Artificial Code Restrictions on Safe Locks

If you service digital locks at all, you will find the methods for how some people select the code. The convenience for the end user to set a combination, also means they sometimes choose poorly. The most common group 2 locks accept a six digit code and so have one million theoretical codes.  Some are in use as instructions or factory codes and you really should also toss out stuff like 111111 and 999999.  This means there are less than one million but it is very close.

The process used to get a new code is often done with some method to help memory but it has the problem of significantly restricting the available codes which are selected from at any time.  This is less of a vulnerability during a midnight break in where the intruder knows nothing of the safe except that it has to be in here somewhere.  However, the greater risk is from unauthorized staff or former staff who may have seen somebody open the container or know the system used to get a code.  I once heard a manager tell another the safe code is always a six letter word spelled out and it was said with unauthorized staff in the room.  (The risk here is lessened by this being a locked office to which only the managers have keys and the place runs 24/7.  However, why was it lessened at all.)

With that, I am going to explore the mathematics of how some of these methods of code restriction affect how many codes you are really choosing from when you could be selecting from a pool of almost one million.  I have built these around the LaGard 33E keypad (seen above) which is very common in the North American trade.  There are other keypads and while the shape differs the fundamental problem persists. I will show and discuss these below.


Doing Some Lines of Code

One of the common methods is to choose a pair of straight lines to get the six digits needed.  You can write out all the common 3 number blocks on the face of the above keypad and to get more codes I have even given the three number crooked lines.

Simple Lines
123 & 321
456 & 654
789 & 987
147 & 741
258 & 852
369 & 963
580 & 085

159 & 951
357 & 753

Humps and Valleys
426 & 624
759 & 957
153 & 351
486 & 684
709 & 907

Arrow Points
157 & 751
268 & 862
248 & 842
359 & 953
426 & 624
759 & 957
153 & 351
486 & 684
709 & 907

Assuming the end user gets no fancier than this, you have exactly 46 sets of three number blocks. Since a code would be any triplet followed by another, the possible codes from this system is 46 x 46 or  2116 codes. 

So let's be clear.  You have thrown away over 99% of the possible codes to make it easy to remember.  It does not seem a good price to pay for the memory advantage.


Six Letter Words

End users will use a six letter word to make a code. Doing this, 'lemony' gets you '536760' on the LaGard keypad above.  In any such list, there are words which many users would know like 'mammal' and words few would know like 'meloid'.[1]  If you are looking for a simple way to learn the code, the codes from common words would still be more common than chance.

I could find no definitive source, but his page claims to show the six letter words in English.
http://clubefl.gr/games/wordox/6.html
It does not give a count.  I printed it in small type and counted a few lines and counted the lines to get this at about 15 000 items.  This roughly agrees with another sources I found. 

There are two ways you can get more choices for code.  You can use a phrases of shorter words to get to six letters such as "big egg".  Also, shorter nouns can be pluralized or verbs moved to another tense to get to the needed 6 letters.  On the other end, it is possible some of these words convert into the same 6 digit number since some keys have three letters which all give the same digit.  I can think of no way to research how many codes this would get but it could be roughly double the number of 6 letter words.  So lets assume we get to 30 000 codes.  The lock allows just shy of a million codes and this system leave about 97% of the possible codes unused.  I would say not a good choice either.


Other Key Pads

You can see from these other pads two types of variations.  If they arrange the numbers in a different pattern, the method of getting lines of numbers changes slightly. As such the number of lines change slightly but the basic problem exists.  Also, sometimes the mapping of letters onto the number keys is different so the same word will generate a different code. [2]  Still, English still has the same number of words and six letter phrases so that problem is the same. 

However, some of these allow for codes longer than six digits or even allow codes of various lengths at the same time by different users.  While this changes the numbers the ratios become even worse not better.  You are still tossing out more codes than you are keeping to do either method above.

Sargent and Greenleaf. Like our example but the letters are under different numbers.  It does not always take a 6 digit code.

AMSEC keypad.  Another common brand.  Notice no letters.

LaGard Basic Keypad.  The numbers are in a different shape so the top line could give 123 and then 234 while the verticals could give 269 and 370.  Still limiting.

