Timestamps Unchained: Toward Secure Distance-Bounding on Commodity Wi-Fi Hardware

Distance-bounding protocols provide strong security guarantees, yet their secure realization depends on high-precision physical-layer timestamping of signal transmission and reception. In principle, modern commodity IEEE 802.11 chipsets fulfill these technical requirements. However, distance-bounding research and experimentation on Wi-Fi remain severely limited, as the required high-precision timestamping functionality on 802.11 hardware is tightly coupled to fixed protocol exchanges (e.g., FTM) implemented in closed-source firmware. This restricts the freedom of open research. Our work overcomes this hurdle by reverse-engineering the high-precision timestamping pipeline of the ESP32-C3 Wi-Fi stack. The analysis reveals that the ESP32-C3 hardware generates precise timestamps for ordinary OFDM frames, not only for FTM-associated ones. This unexposed capability enables precise timestamping of ordinary Wi-Fi traffic and forms the technical basis for implementing custom time-of-flight protocols on low-cost commodity devices. Drawing on this capability, we present the first open-source library extension exposing high-precision timestamping primitives on commodity IEEE 802.11 hardware. To demonstrate the practical utility of our library extension, we implement a proof-of-concept authenticated distance-bounding protocol. Our implementation showcases flexible timing, application-defined frame content, and fully open protocol logic beyond standardized exchanges. Experimental evaluation under line-of-sight conditions shows that proximity decisions with meter-level granularity are achievable. Overall, our work provides an open and auditable foundation for conducting and deploying security research based on time-of-flight on widely available IEEE 802.11 devices.