The Lemon Fool

My aged brain can't handle this.....

I'm getting a key safe fitted tomorrow. It has keys 0-9, plus A and B. It requires codes between 4 and 8 digits, digits cannot be used more than once, and the sequence does not matter, so a code of 123A can be typed in as 1A32, A321, etc.

Since a safebreaker does not know how many digits are used, is a 4-digit code any less secure than an 8-digit code? Obviously a 4-digit code is easier to remember and less hassle to type in than an 8-digit code.

--kiloran

There is some maths here. You have 12 buttons and this link assumes only 10.
If you can use any order there are surprisingly few combinations (only around 200 different 4 digit combinations using 10 buttons)edit:1000 if you read the comments. 5 seemed the optimum with 5 buttons, so maybe 6 for yours?

https://bugadvisor.com/2013/08/09/key-l ... nk-update/

This should help

https://www.mathsisfun.com/combinatorics/combinations-permutations-calculator.html

As Midsmartin suggests, 6 is the optimum number of characters with 924 combinations. 5 & 7 have 592 each, and 4 & 8 have 495 each.

Midsmartin wrote:There is some maths here. You have 12 buttons and this link assumes only 10.
If you can use any order there are surprisingly few combinations (only around 200 different 4 digit combinations using 10 buttons)edit:1000 if you read the comments. 5 seemed the optimum with 5 buttons, so maybe 6 for yours?

https://bugadvisor.com/2013/08/09/key-l ... nk-update/

Perfect! Many thanks, I'll go for 6

--kiloran

mike wrote:This should help

https://www.mathsisfun.com/combinatorics/combinations-permutations-calculator.html

As Midsmartin suggests, 6 is the optimum number of characters with 924 combinations. 5 & 7 have 592 each, and 4 & 8 have 495 each.

By experimentation with that calculator, I see that the optimum number of characters to choose is half the number of characters available. (If the total number is odd, the optimum number will be half rounded up or down)

I'll leave it for someone better at maths than me to explain why

chas49 wrote:

mike wrote:This should help

https://www.mathsisfun.com/combinatorics/combinations-permutations-calculator.html

As Midsmartin suggests, 6 is the optimum number of characters with 924 combinations. 5 & 7 have 592 each, and 4 & 8 have 495 each.

By experimentation with that calculator, I see that the optimum number of characters to choose is half the number of characters available. (If the total number is odd, the optimum number will be half rounded up or down)

I'll leave it for someone better at maths than me to explain why

Consider it symmetrically with the puzzle the same for the number of choices made, as left out.

So if there are 8 characters available, choosing 2 (and omitting 6) is the same as choosing 6 (and omitting 2). With an odd number the optimal is the "middle" (so with 9, 5 is optimal), with an even it is a tie (so with 8, 4 and 5 are optimal).

dealtn wrote:

chas49 wrote:

mike wrote:This should help

https://www.mathsisfun.com/combinatorics/combinations-permutations-calculator.html

As Midsmartin suggests, 6 is the optimum number of characters with 924 combinations. 5 & 7 have 592 each, and 4 & 8 have 495 each.

By experimentation with that calculator, I see that the optimum number of characters to choose is half the number of characters available. (If the total number is odd, the optimum number will be half rounded up or down)

I'll leave it for someone better at maths than me to explain why

Consider it symmetrically with the puzzle the same for the number of choices made, as left out.

So if there are 8 characters available, choosing 2 (and omitting 6) is the same as choosing 6 (and omitting 2). With an odd number the optimal is the "middle" (so with 9, 5 is optimal), with an even it is a tie (so with 8, 4 and 5 are optimal).

