Clever Combination Door Lock Design
This combination door lock is very pretty. Of course, four digits is too short an entry code, but I like the overall design and the automatic rescrambling feature.
Comments
Chris • June 5, 2009 8:02 AM
Is now a bad time to point out that the latch is installed upside down in the pictures?
@Chris:
Considering they’re all computer-generated, I don’t think it matters. It’s pretty, but it’s vaporware. (These design houses do this all the time – design things that’ll never exist so they’ll have something to do between the paying practical projects.)
Mike Purvis • June 5, 2009 8:18 AM
That shuffle-when-released thing is fantastic. I’ve lived in several houses with numeric entry pads, and they always seem to be eating through their batteries. That this is unpowered is great.
John • June 5, 2009 8:20 AM
@Chris Is now a bad time to point out that the latch is installed upside down in the pictures?
Actually, the latch is correctly displayed for a typical exterior door on a house. That door opens inward. So as displayed in the drawings, the door is a push to open door.
What I’m more concerned about is the automatic shuffling of the combination when you open the door. Somehow I suspect that the shuffling won’t be all that random and an attacker could determine the correct combination by examining the dials after shuffling fairly easily.
Cybergibbons • June 5, 2009 8:22 AM
I realise this is just a concept.
But the shuffle when the handle is released is probably going to be a serious weakness.
I think it would be challenging to create a mechanism that will randomly scramble the combination.
You could probably gain a lot of information by setting the combination to 0000, and then releasing the handle a few times, recording what the code ended up as. You’d get an offset, and could probably reduce the number of tries required greatly.
Of course, if it is a mechanical combination lock, you have several problems. Firstly, these rotating tumbler locks can often be decoded using feeler gauges between the dials. Secondly, the actual lock would be in the handle, whereas the latch would be in the lock body. What’s to stop you snapping the handle off and opening the door? It’s like those stupid electronic keypads that have all the electronics integrated inside them on the non-protected side of the door – you can just pull it off the wall and connect the power supply to the solenoid wires to open the door.
Cybergibbons • June 5, 2009 8:23 AM
I see John just beat me to it!
How’s this shuffle-on-release any different that that RSA token you use to access your company’s VPN? The password changes every time you use a password. Bruce has it right – four digits is the weakness. And shoehorning the RSA token algorithm into four digits won’t solve that problem.
Cybergibbons • June 5, 2009 8:42 AM
I don’t see how the RSA token is the same.
Say the scrambling feature shifts the 1st disc by 5-6 digits, the second 2-4 digits, the third 4-5 digits and the last 4 digits.
If you see the handle with 3456, you know that the combination is one of a much smaller number i.e. the first digit is between 7-8, the second 0-2, the third 0-1, the last is 2.
This assumes it is a mechanical lock of course and the shuffling is predictable.
A major drive to make the locks on safes electronic is for auditing, lock-out, and different levels of access control, which are difficult or impossible to achieve with mechanical locks.
It’s also very visible. With an electronic keypad or conventional dial combination lock, you only gain information from the digit being pressed/dialled at the given moment. If I see someone type a 4, I have no information about what they have previously done. (slight caveat, some dial locks restrict digits to a certain range based on earlier ones dialled)
With this, by the time they get to setting the last digit, I can see the other 3 digits. You’ve just reduced the number of combinations to 10.
Anonymous • June 5, 2009 8:43 AM
@Cybergibbons: You could probably gain a lot of information by setting the combination to 0000, and then releasing the handle a few times, recording what the code ended up as.
Sorry, forgot to respond to this – it only rescrambles on successful use of a password. One would hope that failed attempts would result in longer and longer delays in validating the next combination.
Henning Makholm • June 5, 2009 8:44 AM
Instead of attempting to shuffle randomly, it could just reset to 0000.
Another problem would be that the user is likely to leave a thumbprint across the dials while they are set to the correct combination. Afterwards, an attacker can simply dust and scan the dials and figure out how they match up. That would reduce the search space considerably.
