# Locks aren't unique, are they? **URL:** \ **Category:** Factual Questions\ **Created:** [December 1, 2008, 3:22am UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133 "2008-12-01T03:22:38Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![mhendo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mhendo/32/3159_2.png) [@mhendo](https://boards.straightdope.com/u/mhendo)\ **Post date:** [December 1, 2008, 7:31am UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/21 "2008-12-01T07:31:50Z")
> [@1010011010](#): > > [Keyless Entry can be brute forced in 3129 key presses](http://www.hackosis.com/2008/01/12/security-brute-force-a-car-keyless-entry-pad/). Don’t get too excited about “electronic keys” just yet. But the way the lock described in that story works has some crucial differences from how a better-designed electronic key might work. 1. In the story you linked, the ten numbers are really only 5 buttons, meaning that from the very beginning you don’t have too many combinations to work with. Make the electronic key alpha-numeric, and you increase the number of possible combinations incredibly. 2. The keypad on that car requires exactly 5 numbers in the code. A better system would not only allow more digits, but would allow you to set the number yourself, like a password, again increasing the number of possible combinations. 3. The keypad on that car will open the door as soon as you press the five correct numbers in order, even if you have pressed 500 numbers beforehand. An improved system would require you to start over each time you try a new combination, eliminating the type of brute force hack used in that article. You would still be able to use brute force, but it would require many more keypresses. Of course, one downside of allowing more complex electronic codes is that, like with computer passwords, people will probably end up choosing completely obvious codes, like “password” or “myinitials123” or something. ---
**Author:** ![clayton\_e](https://avatars.discourse-cdn.com/v4/letter/c/c57346/32.png) [@clayton\_e](https://boards.straightdope.com/u/clayton_e)\ **Post date:** [December 1, 2008, 8:11am UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/22 "2008-12-01T08:11:27Z")
When I was in sixth grade I found a key in the school parking lot that was light blue and shiny… It had in very small _raised_ letters (not stamped into it like someone might do for some sort of prank) “Master Key, all 1991 Ford F-150” or some such model… It might’ve been more specific, my memory is a little hazy on the details. To this day I just don’t remember what happened to it. I was in 6th grade and should’ve handed it in to the police… I had no intention of using it for any reason… But I thought it was cool. I’m pretty sure I put it on a keyring with other keys and lost it. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [December 1, 2008, 8:17am UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/23 "2008-12-01T08:17:20Z")
> [@Q.E.D](#): > > Not even close. The typical “Arrow” type house key has, as noted above, five tumbler positions with each capable of 6 different pin lengths for a total of 15,575 combinations. Long odds for finding a duplicate, but far short of being identical. It has actually happened to me once with a standard 5-pin tumbler. We had a music practice space and, one caffeine-deprived morning, I slipped my key in, unlocked and opened the door, took the key out, and realized that I had opened the door with my apartment key. I looked closely at the keys and, sure enough, they were identical cuts. The apartment key worked in the practice space and vice versa. Hell of a coincidence, but it happens. ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [December 1, 2008, 8:42am UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/24 "2008-12-01T08:42:46Z")
> [@1010011010](#): > > [Keyless Entry can be brute forced in 3129 key presses](http://www.hackosis.com/2008/01/12/security-brute-force-a-car-keyless-entry-pad/). Don’t get too excited about “electronic keys” just yet. I do not know what car uses that type but my truck has one single button and billions of combinations and the combination changes every time. The system in that link looks like some toy thing or something like that. > [@](#): > > [http://auto.howstuffworks.com/remote-entry2.htm](http://auto.howstuffworks.com/remote-entry2.htm) > > The controller chip in any modern controller uses something called a hopping code or a rolling code to provide security. For example, if you read this PDF, it describes a system that uses a 40-bit rolling code. Forty bits provide 2^40 (about 1 trillion) possible codes. Here’s how it works: > > The transmitter’s controller chip has a memory location that holds the current 40-bit code. When you push a button on your key fob, it sends that 40-bit code along with a function code that tells the car what you want to do (lock the doors, unlock the doors, open the trunk, etc.). > > The receiver’s controller chip also has a memory location that holds the current 40-bit code. If the receiver gets the 40-bit code it expects, then it performs the requested function. If not, it does nothing. > > Both the transmitter and the receiver use the same pseudo-random number generator. When the transmitter sends a 40-bit code, it uses the pseudo-random number generator to pick a new code, which it stores in memory. On the other end, when the receiver receives a valid code, it uses the same pseudo-random number generator to pick a new one. In this way, the transmitter and the receiver are synchronized. The receiver only opens the door if it receives the code it expects. ---