Found on the net.  No more detail than that.  It just looks fun.

A gun same.  No letters to guide you. Has a key over-ride so if you do forget the code, you can still open it.

A common hotel same.  Only takes 4 digits so only has 1000 codes. More secure in that you do not store anything in it for a long time which limits the time for a person to hack or learn your code.  Typically, upper management of the hotel can over-ride this lock and also open this safe.

Some Methods to Choose Better Codes

Well, almost anything is better than those above.  If a method tosses out 10% of the possible codes, it is probably workable.  Here are three I like and since you do not know which I am using when, good luck working backward.

The phone book gives lots of numbers.  Go to some page which you can remember such as page 39 -- my age, honest.  Choose the last two digits of the first three numbers in some column.  My code would then be 55-57-28.  I would have to remember which phone book, which column, my system and my age.  (I have also chosen the last digit of the last six phone numbers on the page.  My code would now be 769850.)

A little old book of math tables.  You find these in old book stores often for a dollar.  They have pages and pages of numbers of things like the cubic roots of all the numbers from one to 100.  Go to some page which means as much as a tax table to you and find any six digits in a row.  Next time choose another page and point to pick your 6 numbers.

Nice little book from 1918.  It was the 'calculator' of its day along with a slide rule.

Carry a few pages of numbers from Random Org ( http://www.random.org/integers/) and when you want a code just pick 6 numbers.  You could toss this out from time to time and get a new one. (Do not circle or mark the numbers you choose.  If somebody finds the pages, it is giving away too much information.)  Or, if the screen is right there, just pull up the page and use it once.

There are also many other systems to find collections of mixed up numbers and if you go to a different source each time, then your safe code will not fall into a pattern.  My goal was just to dissuade you from using two systems to get a safe code which clearly lack the random nature needed to give you the security you paid for in this safe with this kind of lock.

------------------------

[1] I do not know this word.  I hope I did not just swear!  (Well, just looked up and it is a group of beetles.  So relieved.)

[2] You might have noticed that telephones arrange the keypad with 1 on the upper left but computers put it on the lower left.  I went looking for the reason historically, but closest I found was this from How Stuff Works: http://www.howstuffworks.com/question641.htm

A Security Audit OF a Locksmith, Round One

Commercial locksmiths love when a bank or some other institution has a security audit since it often gets the shop work.  You get work right after the audit and sometimes in the week just before the next audit.  I also know the auditors find all kinds of accounting and personnel procedures to change as well but that does not get us work.  In all this, I was wondering if anybody with serious security concerns was looking a bit deeper.  With that in mind, I have written a series of questions to audit the locksmith since the security of the end user is partly dependent on the diligence of the locksmith shop.  There are occasional robberies of shops after all.

I am not making any comment on any of the shops I know.  Also, I am trying to strive for best practice at all times.  However, answers need to be realistic in the real world we all work.  I have chosen to toss out the questions first and invite anybody to add others for later revisions.  After the questions, I will give my thoughts on what is best practice for each item.  I fully expect 'not applicable' will be the correct reply for some shops to many of the questions.

Yikes, did I ever open a bucket of worms.  I keep finding questions about areas of vulnerability.  I am tossing these out now hoping I get some ideas of other questions to ask.  I still have a page of question on staffing I have not typed.

--------------------------------------

Physical Security

(This set of questions should be answered for each building used by the locksmith where it has multiple locations.)

Does the shop have high security locks on all exterior doors?  Do all exterior doors have deadbolts with 1 inch or 2.5 cm of throw? Are astragals or blockers in place if appropriate? Do cylinders have taper rings to limit extraction? Are all doors code compliant as emergency exits?

Are the exterior door of good enough construction to resist some physical attack?

Would broken glass in the door or sidelight be an effective way to open any door?  Are all such glass surfaces coated in security films?  Does breaking glass trigger an alarm?

Are records kept in an interior locked room also with a high security key?  After hours, would an alarm condition exist before an intruder reaches this room?

Does the alarm system have contacts on all doors and openable windows?  Does it have motions sensors to cover all interior space?  Is the alarm monitored?  Does the alarm have battery and cell phone backup?  Is the cell phone back-up guarded against a fast disable?

