Attackers can illegally open a vehicle by forgeing the Radio Frequency IDentification （RFID） signal sent by the vehicle remote key. Besides， when the vehicle remote key is lost or stolen， the attacker can obtain the secret data inside the vehicle remote key and clone a usable vehicle remote key， which will threaten the property and privacy security of the vehicle owner. Aiming at the above problems， a Vehicle RKE Two-Factor Authentication （VRTFA） protocol for vehicle Remote Keyless Entry （RKE） that resists physical cloning attack was proposed. The protocol is based on Physical Uncloneable Function （PUF） and biological fingerprint feature extraction and recovery functions， so that the specific hardware physical structure of the legal vehicle remote key cannot be forged. At the same time， the biological fingerprint factor was introduced to build a two-factor authentication protocol， thereby solving the security risk of vehicle remote key theft， and further guaranteeing the secure mutual authentication of vehicle RKE system. Security analysis results of the protocol using BAN logic show that VRTFA protocol can resist malicious attacks such as forgery attack， desynchronization attack， replay attack， man-in-the-middle attack， physical cloning attack， and full key leakage attack， and satisfy the security attributes such as forward security， mutual authentication， data integrity， and untraceability. Performance analysis results show that VRTFA protocol has stronger security and privacy and better practicality than the existing RFID authentication protocols.