Lock Picking 101 Forum
A community dedicated to the fun and ethical hobby of lock picking.
       

Lock Picking 101 Home
Login
Profile
Members
Forum Rules
Frequent Forum Questions
SEARCH
View New Posts
View Active Topics


Live Chat on Discord
LP101 Forum Chat
Keypicking Forum Chat
Reddit r/lockpicking Chat



Learn How to Pick Locks
FAQs & General Questions
Got Beginner Questions?
Pick-Fu [Intermediate Level]


Ask a Locksmith
This Old Lock
This Old Safe
What Lock Should I Buy?



Hardware
Locks
Lock Patents
Lock Picks
Lock Bumping
Lock Impressioning
Lock Pick Guns, Snappers
European Locks & Picks
The Machine Shop
The Open Source Lock
Handcuffs


Member Spotlight
Member Introductions
Member Lock Collections
Member Social Media


Off Topic
General Chatter
Other Puzzles


Locksmith Business Info
Training & Licensing
Running a Business
Keyways & Key Blanks
Key Machines
Master Keyed Systems
Closers and Crash Bars
Life Safety Compliance
Electronic Locks & Access
Locksmith Supplies
Locksmith Lounge


Buy Sell Trade
Buy - Sell - Trade
It came from Ebay!


Advanced Topics
Membership Information
Special Access Required:
High Security Locks
Vending Locks
Advanced Lock Pick Tools
Bypass Techniques
Safes & Safe Locks
Automotive Entry & Tools
Advanced Buy/Sell/Trade


Locksport Groups
Locksport Local
Chapter President's Office
Locksport Board Room
 

The new Master Lock Speed Dial

Information about locks themselves. Questions, tips and lock diagram information should be posted here.

Re: The new Master Lock Speed Dial

Postby prevariikation » 25 Nov 2021 14:47

Ahh, I see what you're saying, thank you! That does help bring intuition in line. It's almost as though commutativity holds, except for rearrangements that would change the order in which fractional parts are set.

I think the first observation makes sense through a similar kind of intuition; a specific sequence of moves applies a near-constant displacement of the disks, except for "jitter" around the starting position, and the 5-fold symmetry ensures that the displacements return after those 5 sequences.
she/her/hers
User avatar
prevariikation
 
Posts: 150
Joined: 22 Feb 2021 0:44

Re: The new Master Lock Speed Dial

Postby prevariikation » 26 Nov 2021 12:19

I've figured out how to undo arbitrary moves without resetting. It's very much proof-of-concept, not a practical approach, but still fun :)

It relies on the observation in my last big post:
prevariikation wrote:[...] on the fifth repetition of a full sequence, the states sync up at the 2nd move, at the latest.

With the following techniques, we can reduce any sequence to the first two distinct moves, turn those into a single move, and change the single move to be any other single move we want. This allows us to undo all moves, which obviously allows us to dial any other sequence we'd like.

Transforming single moves:
Code: Select all
R(U^5)D ≡ D
D(R^5)L ≡ L
L(D^5)U ≡ U
U(L^5)R ≡ R

Reducing two move sequences to single move:
Code: Select all
R(DLR)^5 ≡ R     RL(RL^4)R ≡ R
D(LUD)^5 ≡ D     DU(DU^4)D ≡ D
L(URL)^5 ≡ L     LR(LR^4)L ≡ L
U(RDU)^5 ≡ U     UD(UD^4)U ≡ U


So an example: someone has dialed DDUUR, and we'd like to change that to RULL, without resetting. In the below sequence, all moves are performed consecutively:
Code: Select all
0 DDUUR -> (DDUUR)^4(DDU) -> (DDU)^4(D) -> R^5(L) -> D^5(U) -> L^5(R) -> ULL
                       ^             ^         ^         ^         ^       ^
                       |             |         |         |         |       |
≡ DDU -----------------+             |         |         |         |       |
≡ D ---------------------------------+         |         |         |       |
≡ L -------------------------------------------+         |         |       |
≡ U -----------------------------------------------------+         |       |
≡ R ---------------------------------------------------------------+       |
≡ RULL --------------------------------------------------------------------+

