What is a rolling code on a tag?
A value the chip produces afresh on each read, so that a value captured once is already spent when somebody tries to use it. It defeats replay, which is the attack where an exchange is recorded and repeated. It does nothing about somebody who has the tag in their hand.
What it does
Each time the tag is read, the chip produces a value that has not appeared before. The reader does not have to ask anything special; the value simply differs.
Commonly the value is combined with a counter, so that the receiving side can tell not only that this read is new but roughly how many reads have happened.
The consequence is that a value observed once is worthless afterwards, because presenting it again presents something already seen.
What the other side needs
Something that remembers. A rolling value only means anything to a verifier that knows which values have already appeared, or that can compute what the next legitimate one should be.
That is a service holding a secret and a record, which is the same infrastructure requirement every authentication scheme has and the same one every evaluation underestimates.
A rolling value read by something with no memory is a number that changes, and a number that changes is not a security property.
What it stops and what it does not
It stops replay: recording an exchange and repeating it later, which is otherwise the cheapest attack against a tag that says the same thing every time.
It does not stop somebody who has physical possession, because they can simply read the tag again and obtain a fresh value.
It does not prove anything about the item the tag is attached to, for the same reason no chip mechanism does.
And it does not help if the verifier accepts an old value anyway, which is a configuration question rather than a chip one.
The failure mode to plan for
Counters drift. A tag read repeatedly out of contact with the verifier advances beyond what the verifier expects, and a strict verifier then rejects a genuine tag.
Every deployment meets this, usually through a tag being tested during installation or read by curiosity before it goes live.
So the verifier needs a tolerance window and a defined way to resynchronise, decided before deployment rather than during the first incident.
A scheme with no answer to a legitimate tag that fails will be switched off the week it starts rejecting customers.
Frequently asked questions
Does a rolling code stop cloning?
It stops a recorded exchange being replayed. It does not stop somebody holding the tag and reading it again.
Do I need a service to use one?
Yes. The value only means something to a verifier that remembers what it has seen or can compute what comes next.
What happens if the counter gets ahead?
A strict verifier rejects a genuine tag. Plan a tolerance window and a way to resynchronise before deploying.
Is it the same as authentication?
It is one family of it. The other sends a challenge the chip must answer, which needs no counter tracking.