Schneier on Security

Roger • March 22, 2006 8:54 PM

This seems like a very good idea, and well implemented so far as I can tell from their specifications. Most of the criticisms various people have suggested above, have in fact already been met by the designers.

(NOTE: It very much sounds to me as if the cryptographic functionality in this device is provided by the KeeLoq protocol. Some of my comments are based on this assumption and may not be valid if it is not correct.)

== Notably good points ==

1. It seems that each knocker must be set up by programming with a 6 digit “master code”, then a 4 – 6 digit user PIN is entered to unlock a door. Thus, it is two factor authentication. Yay!
2. The knocker is not just a token but also a PIN entry keypad (and code generator). Because each user gets their own and carries it around with them, this makes it much harder for an attacker to implement attacks on the PIN entry interface (e.g. prying open the cover and inserting a keylogger).
3. Uses cryptography to implement an (apparently) strong rolling code protocol for authentication.
4. Like most modern electronic locks, it has built-in key management and (in some models) auditing. However, if I read the specs right then it seems each lock can manage up to 100 different users whilst also using a rolling code for each user. So far as I know, this is unique.

5. From the video, it seems to be possible to enter your PIN shortly prior to unlocking the door, then activate it by pressing against the door. This feature makes it possible to avoid shoulder surfing or video photography being used to recover your PIN. However one would need to be careful with how long the device stays “armed” after entering the PIN.

6. Acoustic signalling: like RF based key systems, the lack of an exposed interface forces an attacker to concentrate on the information rather than the implementation. For example, on a keypad based system one has to worry what would happen if the attacker exposes the wires between keypad and microcontroller, and sends malformed signals along it e.g. seriously overvoltage. Additionally the exposed interface is vulnerable to vandalism which can also be used for denial-of-service attacks. An RF interface is significantly less vulnerable to these sorts of shenanigans, although not totally invulnerable. Possibly the cleverest part of the KnockKey is that it takes this sort of protection even further: very high amplitude acoustic signals might damage the device, but everyone in the area is going to notice! Having a broad spectrum pulse-time modulation scheme makes it very difficult to confuse with invalid pulse timings or unexpected frequencies. Seriously out of spec frequencies are likely to be strongly attenuated by the door material anyway. In comparison to RF solutions, it is also likely that the effective interception range will be reduced; the attacker will need to mike the door specifically, rather than simply hiding a receiver somewhere nearby. Another advantage of acoustic signalling is the possibility to signal through heavy metal barriers (e.g. safe doors, vault doors) without needing to anywhere weaken the barrier with a signal path.

7. Seems to be quite inexpensive compared to most electronic locks.

8. Only judging from an external photograph here, but it looks like the strike positively engages a notch in the retaining bolt (thus giving good resistance to forcing) and throws downward (thus probably not being vulnerable to the electromagnet attack). It also appears that when locked, the strike bolt is completely concealed, surrounding entirely by the casing and the heavy steel retaining bolt, which itself is completely surrounding by the casing. This makes it fairly resistant to physical assault from the INSIDE as well. (It seems it comes in both deadlock and non-deadlock versions.)

9. The combination of “master code” and PIN is a minimum of 10 digits. If it can be taken literally, the video seems to indicate that a code takes about 1 second to transmit, so even without rate limiting a 10 digit key will take an infeasible amount of time to brute force.

10. It deliberately forces the administrator to change default keys on set up. Yay!

== Questionable points ==

1. They don’t state what cryptographic algorithm is used to generate the rolling codes. From the description, it sounds a lot like they have used KeeLoq, which is a great protocol, but usually implemented with a secret proprietary block cipher algorithm.

2. PINs are allowed to be as short as 4 digits (or as long as 6). It seems they are somehow combined with a 6 digit “master key” before use, but no information is given on the device’s resistance to reverse engineering. If an attacker manages to extract the master key from a legitimate knocker, captures the master key by some other method, or obtains a knocker and is allowed access to it for an extended period, then a 4 digit PIN without rate limiting is rather weak. It could be brute forced in 8 minutes on average. Even 6 digit PINs would take about 6 days on average. With this sort of system it is of course fairly easy to severely limit brute forcing through a combination of rate limiting and auditing, however the description does not make any mention of rate limiting. I would like to see it added, if not already present, to further reduce the risk of reverse engineering the master key.