“If you see the handle with 3456, you know that the combination is one of a much smaller number”
So what you’re saying is, four digits is too short. Glad you agree.
Ya know, I think I may have misunderstood this rescrambling thing – I figured it changed the password every time. That would be a cool feature.
Cybergibbons • June 5, 2009 8:56 AM
“Instead of attempting to shuffle randomly, it could just reset to 0000.”
It’s much simpler to do and much more effective at hiding the code.
“So what you’re saying is, four digits is too short. Glad you agree.”
Not really. It’s plenty enough on an electronic keypad for access control in an already secure area, but several aspects of this lock mean an attacker can reduce the number of guesses to 20 (if the shuffle is predictable) or 10 (if you see the first three numbers), which is a long way off a 4 digits x 10 number code.
Cybergibbons • June 5, 2009 8:57 AM
D – ah, now I get you. I think there is a chance that it would place too high a demand on the average user…. and only one person would be able to use it!
John • June 5, 2009 8:57 AM
@D: How’s this shuffle-on-release any different that that RSA token you use to access your company’s VPN?
Oh? Perhaps because the RSA token is different every time you use it?
As regards the 4 digits, I would agree that it is a weakness. However, the limit of 4 digits isn’t fundamental to the design and it could be easily extended to more digits. But a more fundamental issue is that the difficulty of bypassing the lock just needs to be harder than the difficulty of physically forcing the door itself.
And frankly, assuming that they can actually come up with a good shuffle, 4 digits is plenty. Assuming that setting a digit takes just 1 second and moving the handle takes another second, an attacker can try 1 combination every 5 seconds. Given the average of 5000 attempts before succeeding, that means that an attacker would have to be present at the door for almost 7 hours before being able to bypass the lock via manipulation. Given that amount of time, it would be far faster and easier to simply force the door.
Musashi • June 5, 2009 9:02 AM
The makers obviously never watched Sneakers…
TS • June 5, 2009 9:23 AM
Easiest way to hack this is placing one of those little spy cameras above the door and wait for someone to dial in the correct code.
Rich Rumble • June 5, 2009 9:43 AM
The lock is cute and interesting, “cracking” seems like a waste of time really… it’s still just a typical door latch, meaning a credit-card (something thin) would probably be sufficient to move the lock out just as with any tapered door latch I’ve encountered.
From a cryptography standpoint I see the point of 4 digits being a limiter, but if I encountered the lock when doing something nafarious I would put my inner cryptographer aside and get or a CC or gift-certificate card. 🙂
-rich
John • June 5, 2009 10:03 AM
@Rich Rumble: meaning a credit-card (something thin) would probably be sufficient to move the lock out just as with any tapered door latch I’ve encountered.
Most exterior door latches I’ve seen have a 2nd piece that’s intended on being depressed while the door is closed. And when this half-cylinder piece is depressed, the door latch itself can’t be depressed by external pressure. So the old credit card trick doesn’t work on exterior doors. It still works on interior doors since that little extra security device is typically not used for interior doors.
Courtney • June 5, 2009 10:15 AM
This looks like an accessibility nightmare. Can you imagine arthritic hands trying to rotate the tumblers?
Which is hilarious to me, because that type of handle is now commonplace due to its accessibility compared to a doorknob.
mpj • June 5, 2009 10:15 AM
I disagree that four digits is too short an entry code. It’s around the order of magnitude of a traditional key (although testing the different combinations is obviously quicker.) However, even at 10^4 combinations it will be easier to bypass the lock than to bruteforce it. For the same reason thieves don’t generally pick locks; even a skilled lock picker may take a minute to gain entry.
Rich Rumble • June 5, 2009 10:19 AM
I know the intention of that half-cylinder, but I’ve never seen one work correctly or as intended. All the doors in the building and the exterior doors suffer the same fate… I’ve always been curious if they ever worked. I can’t find the name of that half-cylinder…
-rich
Cybergibbons • June 5, 2009 10:37 AM
I’m not sure what the name of it is either – the feature is called “anti-carding” or “automatic deadlocking”.
