4 ms·

I don't know if this is too slow of an attack to count, but you could build an automated lockpicking machine that would iterate over the possible pin height com

I don't know if this is too slow of an attack to count, but you could build an automated lockpicking machine that would iterate over the possible pin height combinations. If a fast robotic machine could input & test one key pattern per second, it would find the correct pattern in 12.96 hours or less. One pattern per second should be quite feasible. Here's an example video that shows how robots can move very quickly while maintaining submillimeter precision: https://youtu.be/SVuOWwL410U?t=7 https://youtu.be/SVuOWwL410U?t=7

bryans 4y ago
Exactly. And based on the test mechanism simply requiring a ~46 degree turn to fail, I think it could actually be done in ~300ms per attempt, which would make the maximum solution even lower at ~4 hours. That's of course still a lot better than a traditional mechanism, which even brute force robotic pickers can tear through rapidly, but it's far from "unpickable." Ultimately, even lengthening the time per attempt wouldn't help save it from attack, because not only is this lock susceptible to robotics, it's easily pickable with audio analysis. Much like the traditional mechanisms that this lock hopes to replace, you only need to analyze one to build a matrix applicable to all of the locks. It's not unpickable, and the creator doesn't claim it's unpickable, either. So the title really shouldn't include the word.
- kortex 4y ago
  Those master cylinders are of specific dimensions, variable length and probably mass as well. I wonder if one could analyze the audio frequency spectrum, and/or mechanical impulse response, to deduce the length of the master and work out the bitting.
  - bryans 4y ago
    The fun part of audio is that there's multiple ways to do it. You can use spectrum analysis, impulse response, harmonic frequency, beamforming, triangulation and more. Some would be easier than others in this situation, but you could technically use any of them to pick this lock.
- necovek 4y ago
  I am not sure if I would call trying all combinations "picking s lock" — wouldn't adding a couple of pins simply make that infeasible again? You could also bring all 46k key variations and try them out, and you'll open it with 23k attempts on average, but that would not make the lock pickable if I was to talk about it. I have no clue about locks, but there's a difference between brute forcing a password and decrypting it from the hash.
  - bryans 4y ago
    > I am not sure if I would call trying all combinations "picking s lock" Lockpicking is defined as opening a lock with an instrument other than the appropriate key. It is not defined by how many attempts it takes. Many of the most common lockpicking methods are nothing more than brute force, which are sometimes incredibly effective. They're also sometimes the opposite of effective, meaning they may take many thousands of attempts before stumbling upon success. That doesn't disqualify them from the definition of lockpicking. > You could also bring all 46k key variations and try them out [...] but that would not make the lock pickable if I was to talk about it. The entire point of lockpicking is that you don't need to make every key combination, and instead only need a small set of tools or a single device. The personal decision to make every key instead of using another method, doesn't mean the lock isn't pickable, it just means you spent a lot of time making keys. You could also make all of the keys for a basic $1 padlock, but that padlock is still pickable with a paperclip. It didn't become unpickable by creating the keys. > I have no clue about locks, but there's a difference between brute forcing a password and decrypting it from the hash. Yes, the difference is that one will definitely take longer than the other, but you don't actually know which until you've successfully completed the task. They're both still password cracking methods with the same end result. One doesn't magically stop being a cracking method just because it takes longer.
    - necovek 4y ago
      My point is that every single lock (or password) is susceptible to trying every key combination: the only protection against that is to increase the number of combinations available. Sure, if a particular lock is more prone to brute-forcing due to its design than an average lock (eg. side channel attacks like timing attacks with passwords), one could surely qualify that as a pickable lock (or a "weak" password scheme). So I am not saying that a brute-forceable lock is not pickable, but that those are independent since every lock is brute-forceable. Sure, devil is in the details, and what seems like brute forcing is sometimes something smarter, but only when you are able to reduce the problem space from the full set of combinations would I say you are picking a lock. Again, maybe I am totally off base with regards to terminology as used in lock picking circles, but this is how I would differentiate between different approaches.
HellsMaddy 4y ago
To counteract brute-forcing, how about adding a rate-limiting mechanism? I could imagine each attempt to rotate the cylinder could partially compress a spring-loaded lever. There could be some sort of ratcheting return mechanism that allows the spring to decompress at a known rate (think a kitchen timer). Once the spring is compressed beyond a certain point (e.g. after 5 failed attempts), a mechanism locks out the cylinder until the return mechanism allows the spring to decompress back to its starting position. If the lockout happened after 5 failed attempts, and the lockout duration was 10 minutes, an attacker could test at a maximum rate of 30 combinations per hour. It would take 64 days to check all 46,656 possible combinations, or 32 days on average to find the solution.
- lexicality 4y ago
  Sounds like an interesting way to get locked out of your house. You would need successful uses of the key to reset the ratchet or every 5 times you opened your door it would become inoperable for 10 minutes, assuming the spring for the timer hasn't rusted or got a bit of grit in it or whatever.
  - HellsMaddy 4y ago
    Revised: - Each [failed] attempt to rotate the cylinder could partially compress a spring-loaded lever. - The return mechanism would always return if not in its resting position, not only after each 5 failures. - Successful attempts immediately reset the spring.

