a general-purpose receiver, which is a much lower barrier.
The defender's takeaway
A wireless peripheral's security has to be judged by what protects the radio link, not by the complexity of its physical transport. A keyboard that merely transmits on an unusual frequency, or encodes bits in a non-obvious way, is relying on obscurity that general-purpose radio tooling erodes a little further every year. Genuine protection requires actual cryptographic authentication and encryption of the keystroke stream, regardless of which frequency or encoding carries it, which is what later wireless keyboard standards moved toward.
What changed afterwards
Vendors eventually moved toward protocols with proper cryptographic authentication and encryption built in from the start, rather than relying on the link being hard to find or hard to decode. The lesson generalises well beyond keyboards: any wireless peripheral, from a mouse to an industrial sensor, should be evaluated on whether its data is actually encrypted, not on how unusual its radio link happens to be.
Key takeaways
- Early wireless keyboards often used simple radio encoding with little or no real encryption.
- Line-coding schemes like Miller encoding exist for reliability, not security, and are well documented.
- Software-defined radio turned intercepting these signals from a specialised-hardware task into a software one.
- Obscurity in frequency or encoding is not a substitute for real cryptographic protection of the data stream.
- Later wireless keyboard standards addressed this by adding genuine encryption at the protocol level.
This note has been rewritten and checked for this edition; it is not a copy of the original post.