**Author:** ![Critical1](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Critical1](https://boards.straightdope.com/u/Critical1)\ **Post date:** [December 1, 2008, 9:28am UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/25 "2008-12-01T09:28:09Z")
go to any big hardware store and check out the deadbolt section, you will be able to find matching sets of locks so you can buy say 2 or 3 dead bolts so you only need one key for your house no matter what door you try to get in through…last time I did this there were only about 6 different locks to choose from in the type I looked at and it was a big name brand. a friend of mine growing up had a garage door key that would open doors to at least 3 other houses we knew of. once I wen to get in my car to leave and it was sitting there running, some chick got in and started it (evidently it was a bit hard to get the key to turn to start it) and when she tried to put it in gear she realized her car was an automatic…and the damn key wouldnt come out. it was a strange way to meet a cute girl. at this point its still going to be to expensive to make each physical lock so unique that no one elses key would open your lock. ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [December 1, 2008, 11:17am UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/26 "2008-12-01T11:17:28Z")
> [@Critical1](#): > > go to any big hardware store and check out the deadbolt section, you will be able to find matching sets of locks so you can buy say 2 or 3 dead bolts so you only need one key for your house no matter what door you try to get in through… They sell the in sets especifically for that purpose. They also sell sets of padlocks keyed alike. All the padlocks on my boat use the same key. > [@](#): > > last time I did this there were only about 6 different locks to choose from in the type I looked at and it was a big name brand. i do not believe that for a second. If all they had was 6 types it was because all they had was 6 locks. I can guarantee you that any name brand which makes locks will make them in thousands of different combinations. > [@](#): > > at this point its still going to be to expensive to make each physical lock so unique that no one elses key would open your lock. Nonsense. ---
**Author:** ![ticker](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@ticker](https://boards.straightdope.com/u/ticker)\ **Post date:** [December 1, 2008, 1:32pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/27 "2008-12-01T13:32:46Z")
I have one of [these](http://www.yalelock.co.uk/en/yale/couk/ProductsDB/?groupId=261&productId=6792) which the manufacturer claims to have 100,000 combinations. ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [December 1, 2008, 2:02pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/28 "2008-12-01T14:02:09Z")
> [@sailor](#): > > I do not know what car uses that type but my truck has one single button and billions of combinations and the combination changes every time. The system in that link looks like some toy thing or something like that. As usual, it’s not as secure as advertised: [Crypto boffins break car cypher • The Register](http://www.theregister.co.uk/2007/08/24/car_cypher_crack/) ---
**Author:** ![BellRungBookShut-CandleSnuffed](https://avatars.discourse-cdn.com/v4/letter/b/bcef8e/32.png) [@BellRungBookShut-CandleSnuffed](https://boards.straightdope.com/u/BellRungBookShut-CandleSnuffed)\ **Post date:** [December 1, 2008, 2:13pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/29 "2008-12-01T14:13:01Z")
Not two weeks ago I was moving boxes to my friend’s car. She told me it was the first one in the lot. As I was moving the baby seats to make room for the boxes, I began to wonder why she had never told me that she had kids or did babysitting on the side. Turns out her first car was from my perspective the last car. I had been moving someone else’s baby seats around. Not even the same car manufacturer either. I think she has a Land Rover and I unlocked a Jeep or something. ---
**Author:** ![Philster](https://avatars.discourse-cdn.com/v4/letter/p/13edae/32.png) [@Philster](https://boards.straightdope.com/u/Philster)\ **Post date:** [December 1, 2008, 2:43pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/30 "2008-12-01T14:43:28Z")
Anecdotes: I’ve opened the wrong car door twice with my keys. Once in high school I had my car keys ('85 Pontiac Firebird) in my pocket and put the key into a fellow students Pontiac Firebird and, voila, it opened. We were actually kidding before-hand saying, “I wonder what the odds are of my key opening your door?” The other time was a few years ago when I came out of the barber shop, walked up to what I thought was my red Jetta, inserted the key and opened the door, but it felt strange, because as I looked up from the lock I clearly could see my Jetta a few spots over. The owner of the Jetta came over with a smile and in so many words said, “I’ve done the same thing”. ---