Most of these rely on the fact that a smaller bolt will be pushed in after the main bolt has entered the strike. They rely on the lock->strike, and hence door->frame distance being within a certain range, and quite frequently they aren’t, so it doesn’t work.
Worse still, on a fair few cheap locks like this in the UK, this secondary bolt is a very thin piece of metal separate to the main bolt. You can often bend or snap it with a sharp blow to a piece of metal in the gap, leaving the main bolt card-able.
I think this is why better locks have this behind the main bolt.
The other weakness is that this “automatic deadlocking” isn’t true deadlocking, and using a slim-jim with a bit of force will shift the bolt anyway.
Alan Porter • June 5, 2009 11:08 AM
Amazing! That’s the same combination as my luggage!
Jason • June 5, 2009 11:12 AM
Ugh. Design =/= Invention.
Anybody can put a combo lock on a door handle. The hard part is figuring out a linkage to connect the combo dials to the latch mechanism through the rotating door handle, building a set of rotary dials that spin freely without weakening the handle, figuring out how to rotate the dials after the door has opened to clear the combo, and making the whole thing immune to weather and physical force.
This is what I hate about design shops. The gulf between having an idea and having an idea that works is usually far huger than they imagine.
“Easiest way to hack this is placing one of those little spy cameras above the door and wait for someone to dial in the correct code.”
No, easiest way to hack this is to smash the handle with a fire extinguisher until it breaks at the dials, then manually twist or pull the interior mechanism that operates the latch.
Elliot Ross • June 5, 2009 11:42 AM
That whole door is an interior door – great for a teenage girl to keep her brother out of her room
It is a thin wood door with no strike plates etc – not a legal exterior door.
Clive Robinson • June 5, 2009 12:00 PM
@ Jason,
You’re half right,
The design as shown is not realy that practicle, first off the manufacture of such a device would require the handle to be a sleave (otherwise you could not get the combo wheels on). This sleave would probably be quite easy to remove, after that it would if it’s like any other of these tumbler lock designs just require a very thin piece of plastic to slide down the length of the handel under the wheels to feel the correct position…
Alternativly if you have about five minutes nearly all tumbler locks can be “felt in” that is you apply a small amount of preasure to the lock which makes the wheels bind slightly. You rotate the wheel which is most bound untill it frees which is where it nolonger binds against the lock tang, you then repeate for the next most bound wheel and repeate for all four wheels at which point the lock opens.
I’m a bit older than Bruce and I have opening combo and other locks since I was around eight and belive me when I say most combo locks “suck baddly” because they have to much mechanical slop which only gets worse with age.
If properly made the hardest of the “cheap” locks to open are those with the tubular key with various depths of cut for the pins. You see them on the more expensive push bike locks and vending machines. And yes these can be picked with a little patience and a cheap Bic Biro ball point tube.
Joe • June 5, 2009 12:15 PM
I look at that and It seems to me the design winds up being if you don’t have the right combination. The handle comes off.
RSaunders • June 5, 2009 12:17 PM
Since we’re still engineering this, making the dials mechanically operate the lock is a loser. Impossible to secure and too easy to bypass.
That doesn’t mean it’s a bad design, just that we haven’t engineered it enough. The dials need to be free-turning, detented, digital inputs to a processor in the door. I can’t buy “random”, but the correct “reset to 0000” solution was given by Cybergibbons, so we’ve improved it already. The dials can spin around a solid steel shaft, so that it can resist fire extinguishers. Even if you get them off, you still don’t know the number to send to the processor to open the lock.
At least we don’t have an LCD with numbers on it and some sort of math problem that must be solved to put in the right number. That would be too much like a safe rather than a door.
Davi Ottenheimer • June 5, 2009 1:20 PM
Makes me think of the steering wheel of a convertible.