Sorry for quadruple- and quintuple-posting here, I just continue to find the internals fascinating.
she/her/hers
User avatar
prevariikation
 
Posts: 150
Joined: 22 Feb 2021 0:44

Re: The new Master Lock Speed Dial

Postby prevariikation » 25 May 2022 23:00

Blank_Registration discovered a preimage attack on the hash features of this lock, i.e., how to generate a working combination given any valid ending state. He sent me a beautiful cutaway he made and mentioned that he can solve them using the internal coloring, kind of like a Rubik's cube. He challenged me to rediscover the algorithm, so I don't know if this algorithm is his exact algorithm but I imagine it could be similar :)

The algorithm is based on the observation that after the second-to-last distinct move, the other three wheels must already be effectively synced. So the overall process is to

  1. Find the direction of the last move.
  2. Find the second-to-last distinct move direction.
  3. Use this knowledge to sync wheels perpendicular to the last move.
  4. Then sync the wheel in the direction of the last move.
  5. Then move the unaffected wheel into place while preserving the sync of the other three wheels.

As an example, let's find another combination for a lock with the combo set at DD UUU R L R. (I find it helpful to use the visualizer.) The open state would then be
Code: Select all
    0,-1
4,0     1,0
    3,+1

Steps 1 & 2
We know a move leaves a clockwise pattern of -1, 0, +1 in the second coordinate, and so we can tell just from the position indices that the last move will be R. Then the unaffected wheel, the left wheel, tells us the second-to-last move direction. Its second coordinate is 0, meaning the second-to-last move direction is L.

Step 3
We'll sync the top and bottom wheels, which are "perpendicular" to the last move R.

This will use the idea of "offset:" given two wheels, pick one as a reference wheel. The offset of the other wheel is the difference between the number of moves only in the last move direction that are required to align the offset wheel vs. the reference wheel.

Confusing! Let's make it concrete. From the reset state, consider only moving in the last move's direction, R. It takes 5 moves right to align the top wheel with its ending state [0,-1]. It takes 4 moves right to align the bottom wheel with its ending state [3,+1]. So the offset of the top wheel, relative to the bottom wheel, is the difference, (5-4) = 1.

What's the purpose of this? It tells us that if we could advance the top wheel separately, the equivalent of one move to the right, the top and bottom wheels would sync and could be moved into their final positions at the same time, using only R moves.

And we can move the top wheel separately, without disturbing the bottom wheel, by doing an up move. Two moves up effectively counts as one extra move right. In general, it's equal to (the number of moves we need to advance, plus one,) followed by 1 move in the last move's direction to normalize wheel orientations.

Put together, in our example, performing the sequence R UU R will sync the top and bottom wheels. (You can check this by seeing that R UU RRR aligns the top and bottom wheels in their ending states at the same time.)

Step 4
Now we sync the wheel in the last move's direction, R. This is exactly like the process we just did, except we don't start at the reset state, we start after the sequence R UU R, when the top and bottom wheels are already synced.

Let's use the right wheel as the reference point. It takes 3 moves right to align the right wheel with its ending state [3,0]. It takes 2 moves right to align the bottom wheel with its ending state [3,+1]. So the offset of the top & bottom wheels, relative to the right wheel, is (2-3) ≡ 4 (mod 5.) If the last sentence is confusing, it's just that we could replace 2 moves with 7 moves, since the lock states repeat every 5 consecutive moves, and that would also give us an offset of (7-3) = 4.

And then we move the top & bottom wheels separately, by moving left (4+1 = 5) times, then normalizing the wheels with 1 move R.

Put together, the top, bottom and right wheels are all synced after performing the sequence R UU R LLLLL R.

Step 5
Now we can move the unaffected wheel while maintaining sync of the other three wheels. This is done by moving in the second-to-last move direction, then the last move direction, repeated as many times as necessary.