bryans 4y ago

Exactly. And based on the test mechanism simply requiring a ~46 degree turn to fail, I think it could actually be done in ~300ms per attempt, which would make the maximum solution even lower at ~4 hours. That's of course still a lot better than a traditional mechanism, which even brute force robotic pickers can tear through rapidly, but it's far from "unpickable." Ultimately, even lengthening the time per attempt wouldn't help save it from attack, because not only is this lock susceptible to robotics, it's easily pickable with audio analysis. Much like the traditional mechanisms that this lock hopes to replace, you only need to analyze one to build a matrix applicable to all of the locks. It's not unpickable, and the creator doesn't claim it's unpickable, either. So the title really shouldn't include the word.

kortex 4y ago
Those master cylinders are of specific dimensions, variable length and probably mass as well. I wonder if one could analyze the audio frequency spectrum, and/or mechanical impulse response, to deduce the length of the master and work out the bitting.
- bryans 4y ago
  The fun part of audio is that there's multiple ways to do it. You can use spectrum analysis, impulse response, harmonic frequency, beamforming, triangulation and more. Some would be easier than others in this situation, but you could technically use any of them to pick this lock.
necovek 4y ago
I am not sure if I would call trying all combinations "picking s lock" — wouldn't adding a couple of pins simply make that infeasible again? You could also bring all 46k key variations and try them out, and you'll open it with 23k attempts on average, but that would not make the lock pickable if I was to talk about it. I have no clue about locks, but there's a difference between brute forcing a password and decrypting it from the hash.
- bryans 4y ago
  > I am not sure if I would call trying all combinations "picking s lock" Lockpicking is defined as opening a lock with an instrument other than the appropriate key. It is not defined by how many attempts it takes. Many of the most common lockpicking methods are nothing more than brute force, which are sometimes incredibly effective. They're also sometimes the opposite of effective, meaning they may take many thousands of attempts before stumbling upon success. That doesn't disqualify them from the definition of lockpicking. > You could also bring all 46k key variations and try them out [...] but that would not make the lock pickable if I was to talk about it. The entire point of lockpicking is that you don't need to make every key combination, and instead only need a small set of tools or a single device. The personal decision to make every key instead of using another method, doesn't mean the lock isn't pickable, it just means you spent a lot of time making keys. You could also make all of the keys for a basic $1 padlock, but that padlock is still pickable with a paperclip. It didn't become unpickable by creating the keys. > I have no clue about locks, but there's a difference between brute forcing a password and decrypting it from the hash. Yes, the difference is that one will definitely take longer than the other, but you don't actually know which until you've successfully completed the task. They're both still password cracking methods with the same end result. One doesn't magically stop being a cracking method just because it takes longer.
  - necovek 4y ago
    My point is that every single lock (or password) is susceptible to trying every key combination: the only protection against that is to increase the number of combinations available. Sure, if a particular lock is more prone to brute-forcing due to its design than an average lock (eg. side channel attacks like timing attacks with passwords), one could surely qualify that as a pickable lock (or a "weak" password scheme). So I am not saying that a brute-forceable lock is not pickable, but that those are independent since every lock is brute-forceable. Sure, devil is in the details, and what seems like brute forcing is sometimes something smarter, but only when you are able to reduce the problem space from the full set of combinations would I say you are picking a lock. Again, maybe I am totally off base with regards to terminology as used in lock picking circles, but this is how I would differentiate between different approaches.

HellsMaddy 4y ago

To counteract brute-forcing, how about adding a rate-limiting mechanism? I could imagine each attempt to rotate the cylinder could partially compress a spring-loaded lever. There could be some sort of ratcheting return mechanism that allows the spring to decompress at a known rate (think a kitchen timer). Once the spring is compressed beyond a certain point (e.g. after 5 failed attempts), a mechanism locks out the cylinder until the return mechanism allows the spring to decompress back to its starting position. If the lockout happened after 5 failed attempts, and the lockout duration was 10 minutes, an attacker could test at a maximum rate of 30 combinations per hour. It would take 64 days to check all 46,656 possible combinations, or 32 days on average to find the solution.

lexicality 4y ago
Sounds like an interesting way to get locked out of your house. You would need successful uses of the key to reset the ratchet or every 5 times you opened your door it would become inoperable for 10 minutes, assuming the spring for the timer hasn't rusted or got a bit of grit in it or whatever.
- HellsMaddy 4y ago
  Revised: - Each [failed] attempt to rotate the cylinder could partially compress a spring-loaded lever. - The return mechanism would always return if not in its resting position, not only after each 5 failures. - Successful attempts immediately reset the spring.