> To be useful, T should be, say, 20ns or less, which requires a bit of clever crypto to make the actual exchange fast enough
I don't think you even need crypto on the actual exchange.
The car and the key fob could negotiate a pair of random values, R1 and R2, using an encrypted protocol so that eavesdroppers cannot figure out R1 and R2. This negotiation does not have to be particularly fast, so no need for anything clever. This is also where you would do authentication to prove to the car that it is talking to an authorized key fob.
For the actual distance measurement, the car sends a message containing R1 and the key fob responds with a message containing R2. Each R1/R2 pair would only be good for one try, so it doesn't matter if an eavesdropper sees the distance measurement attempt.
I don't think you even need crypto on the actual exchange.
The car and the key fob could negotiate a pair of random values, R1 and R2, using an encrypted protocol so that eavesdroppers cannot figure out R1 and R2. This negotiation does not have to be particularly fast, so no need for anything clever. This is also where you would do authentication to prove to the car that it is talking to an authorized key fob.
For the actual distance measurement, the car sends a message containing R1 and the key fob responds with a message containing R2. Each R1/R2 pair would only be good for one try, so it doesn't matter if an eavesdropper sees the distance measurement attempt.