Does the shop have interior space monitored by cameras?  Do the cameras have IR ability?  Where does the signal feed?  Backup?  Offsite backup?  How long are the files or video tapes kept?  Are the record secured from tampering?

Are any exterior walls vulnerable to a mining attack from outside or an adjacent building? Are all places directly inside under a motion sensor?  How far could an intruder move before tripping a double hit on the alarm?


Record Keeping

Are files with master and restricted keying records kept locked in a cabinet or safe when the business is closed?  Give the rating of the this cabinet or safe.

During business hours, are they also secured from non-cleared staff? 

Is there any leakage of key codes or other sensitive security information into the accounting stream?

Are ready-to-use keys kept in the files associated with the building they operate? 

Is any kind of encoding used on key records sent with staff outside the building?  Are keys tagged with the function and location?

How long are dormant files kept after the last work done in a location?  Is the building or operation notified of their destruction?

Who owns the keying record of the building and how do you make this clear to the end user who buys a master key system?  Is the end user given a choice??


Staffing
(Whole page of questions pending.)


Procedures

Are old master keys decoded before planning new systems?  Is this done in a way you can reasonably know all the old keys are retired?

Are all keys shipped to the end user with standard codes?  Could they be shipped without code if asked or fully blind codes??

Do you keep off site records off all the key system files you have on record?

What computer systems exist connected to the internet?  If a trojan was ever installed what kinds of data could leak?
___ keying charts  ___ client names ___ financials  __ emails  ___ quotes
___ others, specify __________________________________

Of computers not connected to the internet, are they systematically backed up?  Are the systems checked for viruses from sources like CDs and USB sticks?  Is data stored overnight as encrypted files?  Good encryption??

Are all laptops in use at the site equipped with recovery software?  Do they encrypt key data?  Will it erase if a brute force attack is tried?

Are all passwords strong on all critical systems?  No really … how strong are they?   Are they written on paper but only in a safe?



Get back to me with more good questions you think would help this topic along.

--- --- --- --- ---
The contents of this post are released for non-profit or educational use in whole or in part provided this statement and the attribution below are kept attached.

Laux Myth ... Thoughts From a Locksmith
By MartinB, Found @ http://lauxmyth.blogspot.com/

Some Cruise Ship Doors and Hardware

I took a cruise in the winter.  Always good to escape my climate in February!  Since I had not been on a big ship before, I spent an afternoon photographing the hardware as seen in the public spaces.  I was even lucky enough to speak with the ship's locksmith for a short time.  [I am deliberately not saying the name of the ship and should you recognize it, I ask you not to say the name in the comments.]

At various places to provide noise or wind separation, were sets of push/pull doors like this with the most amazing glass knobs on both sides.  These did not latch so had no fire rating but created a weather vestibule on the other side along with the door below.

The outer door was the primary weather seal.  These were immense wood door pairs with double seals along the inside as you see.  The hinges were already showing the signs of rust and this ship was only a few years old.  Since I have not lived on the sea, I was shocked how fast the salt would start corrosion. 

The closing hardware on this door shown.  European profile with an oval cylinder.  I have had these apart a FEW times.  At first I was surprised by the lock function as it seemed it would only need to be passage.  Why would you want to lock people out on the deck?  I was told it was for emergencies if the ship needs to isolate a deck or section to keep guests out.  

This is an interior fire isolation door sitting in a wall recess.  I spoke after my photo tour to another passenger who had never noticed these doors and pairs of them were in about 8 locations on every public deck.  I was not surprised as the general public really does not see life safety hardware.   These doors were in pairs and this is the active leaf so it must close last and open first.  The inactive leave is out of frame to the right and it has automatic flush bolts once closed and it controls an overhead coordinator which is just removed from the ceiling.  I never measured but the hall was 8 feet high or a bit more.  The ship was finished in Europe so might be better to guess at 250 cm. (I photographed the fire rating label.  Or what I thought was the fire rating.  Lacking Italian, I can not be sure and not clear time was given on it as near as I could tell.)

