### Tuesday, August 29, 2006

##
When you've forgotten the combination to your lock...

As we all know, combination locks should really be called permutation locks.

Actually, that isn’t quite right. Duplicates are allowed, so you aren’t really taking permutations of 40 numbers. But that isn’t the subject of this post. The point is that with three numbers, each of which can be one of 40, there should be 64,000 possible “combinations.” That means that the probability that two locks will have the same combination is small enough not to worry about. It also means that it would take you a long time to try every possibility if you forget what your combination is. Let’s suppose you can try five possible combinations per minute, which seems reasonable, then it should take 12,800 minutes, which is 213 hours. At eight hours per day, we’re talking about 27 days of work, or over five solid weeks if you give yourself weekends off.

That seems pretty secure, doesn’t it? Clearly nobody will devote that amount of time.

Actually, that’s the worst-case scenario. You might, after all, hit on the correct combination in your first try. So we need the expected value, which is half the previous figure: on the average it should take less than three weeks. Still ridiculous.

But Liam Bowen has shown that there’s a way to get the expected value down to a very manageable ten minutes, still at five tries per minute! In other words, the worst case becomes 100 trials rather than 64,000. In his interesting and much linked-to article, he uses modular arithmetic and lock knowledge (occasionally confusing

Actually, that isn’t quite right. Duplicates are allowed, so you aren’t really taking permutations of 40 numbers. But that isn’t the subject of this post. The point is that with three numbers, each of which can be one of 40, there should be 64,000 possible “combinations.” That means that the probability that two locks will have the same combination is small enough not to worry about. It also means that it would take you a long time to try every possibility if you forget what your combination is. Let’s suppose you can try five possible combinations per minute, which seems reasonable, then it should take 12,800 minutes, which is 213 hours. At eight hours per day, we’re talking about 27 days of work, or over five solid weeks if you give yourself weekends off.

That seems pretty secure, doesn’t it? Clearly nobody will devote that amount of time.

Actually, that’s the worst-case scenario. You might, after all, hit on the correct combination in your first try. So we need the expected value, which is half the previous figure: on the average it should take less than three weeks. Still ridiculous.

But Liam Bowen has shown that there’s a way to get the expected value down to a very manageable ten minutes, still at five tries per minute! In other words, the worst case becomes 100 trials rather than 64,000. In his interesting and much linked-to article, he uses modular arithmetic and lock knowledge (occasionally confusing

*numbers*with*digits*) to explain how to do this. But let me quote and emphasize Bowen’s caution:PLEASE don’t use this to break into anything other than your own stuff.

Labels: math

###### ARCHIVES

- May 2005
- June 2005
- July 2005
- August 2005
- September 2005
- October 2005
- November 2005
- December 2005
- January 2006
- February 2006
- March 2006
- April 2006
- May 2006
- August 2006
- September 2006
- November 2006
- December 2006
- January 2007
- February 2007
- March 2007
- April 2007
- May 2007
- December 2007
- January 2008
- February 2008
- March 2008
- April 2008
- May 2008
- July 2008
- November 2008
- December 2008
- January 2009