Classic CAN has no built-in authentication or encryption. Any node that can place frames on the bus can send them, and receivers cannot tell a genuine sender from a forged one. The protocol was designed for reliable wiring inside one vehicle, so security has to be added by the applications above it.
Where CAN came from
Bosch began developing CAN in 1983 and released it in 1986. The goal was to replace bulky point to point wiring with one shared twisted pair that many control units could use. Mercedes-Benz's W140, from 1991, was the first production car with a CAN based multiplex wiring system, according to the Wikipedia history of the protocol.
That history explains the design. The bus was a closed wire inside a metal box on wheels. The threat model was electrical noise and faulty nodes, not an attacker with a laptop.
What a CAN frame carries
A classic CAN frame has an 11 bit or 29 bit identifier and up to 8 data bytes, plus a CRC and an acknowledgement slot. The identifier says what the message is about, not who sent it. There is no sender field, no signature and no counter.
The CRC protects against accidental bit errors. It is not a message authentication code, because anyone can compute it.
Arbitration makes spoofing easy to reason about
When two nodes transmit at once, the one with the lower identifier wins and the other backs off. That is how CAN stays orderly without a central controller. It also means a node that sends a very low identifier often can crowd out others. Fault tolerance in the protocol handles broken nodes, but it does not judge intent.
What follows from this
Wikipedia states it directly: an attacker who can insert frames onto the bus can intercept or inject messages, so applications must add their own security measures. In practice that shifts attention to three questions.
- Who can reach the bus physically or logically? Diagnostic ports, telematics units and infotainment systems are the usual bridges.
- Are critical networks separated from exposed ones, with a gateway that filters what crosses?
- Do the most important messages carry some cryptographic check at the application layer?
The AUTOSAR partnership, which publishes standards for automotive control unit software, notes that its Adaptive Platform needs secure on board communication. The details of any particular scheme should be checked in the specification you use.
What this does not mean
It does not mean every car can be driven remotely by anyone. Reaching the bus is the hard part, and layered defences such as gateways exist for that reason. It also does not mean CAN should be abandoned. Newer variants like CAN FD keep the same trust model, so the same advice applies.
Quick check
Does the CRC in a CAN frame authenticate the sender?
No. It detects accidental corruption. Anyone can compute a valid CRC for a forged frame.
Does CAN FD add authentication?
No. CAN FD enlarges the payload and speeds up the data phase, but the page describing it does not claim any security features.
Sources
Last reviewed: 19 October 2026.