This square at the bottom corner puzzled me for days.  A slight push with my toe and it would hinge back until hitting the wall of the recess.  I finally found a staff member to ask and it is for a fire fighting hose.  As soon as I was told that it was obvious.  Similar to prisons, you can not really evacuate the whole structure. Fires have to be fought from adjoining sections and containment is needed to stop the spread.

Well, all for now.  I am trying a new editor on Blogger and formatting of pictures is not happening smoothly and yet the text is doing better.  This post looks good to me, but if it does not to you, feel free to toss me a message with perhaps a screen shot.  Thanks.

Talking to a Client Getting Access Control

I have dealt with a few clients who were getting access control and realized they did not always know the questions to ask.  Usually, I am speaking when the access control contractor is not present to answer these questions.  I thought I might comment from my point of view.  I have seen these give problems since the access control is already going in but after a bit of talk it is not clear the end user knows of the lock issues.   (Modern systems use prox or proximity readers often embedded in cards.  There are several types of credentials, but I will just call them all cards.)

Several examples of many I could find:

Do you still have a key operated way to walk from the outside of the building to the power supplies and the controllers?

Power goes out and if you can not get into the building, you can not check function or its real security.  Also, the computer which checks the credentials may shut down in a power failure or for 1000 other reasons.  In the end a few people should be able to access physical keys to get to this critical infrastructure.  Often, people think this means carry that key all the time.  Not necessarily.  I can think of one building operator who carries a key for the exterior and the office. Once in there, further keys are available.  (Advise to everybody: If you need a key once a year store it where you have access at that time.)

Who has the keys to bypass the card reader doors?
Access control systems have two great advantages. First is that only those with a valid card can go through a door. Second, you have a record of who and when opened the door and just as importantly when a card was denied.  This second part is called an audit trail and if you ever hope to use it in a legal process it has to be as solid and complete as you can make it.

Getting a valid audit trail then involves changing the keying on every door used in the access control system if anybody who now has a card formerly had a key.  (The exception would be if it is truly a high security keying systems and you can account for every key.  In this case, high security means the locks and keys are UL 437 standard rated.)  This generates only a very simple keying system for these doors since daily operation is not using the key so many can be keyed alike.  A separate master key may exist to open the path to the power and control units.  Typically after implementation of access control, a large building would have less than 10 of any of these keys.

Are you also getting cameras on critical doors?
Many organizations move to access control since they have so many staff.  Any large staff has some level of turn-over and it is cost effective to be able to disable one card at a time without affecting any other staff member. Also, you do not need to collect the key to 'kill' it.   However, most of these staff arrive at once and so many coworkers will open a door and hold for the next person.  It is polite, but may not be appropriate for your needs and a camera can show that happening.

Also, if you ever take legal action the card opened the door.  It is often helpful to say who was the person holding the card at that point when the card was used.   A camera on key points of entry can solve many of those.  (There are high security systems which enforce carding in and out rigourously.  Key points are then monitored by armed staff.)

This can also help with contractors like perhaps the photocopy technician.  You have to set up a few visitor cards with some limited access and a paper sign out process.  If a card goes missing, it can be deactivated.  A camera will tell you when that person left and if anything was moved out at the same time.  I have seen a case where my visitor card ended up opening EVERYTHING.  In the case I am thinking, I did not need into the cash office and if I had to be there should have been under escort.  So the escort would open the door.

Does key use generate a 'force entry alarm'?
If you want a full audit trail, everybody needs to be uniquely identified when they enter a door.  Since you must have key holders for emergencies, they should have a card also and use it.  When a key is used to open the door, it should register as an unusual event in the audit logs. From the wiring point of view, this is exactly the same as somebody prying the door open so it goes into the log as a 'forced entry' in most system.  A door needs an inside motion sensor to make this work so it has a way to tell if somebody is leaving.

Are blocking plates planned for every cylindrical lock set into an electric strike?
This is a cylindrical lock since it fits into a round hole in the door.  You can see the deadlatch at the end sitting beside the main latch.