**Author:** ![muldoonthief](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/muldoonthief/32/3188_2.png) [@muldoonthief](https://boards.straightdope.com/u/muldoonthief)\ **Post date:** [December 1, 2008, 2:50pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/31 "2008-12-01T14:50:00Z")
> [@MikeS](#): > > Maybe it’s just late at night and I’m overtired, but shouldn’t this be 7[sup]5[/sup] = 16 807 keys, rather than 5[sup]7[/sup] = 78 125? You’re right, it’s (number of positions)^(number of tumblers). Consider the degenerate case - 1 tumbler, 7 positions. Obviously there are 7 different possible keys. 1^7 = 1, incorrect, but 7^1 = 7, correct. ---
**Author:** ![Philster](https://avatars.discourse-cdn.com/v4/letter/p/13edae/32.png) [@Philster](https://boards.straightdope.com/u/Philster)\ **Post date:** [December 1, 2008, 2:58pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/32 "2008-12-01T14:58:27Z")
Anecdotes: I’ve opened the wrong car door twice with my keys. Once in high school I had my car keys ('85 Pontiac Firebird) in my pocket and put the key into a fellow students Pontiac Firebird and, voila, it opened. We were actually kidding before-hand saying, “I wonder what the odds are of my key opening your door?” The other time was a few years ago when I came out of the barber shop, walked up to what I thought was my red Jetta, inserted the key and opened the door, but it felt strange, because as I looked up from the lock I clearly could see my Jetta a few spots over. The owner of the Jetta came over with a smile and in so many words said, “I’ve done the same thing”. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [December 1, 2008, 3:07pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/33 "2008-12-01T15:07:09Z")
In replay to **Critical1** : > [@sailor](#): > > … > i do not believe that for a second. If all they had was 6 types it was because all they had was 6 locks. I can guarantee you that any name brand which makes locks will make them in thousands of different combinations. > > Nonsense. I was going to post pretty much what **Critical1** said about the very limited offerings at big box hardware stores. Sure they can _make_ a lot of combinations, but a given store will only _stock_ a very small number of them. So if a builder is putting up some houses, there’s probably going to be some of them that have the same keysets. Food for thought about how much do you trust your subdivision neighbors. As for keyless cars and security: [start reading here.](http://slashdot.org/article.pl?sid=06/05/03/1928256) ---
**Author:** ![ivan\_astikov](https://avatars.discourse-cdn.com/v4/letter/i/58f4c7/32.png) [@ivan\_astikov](https://boards.straightdope.com/u/ivan_astikov)\ **Post date:** [December 1, 2008, 3:38pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/34 "2008-12-01T15:38:24Z")
As an ex-acquaintance of several car thieves in my misspent youth, I can add that certain keys were highly valued amongst them, for their ability to open the locks of any Ford car, up to a certain registration year. ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [December 1, 2008, 4:07pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/35 "2008-12-01T16:07:05Z")
> [@ftg](#): > > As for keyless cars and security: [start reading here.](http://slashdot.org/article.pl?sid=06/05/03/1928256) That links to [http://www.leftlanenews.com/gone-in-20-minutes-using-laptops-to-steal-cars.html](http://www.leftlanenews.com/gone-in-20-minutes-using-laptops-to-steal-cars.html) which explains little. As usual news articles are so badly done as to be worthless. One reporter will write an article saying electronic locks are 100% safe and the next reporter will say they are worthless crap, and both of them will use a few fancy words they do not understand but none of them will be able to give any sort of meaningful explanation. It is possible that particular models have particular weaknesses but that is not inherent in the system. A wireless system can be made as safe as you like and virtually impossible to crack. By the way, do they sell similar wireless controls for homes? Or maybe I could adapt one of a car. ---
**Author:** ![Stranger\_On\_A\_Train](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@Stranger\_On\_A\_Train](https://boards.straightdope.com/u/Stranger_On_A_Train)\ **Post date:** [December 1, 2008, 4:34pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/36 "2008-12-01T16:34:06Z")
> [@Chronos](#): > > Oh, I forgot to mention another situation that might be of interest to the OP: In high school, we were all issued combination padlocks for our lockers. But friends often told each other their combinations, and it quickly became apparent that many locks, though they had different numbers, had the same pattern. For instance, one student’s might be 17-21-30, and another student would have 23-27-36 (the first student’s combination +6). So you could make batches of 40 identical locks at a time and just put the dial on differently, and you’d end up with 40 different combinations, but they wouldn’t really be secure, since you could get someone’s combo by finding out what the last digit is (by looking at the lock after they’d opened it), and then guessing which of about 10 different patterns they had. It is possible (by a method I will not elucidate on but which can readily be found elsewhere) on most spin dial combination padlocks to read the last number in the combo, and often the middle number as well, and since even well built consumer combopads (Master, Abus) the error range is +/- one digit, you have only about a few dozen combinations to try. Cable dial combo locks are even worse; with a little practice it is possible to read the combo in under twenty seconds and walk away with a bike. With regard