Skip • June 5, 2009 1:27 PM
That kind of lock looks pretty cool, as a diversion. I’d rather see it set up where twiddling the numbers then turning the handle triggers a silent alarm of some kind. The real way in would be to just open the cleverly-hidden compartment at the end of the handle and inserting/turning your key as you normally would.
Anonymous • June 5, 2009 3:00 PM
@Eliot Ross
Kinda poor to keep out a little brother. Aside from credit card related tricks, they have long term access to the mechanism and potentially significant patience when tit comes to getting where they’re not supposed to be.
Unix Ronin • June 5, 2009 3:49 PM
I’m wondering how long it’ll be before there’s a published analysis of the “rescrambling” mechanism…
Brett • June 5, 2009 5:40 PM
Use that 4-digit dial-in-the-handle as a red herring. The real key is an RFID type device the user has on his/her person. The RFID reader is on the other side of the door, connected to a solenoid lock.
So no matter what combination is dialled in, or if the handle is smashed off, the lock still won’t open.
Wiskers in Menlo • June 5, 2009 5:59 PM
On the rescrambling, a published analysis might or might not show that all locks rescramble the same. If they all rescramble in a unique way that might be as good as a reset to 0000.
This would be a terrible lock to keep little brother from access to the gun closet. Little brothers have all day all week to try all the possible combination… If it does not scramble after each try it just make the next try a bit easier.
It is also hard to believe that it is strong enough for an external door.
It is purdy in an artsy sort of way.
i approve of this message • June 5, 2009 6:18 PM
Diabetics need to stick their fingers, so using this idea, what if a lock was a hole for a finger, which functioned similar to the device diabetics use for testing, which generated a unique hash and verified it to allow entry?
Pandemonium • June 5, 2009 7:34 PM
At that level of technology, I think you’re better off with a fingerprint scanner. Less intrusive and fingers change less often than blood sugar levels.
The niftiness here is in the idea of an electronic lock integrated with the handle.
Roger • June 5, 2009 10:42 PM
There already exist combination door locks, both digital and mechanical. There already exist electronic combination (and token) door locks that are integrated into the door handle — often designed as a cheap and simple retro-fit for existing locksets, since integrating the electronic lock into the door handle could otherwise be considered a misfeature.
So, what features does this design bring to the table that other designs lack? What fundamental does it have that would make for a reason why “we’re still engineering this”?
I don’t think it has any. In a bicycle chain lock (which it strongly resembles), the use of dial rings is driven by the mechanical constraints of the design. But dial rings are really a pretty inferior way to do it:
* They are difficult to operate (practically impossible for people with arthritis, tendonitis, a broken wrist or bandaged hands);
* They limit the maximum practical password to a very short one (rarely more than 4 digits, which can be brute-forced in under an hour on average, and yes you can spread the hour across several visits);
* They make it difficult to conceal the dialling process to protect against “shoulder surfing”;
* They make it very difficult to automatically clear the combination after entry (in fact I have never heard of one that does);
* Mechanical versions do not permit multiple keying to allow multi-user scenarios, or emergency or maintenance over-rides;
* They have more points of entry for dirt and foreign objects (for bicycle locks, this is dealt with by having very generous internal clearances, but the side-effect of that is reduced security).
So, we have a proposal which inherently offers worse usability, security, maintainability and reliability, which is pretty well all the important aspects of a lock.
But at least it looks cool. “Design.” Pffft.
Roger • June 5, 2009 10:53 PM
@Unix Ronin, @Wiskers in Menlo:
There is no analysis, because there is no mechanism. By “Design” they mean doing the product aesthetics and leaving the nitty-gritty details to someone else. Too bad if the overall package forces the engineering to be bad.
In this case, the designer has said “wouldn’t it be cool to have a combination door lock that looks like a bicycle lock?”, and used a graphics package to draw one. Someone has pointed out that it would have zero security because bicycle combination locks retain the last dialled combination unless you manually clear them, so as an afterthought he has decided the engineers will somehow magically fix that bit.
