"Unpickable" lock potential attacks (and fixes) (Patreon)

If you haven't seen the video on attempting to make an unpickable lock, this wont make any sense. If you'd like, you can check it out here.

I was really worried that my lock video would fall flat on its face. I was afraid that most people wouldn't care since it was mostly an abstract concept. I'm a little surprised but very happy to see that folks are interested in such things! This is rekindling my desire to make a software only video... though that's a topic for another day. Today I want to talk about potential attacks on the lock and and what I did & will do to address them.

I see three broad categories of attacks that this lock could be vulnerable to:

1. Brute force attacksCurrently the lock only has three pins (to state the obvious, that's a lot less than most locks). On top of that the pins have sawtooth ridges, which gives each pin 20 possible discrete positions. The purpose of the ridges is to ensure the system reliably locks the pins in place and to prevent attack #2. Since there are 3 pins with 20 positions, the number of pin height combinations is 20^3 or 8000 possibilities. This is a decent number, but it isn't huge and could be brute forced. The fix for this vulnerability is simple: make the number of combinations huge with more pins. I'll be trying to cram 5 pins into the lock before I send it to the picking lawyer. That should give me >3 million combinations.

Ruffles: They've got ridges. AKA a big fat pain to machine.

2. Pin drop attacksIn my opinion this is the most viable attack on the lock. The basic idea is that you lift the pins as high up as possible, lock them in place, rotate the pins up against the gates with tension, then carefully release the pins and get them to get stuck in the gates at the right height. I saw this attack when I was building the lock and took steps to prevent it. 

First I disallowed the pin locking mechanism to be unlocked when the lock is not in the "neutral" position (the position you insert / remove the key). This is achieved by a "cam path" that presses the lock bar in even if the key is removed. 

The cam path keeps things theoretically locked but you would be amazed at what whacking something hard with a hammer can do. In the case of pins locked purely by friction, the vibrations from a strike have a good chance of making them slip. This is one of the main reasons that the ridges in the pins are very important. They give a positive lock that is much harder to make slip than a purely frictional fit. 

Even with those fixes I'm not satisfied. I still feel it depends too much on friction and tolerances which are hard to prove reliable. My plan is to stagger the gates around the rotation axis of the lock. If I do this, even if you do manage to drop the pins you can get at most one into a gate before they all drop. This should be very reliable against this attack and I believe will allow me to remove the pin locking mechanism. 

3. Dynamic attacks

The basic idea behind dynamic attacks is that you somehow whack the pins really hard - perhaps with something like a bump key. Then as the pins are bouncing around you very rapidly rotate the key and get the pins to randomly bounce through the gates. This would not be a reliable attack but is still a potential attack vector nonetheless. Lucky for me my previous mitigations turn out to be twofers and handle this attack vector for free:

The locking mechanism which holds the pins in place before rotating should totally prevent this attack. Even if you give the pins a good bounce, the pin lock system will keep them in place once the cylinder is rotated from nominal. 

The staggered gate should also prevent this attack even if the locking mechanism is remoted. The basic idea is that by the time a bouncing pin passes through the first staggered gate, the other pins should be bottomed out / settled and unable to be taken through the subsequent gates. 

I'll be incorporating these improvements as well as some hardening of the lock against physical attacks. My goal is to send it to the lock picking lawyer by the beginning of January.

Do you have any questions or see any other potential attack vectors? If so let me know here or even better hop on the Discord. That's where all the action is! As always thanks so much for the support! It is incredibly helpful and very appreciated :) - Shane