  Secure ranging refers to the capability of upper-bounding the actual physical
distance between two devices with reliability. This is essential in a variety
of applications, including to unlock physical systems. In this work, we will
look at secure ranging in the context of ultra-wideband impulse radio (UWB-IR)
as specified in IEEE 802.15.4z (a.k.a. 4z). In particular, an encrypted
waveform, i.e. the scrambled timestamp sequence (STS), is defined in the high
rate pulse repetition frequency (HRP) mode of operation in 4z for secure
ranging. This work demonstrates the security analysis of 4z HRP when
implemented with an adequate receiver design and shows the STS waveform can
enable secure ranging. We first review the STS receivers adopted in previous
studies and analyze their security vulnerabilities. Then we present a reference
STS receiver and prove that secure ranging can be achieved by employing the STS
waveform in 4z HRP. The performance bounds of the reference secure STS receiver
are also characterized. Numerical experiments corroborate the analyses and
demonstrate the security of the reference STS receiver.