This, of course, is exactly the wrong way to do security (design the package and try to shoehorn in some special security sauce afterwards, and awkward process because the sauce squeezes out past the shoehorn 8^)
Clive Robinson • June 6, 2009 4:18 AM
@ Roger,
“This, of course, is exactly the wrong way to do security (design the package and try to shoehorn in some special security sauce afterwards”
It was “ever thus”…
Just about everything I have ever looked at involving security has been designed backwards, even mil/gov equipment.
And guess what in the ICT world we still do it, the marketing department come up with the ideas (based on others ideas) it then gets filtered through business managment, and becomes a vague wish list with lots of “must haves” attached.
But hey that’s just the way “right brained” people do things, it’s left to the “left brained” people to lay the snakes out straight.
And guess what the “left brained” are daft enough to do it because they cannot resist a chalenge, and the “right brained” know it…
Clive Robinson • June 6, 2009 4:49 AM
@ Pandemonium,
“The niftiness here is in the idea of an electronic lock integrated with the handle.”
If you want real “niftiness” you should see the electronic lock I designed several years ago that was built into the standard latch mechanisum.
The real problem with it and it’s still a problem today is electrical power. High capacity batteries have a couple of disadvantages, they have a habit of exploding or bursting into flames if shorted, and they often have high self leakage so a short shelf life.
This usually means that lower capacity battery technology has to be used, and as people ignore battery low warnings untill it’s to late…
This very much dictates in most cases that the battery has to go on the insecure side of the door, or a set of electrical contacts is available to “jump start” the lock, which dictates a minimal damage method of removing the cover (which is needed not just for electrical safety but to prevent damage by static etc to the lock electronics).
Likewise the potential for the electronics to fail is the reason the electronics ends up on the insecure side of the door, and why often the case holding the electronics and battery can be fairly easily removed from the insecure side.
The real reason for the majority of electronic locks untill recently is not for extra security but to reduce costs and increase flexability in the hotel and entertainment industries.
For this cheap key cards etc are used (usualy less than 10cents each) compared to mechanical keys costing upwards of 2$ each. The card keys become throw aways and the hotel is not reliant on guests returning keys on check out. Also the keys can have an expiry date on them so they become usless after a given time.
Also the locks can be easily reprogramed via a master key card so it the hotel decides to change the way the maids/cleaners do their rounds it can be done in a few minutes of walking around the doors dipping in the master key card etc.
For high security use electronic locks are usually only of use in high transit areas or where access auditing is required.
In lower security settings you will also find them used with doors that have electrical openers instead of simple push buttons and they provide a cost effective method of access control.
However both high security and access control locks for safety require a bypass mechanism either as a mechanical lock (as seen on safes) or via a secondry access point etc.
For most purposes where access is by just a small handfull of people they are a waste of time and more trouble than they are worth (especially the new “bio-metric” locks).
whispering in your ear • June 8, 2009 1:45 PM
“At that level of technology, I think you’re better off with a fingerprint scanner. Less intrusive and fingers change less often than blood sugar levels.”
I was referring to the method (finger stick) not the sampling for hash generation. I’m confident some content of the blood would remain semi or entirely constant. With all the potential cons to this, maybe it wouldn’t be a good idea (people with aids using the same lock with non aids carrying people and so on). What of the use of hair, instead?
John • June 9, 2009 12:20 PM
@Seth: John, if it takes 1/2 second to turn a digit to the next number, and 1 second to test the handle, then it takes 1.5 seconds per combination. See “Gray Code”.
I was going under the assumption that the lock shuffled itself after each attempt to open it. Although the same issue would apply with Cybergibbons “reset to 0000” idea. If the lock scrambles or resets itself after every attempt, an optimization like using a grey code to speed up the process of manipulating the lock won’t work. And once again, the fastest and easiest way in is to just force the door.
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
Carlo Graziani • June 5, 2009 7:59 AM
Looks like Enigma on a door handle, except the rotors can’t be re-arranged, and it only transmits one message (“let me in”).