[DBNO]

This is basically the solution. Light travels about 1 foot in one nanosecond, so the car needs to reject latent replies.

I did research in this area a few years ago. Here's a research paper [1] from 1993 that goes into more detail about this type of "distance bounding" solution (i.e. authenticating received signal only if 1) it is received within a few nanoseconds AND 2) the decrypted received signal contains the previously sent random number) in order to defend against "relay attacks". The paper discloses many variations to this general solution as well.

[1] Brands and Chaum, "Distance-Bounding Protocols"

https://link.springer.com/chapter/10.1007/3-540-48285-7_30

[starbeast]

I realised after writing it that you don't actually need to send the time itself, but it was my first 5 minute stab. Plus it is sort of fun to have the time flying about.

edit - thanks for the link, having a read through.