to pin tumbler locks, most common locks have only five or six tumblers, and four or five height settings, which gives between 1024 and 7776 possible combinations not including the mechanical limitations previously indicated by **Chronos**. (The variation in height settings are created by using different combinations of key and driver pins to provide a shear line; see the [Wikipedia article](http://en.wikipedia.org/wiki/Pin_tumbler_lock) on the topic.) In addition, many pin tumbler locks for commercial buildings and apartments are master keyed (meaning they have two sets of key tumblers) which creates additional shear lines; such locks are typically easier to pick. The use of all-out tumblers, alignment sensitive (mushroom) tumblers, and a second line of internal tumblers is intended to make bypassing the lock mechanism more complex, but none of these means is foolproof or ensures that keying is unique. However, the concern about having unique key combinations is rather a minor issue; the number of combinations virtually ensures that no casual user will have a similar key (stories about car makes sharing a small number of combinations aside), but it is typically easier to bypass the lock by some means other than picking the tumblers, especially in pursuit of nefarious purposes where damage to the lock or other entry points is immaterial. Most padlocks can be readily bypassed by a shimming attack on the shackle, and that assumes that the hasp itself is secure from attack. Most houses are far more vulnerable to entry via window or glass door than a frontal attack on a door lock. So trying to make locks unique in combination is not only futile, but pointless from a security aspect as well. Mechanical locks should really be considered an anachronism at this point; it is relatively simple to make an inexpensive, self-contained locking system using an encrypted electronic handshake that is unique and essentially mathematically unbreakable. However, the desire to have a purely mechanical system is entrenched in both the lock manufacturing industry and the public at large. Stranger ---
**Author:** ![Chefguy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chefguy/32/138_2.png) [@Chefguy](https://boards.straightdope.com/u/Chefguy)\ **Post date:** [December 1, 2008, 4:57pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/37 "2008-12-01T16:57:40Z")
> [@Q.E.D](#): > > Not even close. The typical “Arrow” type house key has, as noted above, five tumbler positions with each capable of 6 different pin lengths for a total of 15,575 combinations. Long odds for finding a duplicate, but far short of being identical. Pin length is not the only variable for keyways. You also have the “left”, “center”, and “right” options for each cut. Medeco locks throw in a fourth option which makes the lock virtually unpickable. ---
**Author:** ![CookingWithGas](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cookingwithgas/32/485_2.png) [@CookingWithGas](https://boards.straightdope.com/u/CookingWithGas)\ **Post date:** [December 1, 2008, 5:11pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/38 "2008-12-01T17:11:46Z")
> [@beowulff](#): > > As usual, it’s not as secure as advertised: [Crypto boffins break car cypher • The Register](http://www.theregister.co.uk/2007/08/24/car_cypher_crack/) Oddly that article says, " It’s far easier to capture the code used by a target when he opens his car and then replay it, rather than getting into all this complicated code breaking stuff." But defeating an attempt to capture a single code and replay it is exactly what these devices are good at, even though they could be cracked by more sophisticated means. Does the author know what he’s talking about? ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [December 1, 2008, 5:29pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/39 "2008-12-01T17:29:16Z")
> [@CookingWithGas](#): > > Oddly that article says, " It’s far easier to capture the code used by a target when he opens his car and then replay it, rather than getting into all this complicated code breaking stuff." But defeating an attempt to capture a single code and replay it is exactly what these devices are good at, even though they could be cracked by more sophisticated means. Does the author know what he’s talking about? Exactly, most news articles are written by people who are woefully ignorant of the topic. Capturing a code gains you nothing because each code is used once and then discarded. A new code is required each time. ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [December 1, 2008, 5:59pm UTC](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133/40 "2008-12-01T17:59:41Z")
> [@sailor](#): > > Exactly, most news articles are written by people who are woefully ignorant of the topic. Capturing a code gains you nothing because each code is used once and then discarded. A new code is required each time. That’s not completely true. Capturing the code may give you information as to where in the sequence the pseudo-random number generator is. Also, there are possible vulnerabilities due to the necessity to account for the transmitter and receiver getting out of sync (what happens if you press the transmitter button when you are too far away for the receiver to detect it?) [Previous page](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133.md?page=1) [Next page](https://boards.straightdope.com/t/locks-arent-unique-are-they/475133.md?page=3)