But that calculator shows for a 9 character set, order irrelevant, no repetitions - the optimal value is 4 or 5 (they both give 126 combinations). For 8 characters, it's 5 (56 combinations). Is the calculator wrong? Or have I misunderstood your post?

chas49 wrote:

dealtn wrote:

chas49 wrote:
By experimentation with that calculator, I see that the optimum number of characters to choose is half the number of characters available. (If the total number is odd, the optimum number will be half rounded up or down)

I'll leave it for someone better at maths than me to explain why

Consider it symmetrically with the puzzle the same for the number of choices made, as left out.

So if there are 8 characters available, choosing 2 (and omitting 6) is the same as choosing 6 (and omitting 2). With an odd number the optimal is the "middle" (so with 9, 5 is optimal), with an even it is a tie (so with 8, 4 and 5 are optimal).

But that calculator shows for a 9 character set, order irrelevant, no repetitions - the optimal value is 4 or 5 (they both give 126 combinations). For 8 characters, it's 5 (56 combinations). Is the calculator wrong? Or have I misunderstood your post?

No it's my explanation!

So consider 10 character selection for instance (as we work in base 10 and have 10 fingers it's intuitively easiest!).

How many unique solutions are there if you have to choose 10? Only one "all of them", which is the same number as "none of them".

How many unique solutions are there if you have to choose 1? Intuitively we should be able to see there are 10 (the number of possible fingers!). Hopefully, intuitively, you can see that is the same number of solutions to the question of choosing 9. The question of choosing 9 can be rephrased as "leaving out 1".

So 0 and 10 will pair, 1 and 9 will pair, 2 and 8 will pair, etc. with progressively higher numbers of solutions, until you get to 5 which doesn't pair, being optimal.

I got the "odd" and "even" explanation wrong in my explanation as you need to include "zero" in the range, so odd numbers have an even number of potential characters, and vice versa. It wasn't clear in my explanation I was using zero!

This is not a simple matter of calculating how many combinations there are for different numbers of digits/letters (I will refer to "digits" from now on for brevity).

With a 12 button safe, if a safe cracker were to use brute force, four digits is not the same as eight digits even though 12C4 and 12C8 are both 495. It would take, on average, about 248 attempts to guess the correct combination in each case but try this: get a safe and try 248 different 4-digit combinations, then, with the same safe, try out 248 different 8-digit combinations. The latter will require more button presses and will take longer.

It is more to do with psychology, however. If the safe cracker relies upon brute force, I would guess that smaller numbers of digits would be attempted first (before giving up). Keeping a tally of which 8-digit combinations have been tried is likely to appear more daunting as well as taking longer. If someone just tries their luck with a few random presses, they might try more buttons, say, six. To a non-mathematically minded safe cracker, it may (incorrectly) seem obvious that there are insurmountably more 8-digit combinations than 4-digit ones so the former may not be attempted.

For these reasons, it may be preferable to err on the side of more digits rather than fewer.


Julian F. G. W.

kiloran wrote:Obviously a 4-digit code is easier to remember and less hassle to type in than an 8-digit code.

An 8 digit code only requires that you remember which 4 keys not to press.

Nothing to do with your basic question but worth remembering if I am right!

Your mention of keys and no repeats suggests to me that perhaps as you press the keys they stay down.
If that is the case there will also be a RESET button.

Do make sure you tell users of the keysafe that they MUST press the RESET button when finished using the device otherwise anybody can take in the relevant keys at a glance, for them to try at their leisure.

For example for a four-key permutation, your are reducing the possibilities from millions for ten keys to just 24.

Regards,
ep

IME, these push-button locks usually reset themselves when they are opened. The C (clear) key (if there is one) is only really needed if a wrong button is pressed.

The buttons are usually (not always) spring-loaded so they always return, although it would be possible to feel if they had been pressed and not reset.

These are true combination locks, i.e., the order in which the buttons are pressed makes no difference. 1234 does the same as 4321, and they both do the same as 12324322114312.

If a safe cracker marks every key with a UV pen, then comes back at a later date and examines the keys with a UV lamp, it is possible to see which buttons have been pressed.


Julian F. G. W.