3. Although the knocker has a feature which enables one to avoid shoulder surfing attacks, this isn’t mentioned at all. For most users, shoulder surfing will probably continue to be a serious vulnerability.

4. The version in which the knocker is left attached to the door seems rather pointless to me. It eliminates most of the advantages of the idea, apart from not needing to drill holes through a door. I would certainly restrict its use to monitored areas.

5. (This bit has quite a few assumptions about the protocol.) The maximum length of the master key is too short. The maximum total keyspace seems to be a 6 digit master key and a 6 digit PIN (approximately 40 bits). In addition, if this is KeeLoq or works in the same way, there is also a 16 bit internal counter. The output from one knock is probably 32 bits (guessing, both from resemblance to KeeLoq, and claims of “billions of knock sequences”.) That means that an attacker who records a knock sequence, and then (having obtained the KeeLoq algorithm by some means) attempts to brute force the keyspace off-line by trial decryptions, cannot get the answer from one intercepted successful knock. But how many does he need? Unless the resynch protocol is triggered (which it usually isn’t), the next successful knock must decrypt to one of 16 possible values after decryption by the same trial key (assuming the upper 16 bits of the plaintext are fixed, as is usually the case, but need not be here.) Thus, 2-28 of trials keys will pass a second knock by chance, thus leaving ~4000 trial keys. A third knock will eliminate all but the correct one. Thus with a 6 digit user PIN and knowledge of the secret cipher algorithm, an attacker can break the system using 3 intercepted ciphertexts, ~241 encryptions and negligible memory, which is not a very serious obstacle today. With 4 digit user PIN, it is proportionately easier. (Note that the maximum keysize of the KeeLoq algorithm itself is 64 bits, so it is possible that there is additional keying information already embedded in the device — enough, in fact, to make brute forcing the algorithm significantly harder than kicking the door in — but as this data does not need to be entered into a replacement knocker, it must be the same for all of them and so will eventually be discovered.)

== Answers to specific objections ==

1. No, you cannot simply record the code and play it back. It specifically says that it uses a “rolling code”, which is designed to defeat just such an attack.

2. No, stealing the knocker alone does not let you break in.

3. Yes, of course you can bypass the lock’s security by attacking the physical fabric of the door, frame, or surrounding walls etc. But that is true for any lock, and thus not a criticism of the lock so much as a reminder of the necessity for whole-of-system design. To the extent that it is relevant to the lock design, THIS lock looks like it has been designed in a way that makes it easier rather than harder to secure the rest of the system, i.e. it doesn’t weaken the fabric of the door, it works just as well with very heavy doors and probably with doors with extra cladding, and it positively engages with the frame. The lack of a need to position a keyhole, and the mechanical simplicity of the engagement with the bolt, would make it fairly simple to adapt to more powerful boltwork if desired (as in fact appears to have been done in the S&G safes).

4. No, not all electric strikes are vulnerable to the electromagnet attack (i.e. throwing the bolt by attaching a powerful electromagnet outside the door, thus entirely bypassing the lock’s logic). A couple of designs were found to be vulnerable, and the manufacturers in true locksmithing tradition tried to suppress the information instead of fixing the problem, which caused a bit of a fuss among computer security types. However, the attack simply doesn’t work on most electric strikes, and from an admittedly very superficial examination it doesn’t look like it would work in this case.

5. The fact that S&G incorporate an override code in the version they put in some safes, doesn’t mean there’s a backdoor. Remember, each lock can manage up to 100 user accounts, so all S&G has to do is add a “field serviceman” user account. They could even have a different one for each customer, to minimise exposure. If you read the manual, you will see it is probably possible for the user to delete this account if they want to, although I imagine most commercial users are more worried about the considerable cost of getting their safe forced if they forget the PIN.

6. No, every knockkey does not contain the entire set of codes and PINs, encoded into itself. When you buy a replacement, it contains a default master key (which it forces you to change immediately) and no user PINs at all. To use it, the system administrator must enter the 6 digit master key. Your user PIN (apparently) does not get stored in it at all, but is entered each time you want to open a lock.