In this case, after repeating LR 3 times, the left wheel is aligned with its ending state [4,0] and, crucially, the other three wheels have maintained their sync.

Now we can align the 3 synced wheels with their ending states, just by moving right 4 times. The lock is now in the opening state, and we can see that the sequence R UU R LLLLL R LR LR LR RRRR serves as another combination for this lock.

Phew :wink:
I like this a lot. Given any valid ending state, we can construct a sequence from the reset position that is also a combination for that state. This helps my intuition for why every valid ending state is reachable, too – by computation, mh and others have demonstrated that's true, but this algorithm is a constructive proof, which is very helpful to me.
she/her/hers
User avatar
prevariikation
 
Posts: 150
Joined: 22 Feb 2021 0:44

Re: The new Master Lock Speed Dial

Postby mh » 26 May 2022 2:01

Very nice!
"The techs discovered that German locks were particularly difficult" - Robert Wallace, H. Keith Melton w. Henry R. Schlesinger, Spycraft: The secret history of the CIA's spytechs from communism to Al-Qaeda (New York: Dutton, 2008), p. 210
Image
mh
Moderator
 
Posts: 2437
Joined: 3 Mar 2006 4:32
Location: Germany

Re: The new Master Lock Speed Dial

Postby prevariikation » 28 May 2022 19:13

Here's a super long (~1hr) video about decoding an unknown Speed Dial from scratch. It uses hand manipulation and the visualizer with the precomputed move tables turned off. A huge thank you to everyone here for your information and encouragement :D
she/her/hers
User avatar
prevariikation
 
Posts: 150
Joined: 22 Feb 2021 0:44

Re: The new Master Lock Speed Dial

Postby prevariikation » 26 Oct 2022 15:36

The Speed Dial has been discontinued, according to the internet at large. I mourn alongside the escape room owners who must be stocking up right now. So right on time :lol:, I'm able to decode locks without computer visualization or paper assistance, and I want to share the tricks I've found. As another long post..

Quick overview of the process, from the video above:
  1. Confirm first binding disk — sticking-while-sliding
  2. Find gate on first binding disk — LRU stepping
  3. Approximate the location of second binding disk — Blank_Reg's dragging technique, used opposite the first binding disk
  4. Isolate second binding disk — Blank_Reg's pre-image attack, with trick 1 below
  5. Find gate on second binding disk — directly, with partial moves rotating disks backward using trick 2, or indirectly, using process of elimination or trick 3: Master_Unlocked's observation on ToooL's blackbag
  6. For the following steps, generate a sequence of moves that puts first and second binding disks in their found gates, as a new starting sequence — internalize mh's positional notation
  7. Find third binding disk — partial moves, process of elimination, or brute force
  8. Find gate on third binding disk — partial moves, process of elimination, or brute force
  9. Iterate through positions on the fourth disk — brute force, using trick 1, or trick 4: stepping the free disk around
  10. Open! Ideally.
This isn't a full tutorial on decoding, but I'm getting opens with relative speed, from 5-30 minutes unaided, most factory combos in under 10 minutes. With maybe three days of practice, this could be you too! :D

Without loss of generality, I'll be assuming that the first binding disk is the top disk, which is generally the case.

Trick 1: generic moves to individually advance disk positions for disks in the last move direction
If we have a sequence of moves [...]X*Y*, we can perform uniform, easily memorized moves to advance a chosen disk in the Y direction by one position while keeping the others in the same position. Let A be the movement opposite to the chosen disk. Then the moves boil down to
(A^5 Y X Y^5), or just (A^5 Y) if (A = X)

Specifically, after we've discovered the top gate and we have a sequence of moves X*D* that click on the next dragging move down, we need to isolate disks to tell which disk has the gate that's clicking.

How? Again, let A be the movement opposite to the chosen disk. We consider advancing the chosen disk by one position as actually advancing the non-chosen disks (in the D direction) by 4.

This works out as A^5 and D to resync, and we know from observation 1 below that the disks in the D direction will be exactly where they were, except the target disk which has advanced by one. Now the top disk has been touched 5 times by A^5, so we may need to place it back in the proper position, if and only if (A != X).