There is a systemic problem with the deadlatch of a cylindrical lock falling into the keeper of an electric strike.  The installer can fine tune the spacing and get it right.  It NEVER lasts.  Well, maybe it does sometimes but I have seen it fail too often from simple door shift.  Once this happens, two problems occur.  The first is the extra pressure on the keeper acts as load on the strike and it fails to release on request.  (In the short term, pushing or pulling the door into the frame will take the load off and let you in.)  The second happens on outswing doors.  The dead latch is now out and any little screwdriver or knife or fingernail file can walk the main latch back and open the door.  Once you see scrapes on the latch, you know it is already happening.  Most doors will take off the shelf blockers which install quickly to stop this and then you can adjust the keeper to always let the full latch fall in.

Who controls the computers?
Access control moves building security partly away from building operations and over to the IT department.  Even if the hardware people assign and track the cards and can read the audit trail, the computers this lives on gets maintained and secured by IT.  Given this, it means the server to do this job should be physically isolated like a cabinet which holds master keys. Check that it is. What it takes to secure a computer in these days is beyond me. However, my reading suggests vigilance is vital -- as it is with all security concerns.

---

Since access control is a bit beyond my scope, I will stop asking questions now.  If you are the client, you should not do the same.  Every question you ask, may solve some security hole you have not seen yet.


--- --- --- --- ---
The contents of this post are released for non-profit or educational use in whole or in part provided this statement and the attribution below are kept attached.

Laux Myth ... Thoughts From a Locksmith
By MartinB, Found @ http://lauxmyth.blogspot.com/

Worn Keys and Copies of Worn Keys

To work in a shop, is to have people walk in with a very worn key to their house or car. It still works but they want a copy. With one look, I know it is not that simple. Sometimes I know a copy of the key will work fine and sometimes I do not know that.

Let's start with what I like to see. For most keys, you should see small flat areas on the key and these are where the pins or wafers are to rest on. Between each flat is some kind of ramp or peak to allow for the key to insert and withdraw. The steep parts should be even and smooth. This is a well cut house key.



You can see the 5 flat areas and the peaks between have very clear starts and stops with nice 45 degree angle slopes. If you look down at the cuts, you should see smooth cut surfaces. This photo shows the lines the cutting wheel made going up a steep. You should see these or very lightly. The key on the left is worse in that the lines are more visible and deeper. This makes your key into a small file which grinds the bottom of the pins every time you use it. Cut marks are visible if one or more of several things happen:
-- the cutting wheel was dull, or
-- the carriage was moving horizontally too fast, or
-- the cutting wheel is dull.



This is a worn key which has had time for any cut marks to be worn down. Even as a pro, I can not tell where one cut starts and the next begins. It may work fine. It may work good. Often you ask the client if it works and they will say 'yes'. The problem is it works for that person since it has worn out with use. The person has learned the sweet spot to hold the key or puts up with a bit of jiggle to get it to turn. I can feel the same lock and know the fit is just not right but the worn key does work ... if you wanna call it that.



However, if you duplicate this key, the copy may work or it could be worse. Basic key duplication is like a photocopy machine for a page of text. The machine can be better or worse but if you serially copy the copies enough, the errors build up. I can tell the key above is NOT a factory original since it is not on a Nissan blank. (Given the age of this lock series, the car is a Datsun and the original key would say that in work or logo.)

However, in the trade you do much like the hardware stores and usually just cut the copy and give a warranty that should it now work, the customer can bring it back. Unlike the hardware stores, I often know the most likely key copies to have problems and I have alternate methods to solve the problem should the client return.

A comment on key machines. The machines I see in hardware stores are semi-automatics worth $800 to $1000 but sometimes less. They can be re-calibrated if they are not cutting correctly but the staff lack the tools or skills to do that. A good lock shop will spend $1500 or more on the duplicator and since we know we have to cut keys for high precision locks we keep the machine checked for calibration. (Some locks demand highly faithful copies and the hardware stores do not even stock the blanks for them. Why should they since I doubt they would usually get a key precise enough to work?) Calibration requires tools and time and using up a few key blanks.

Don't worry too much. If your house key says WR5, WR3, KW1 or KW10, a cheap duplicator will work fine. The machining inside the lock will forgive all kinds of mistakes in cutting copies of your key. The sloppy workmanship making the lock also keeps the cost down and makes it so I can pick the lock easy should you be locked out. Have a nice day.