7. “Is this really more secure than a normal lock?” Yes. There is absolutely no question that for the great majority of lock users, any electronic lock, even a moderately badly implemented one, is more secure than a “normal” (i.e. mechanical) lock. This is because of the small fraction of break-ins which involve defeating the lock, most come about from a failure of key management, and key management for electronic locks is enormously easier than for mechanical locks. Of those that don’t fall under key management failures, most rely on applying violence to the exposed interface — something which this lock simply does not have. Other than that, this system appears to be based on a system which is already being used to secure luxury cars, and has been found in practice to be far more secure than mechanical locks. The only caveats are that they seem to be using a master key which is rather shorter than the maximum permitted (which does worry me somewhat), and they use a novel signalling interface (but one which seems to be more secure than the current standard version, rather than less secure).

Roger • April 12, 2006 8:28 PM

@Clive Robinson:

Re: mag field attack on electric locks:

I was just thinking about this the other day, and it occurs to me that there are at least 7 approaches. Some must be designed into the lock, but others can even be retrofitted by the end-user. Of course if the end-user does such a modification, it would be a good idea to obtain a suitable magnet and check to see if the hardening worked. Anyway, my thoughts:

1. Distance. The force from a dipole field on an induced dipole generally drops as a quite high power of distance (often 1/r^6 or 1/r^7, depending on geometry), so slightly increasing the standoff can have a dramatic effect. As a lock manufacturer, this can be achieved by designing the lock so that the solenoid is on the side furthest from the threat. Interestingly however this also allows a lock end-user to upgrade an existing, vulnerable lock by mounting the lock on a stand-off block of some kind. A disadvantage is that this approach only works from one side of the door.

2. Shielding. By making the lock casing, or better yet the entire door, from a high permeability material (e.g. Permalloy) the manufacturer may prevent the field from reaching the solenoid. Also the lock end-user may upgrade an existing vulnerable lock by fitting a plate of soft iron (or better, Permalloy) between the lock body and door. Or better yet, by making a box to completely surround the casing. This approach means that electric locks used to secure safes are probably not vulnerable at all.

3. Direction of operation. When an object is placed in a dipole field and has a dipole induced in it, the force lies in the direction of the field intensity gradient. By and large, this is toward the magnet. Thus locks in which the bolt is thrown at right angles to the plane of the door will be less vulnerable than those which move toward the door, while those which throw away from the door will be least vulnerable. Best of all would be interlocking two part bolts which have to move in two opposite directions at once. This technique will be more useful if there is also a reasonable degree of standoff, since it will then be more difficult for the attacker to significantly alter the relative direction of the magnet. This technique is mainly useful to manufacturers, although an existing end-user could use this approach to upgrade an existing vulnerable lock by making an new mounting bracket which alters the orientation of the whole lock. However this will likely be much more complicated than a simple standoff.

4. Additional components. An additional ferromagnetic sear could be place in the lock in such a way that when the normal solenoid (lying between sear and bolt) is activated, the sear is pressed away, but an external field (operating on bolt and sear in the same direction) causes them to bind together and prevent the bolt from moving. Electrically adept end-users could also use this approach to upgrade an existing vulnerable lock by adding a field sensor (e.g. Hall effect chip) to control a secondary bolt, which holds the door locked when a strong field is detected. Alternatively, the Hall chip could simply trigger a burglar alarm (since the required field strengths are very high, the risk of a false alarm should be quite low.)

5. Extraneous forces. Fields acting on dipoles generally induce significant torques as well as linear forces. The bolt could be designed so that it jams securely in place when subject to a torque. Such a feature would need to be designed in by the manufacturer.

6. More complex mechanisms. A bolt does not have to be thrown by a simple solenoid. It might be operated by a stepper motor, for example. (With a stepper motor, there are effectively two or more coils which must be alternately energised with a precise phase relationship. A static field will do nothing, while an AC field impressed on both coils which just make the rotor vibrate in situ.)

7. Concealed location. It will be very difficult for the attacker to achieve the necessary field strengths over a large area. As such, locks in which the strike mechanism cannot be easily located from the “insecure side” are slightly less vulnerable.

Roger • November 3, 2006 9:07 PM

@Ben:

This locking device is unsafe anyone could record you locking sound

It uses a rolling code. That is, a new knock code is generated every time, using a cipher. Previous knocks are automatically rejected, so recording them achieves nothing unless you are able to break the cipher. We are not able to judge the strength of this cipher because it is a secret proprietary one, however it appears to be the same one commonly used to protect luxury cars.