This becomes (X D D^4) = (X D^5). The top disk will have almost completed a full rotation, without overshooting, so we touch it once and resync down for (X D). Then the last D^4 walks the bottom wheels back into position.

A table for ease of reference.
Code: Select all
Move sequence ending R*D*:
  advance L disk -> (R^5 D)
  advance R disk -> (L^5 D) (R D^5)
  advance D disk -> (U^5 D) (R D^5)

Move sequence ending L*D*:
  advance L disk -> (R^5 D) (L D^5)
  advance R disk -> (L^5 D)
  advance D disk -> (U^5 D) (L D^5)

Move sequence ending U*D*:
  advance L disk -> (R^5 D) (U D^5)
  advance R disk -> (L^5 D) (U D^5)
  advance D disk -> (U^5 D)


Additional fun: instead of chaining these patterns to move a chosen disk by n positions, we can move n positions directly by breaking down the pattern of (A^5 Y X Y^5) as (A^(6-n) Y (X Y)^n Y^4).

Trick 2: internalizing useful partial move directions
Image
The image shows disk positions after moving in the up direction, represented by the faded gray arrow. We can see, as the orange arrows demonstrate, that moving in the left direction immediately attempts to counter-rotate the top and the left disks, and moving downward immediately counter-rotates the right disk. Internalizing this knowledge allows us to know how to make partial moves even without a visualizer guiding the process. We simply need to keep track of our last two distinct move directions to work out the orientations of each disk.

It's also worth noting that if we wish to repeatedly move a disk backward one position at a time using partial moves, the relative pattern is URLURL..., the opposite of the LRU pattern that advances a disk by one position at a time.

Trick 3: if clicks while dragging don't ever stick the knob partway, the last move may be in the dragging direction
This is adapted from Master_Unlocked's observation on ToooL's blackbag.

As Blank_Reg has noted, it can be difficult to detect clicks while dragging if the clicks happen as the knob is returning to center. If there are no intermediate sticking points while dragging, clicking or otherwise, it can be a good indicator that each gate on the remaining three disks only aligns when the knob is in the center position, and hence the last move direction is actually the dragging direction.

Trick 4: stepping the free disk around
A fun one :) If we have the three disks in the last move direction Y solved, a quick way to iterate through possibilities for the fourth disk is to repeatedly move (A Y^5), where A is any direction not equal to Y, no resetting needed. This will advance the fourth disk by one move A, while keeping the other disks in the proper position. After five iterations using the direction A, the fourth disk will have completed a full rotation, and you can move on to (B Y^5) then (C Y^5).

Observation 1: moving orthogonally? Penalized one move.
We consider the position of just a single disk here, which is put into said position with move Y. If we repeat the move Y, it will rotate the disk exactly 1/5 of a rotation with each move, giving us the five-fold symmetry where (Y) = (Y Y^5).

If we instead think about repeatedly moving in the direction A, (A != Y) but A is a move that still touches the disk, we can bend intution to see that the initial move A must rotate the disk somewhat less than the full 1/5 turn that would be made by inputting Y. Further moves in the A direction, however, would then be 1/5 turn at a time. And so the cumulative rotation of (Y A^n) is just barely less than the cumulative rotation of (Y Y^n). And it turns out, inputting a move Y will jump only that tiny sliver of missing rotation, giving us (Y Y^n) = (Y A^n Y).

As it applies in trick 1, we're interested in the cases where (Y Y^5) = (Y A^5 Y).

Thanks for reading
I know I drop a lot of miscellaneous stuff here. I'll probably post again when I have more decoding videos, should be simpler than my last.
she/her/hers
User avatar
prevariikation
 
Posts: 150
Joined: 22 Feb 2021 0:44

Re: The new Master Lock Speed Dial

Postby prevariikation » 20 Dec 2022 11:23

Hey again! Here's the Stupid Speed Dial Trick of the Day! :mrgreen: If you have a lock with a combination such that the last two distinct moves (in order) aren't equal to UR, LU, DL, or RD, you can easily generate a combo that opens on a partial move.

Begin by dialing the existing combination, then add 5 moves in the direction counterclockwise of the last move. On the 6th move in the same direction, move the knob slowly and repeatedly attempt to open the lock. (It should work while dragging, too, if you have a light touch.)

For example, a lock set to UDDR will open on UDDR UUUUU ~U~, where the last move uses that pulsating opening pressure on the shackle while dialing slowly.

Where this gets fun is using the "antecedent" combinations that I just added to the visualizer, which shows the valid combination states that can immediately precede the current lock state. Then we can check the states that can come before UDDR UUUUU U ≡ UDDR U, which includes DLRU. And the lock will open on a partial move during DLRU ~U~! Weird but fun :P
she/her/hers
User avatar
prevariikation
 
Posts: 150
Joined: 22 Feb 2021 0:44

Re: The new Master Lock Speed Dial

Postby Squelchtone » 21 Dec 2022 0:47

prevariikation wrote:Hey again! Here's the Stupid Speed Dial Trick of the Day! :mrgreen: If you have a lock with a combination such that the last two distinct moves (in order) aren't equal to UR, LU, DL, or RD, you can easily generate a combo that opens on a partial move.

Begin by dialing the existing combination, then add 5 moves in the direction counterclockwise of the last move. On the 6th move in the same direction, move the knob slowly and repeatedly attempt to open the lock. (It should work while dragging, too, if you have a light touch.)

For example, a lock set to UDDR will open on UDDR UUUUU ~U~, where the last move uses that pulsating opening pressure on the shackle while dialing slowly.

Where this gets fun is using the "antecedent" combinations that I just added to the visualizer, which shows the valid combination states that can immediately precede the current lock state. Then we can check the states that can come before UDDR UUUUU U ≡ UDDR U, which includes DLRU. And the lock will open on a partial move during DLRU ~U~! Weird but fun :P


you're getting scary good at this!

nice work, thanks for the tip!
Squelchtone
Image
User avatar
Squelchtone
Site Admin
 
Posts: 11307
Joined: 11 May 2006 0:41
Location: right behind you.

Re: The new Master Lock Speed Dial

Postby prevariikation » 21 Apr 2023 17:10

Heya! Here's the Stupid Knollan Trick of the Day! Same mechanism, different lock, this version with false gates 8)

There are 3 gates on each disk, 2 false and 1 true. Gates are evenly spaced by five positions, and are in a URL pattern when read in the counterclockwise direction of disk movement.

If all fences are in a gate on all disks, true or false, we can quickly cycle through the 12 possible configurations of gates to find the opening position.

Without loss of generality, assume we have all disks on a gate, last move U, and free disk on a gate in D direction. Moving UULL syncs gates on disks in the L direction, but displaces the R disk one past the next gate. However, we return to visit all gates on the free disk R by moving (D L^5)^2, (U L^5)^2, (R L^5)^2, where D, U, R, follows the URL pattern from earlier, relative to the R disk. We've then rotated fourteen spaces, returning to the gate we initially skipped over, and have all disks on a gate, last move L, free disk in gate in R direction. This is our starting position, just rotated 90 degrees, so we translate these series of moves and we're ready to repeat the process!

Thanks for reading! Here's a video with some spinning colors.
she/her/hers
User avatar
prevariikation
 
Posts: 150
Joined: 22 Feb 2021 0:44

Re: The new Master Lock Speed Dial

Postby mh » 21 Apr 2023 17:58

Like always, very nice!!
"The techs discovered that German locks were particularly difficult" - Robert Wallace, H. Keith Melton w. Henry R. Schlesinger, Spycraft: The secret history of the CIA's spytechs from communism to Al-Qaeda (New York: Dutton, 2008), p. 210
Image
mh
Moderator
 
Posts: 2437
Joined: 3 Mar 2006 4:32
Location: Germany

Previous

Return to Locks

Who is online

Users browsing this forum: No registered users and 6 guests