scary new lock design

[keeferO]

Has anyone checked out acersequencelocks.com or have heard about the acer sequence lock. I was doing some research and found that acer sequence locks made an appearance at defcon 15 where they disclosed a new lock design. The design and concept poses a huge threat to other lock companies and us lock pickers. From everything that I've read and viewed on the website it appears that you WILL NOT be able to pick, bump or impression the lock. The website has animations for developing designs and you can download their patent. Check out the site and let me know what you all think. There has to be a way to break this lock. I've been picking for years and found it enjoyable to break a lock, especially an expensive one, but this lock scares me. I think this is the next big thing.

-Keefer O'Malley

[lunchb0x]

Looks interesting, only had a quick look at it but I don't see why it can't still be picked, after all it is mechanical and there are tolerance's in the lock which would make picking possible.
Will have a look at all the animations on there web site later on.

[unlisted]

Nothing will ever be "unpickable" and/or "unmanipulatible"

I would love to see a working concept in real life..

[Engineer]

Interesting, but I'm not alarmed.

The inverted "teeth" shape in the top bit all have to be differing heights (or widths). That is complex machining and requires very small and accurate machining.

I suspect it will be prone to wear and relatively expensive. Machining will have to be be fairly high tolerances. Nice idea and a very approximate solution to something I've thought about and that I've seen on here (the idea that the insertion of the key itself requires all the pins to be lifted in sequence). It is a solution though and probably workable too, but I am not convinced it will take off from the high tolerances required and the costs I suspect?

[l0ckp1cker]

How do the top teeth slide in the lock?
It has to be triggered by the key, so that means that you should be able to force it backwards, and then pick it like you normally do.
It might require a dedicated tool, but I don't see it as being the ultimate solution.

But to me this post looks a lot like free publicity.
Is the topic poster in some way connected to the web page / lock?

[unlisted]

But to me this post looks a lot like free publicity.
Is the topic poster in some way connected to the web page / lock?

Hmm... .. ..

[mh]

I don't think it's scary.

The original "proof of concept" had a flaw in that a blank (uncut) key could not even be inserted, i.e. you could decode the lock pin by pin by a very simple form of impressioning.

At first glance the other concepts might have similar flaws.

[mh]

I just had another look, this time at the apparently latest "rotating cam" concept - http://www.acersequencelocks.com/incorrectkey.html

I would stronlgy suggest again to the inventor (I did already in Sneek once) to read Matt Blaze's paper on Master Keying http://www.crypto.com/papers/mk.pdf
specifically the section that refers to how you should not be able to test each pin individually.

Cheers,
mh

[Engineer]

Has anyone actually tried picking this lock? I believe for a patent to be issued a protype has to be made. Only I've looked at it and thought about it a bit more throughly and want to modify my original post a little.

The overhead slider does not go sideways (which would make it all but impossible to fit within the bible of current locks). They say they want it to be retro-fittable, so it cannot be wider. The patent seems to suggest it would slide backwards - Making the lock too deep to be retro-fittable? The new rotating cam would make it too wide for retro-fitting as well.

The animations leave something to be desired. The backwards slider would certainly reduce production costs all and manufacuring would be a lot simpler as well, but the rotating cam would probably be the most expensive of all to make.

1. Someone could drill a small hole in the front and just push the slider, or rotate the cam with a small wire like a paperclip and pick as normal. This would have to be addressed in production models.

3. The ramps on the slider & rotating cam correspond to the heights of the ramps on the key. All you would need to do is to lift the first pin as high as it will go, then put a second pick in (you do not need a tension wrench, so there is plenty of room) and apply pressure to the second pin to hold the slider/rotating cam in place.

Then release the pressure on the first pin and apply greater pressure to the second pin now, to lift it as far as it will go - So moving the slider/rotating cam into the second position.

Now move the first pick from the first pin, to the third pin and continue the process of "walking" the slider/rotating cam quite quickly until it is at the final position. The pick is at the back now, holding the slider in position and is now your tension wrench and just pick the remaining front pins as normally with the other pick.

This lock would seem to be a perfect candidate for being picked with a Sputnik pick (recently mentioned several times on here). I have no doubt that special tools could be made by hobbiests as well. The slide/rotating cam having ramps that correspond directly with the key, mean that a combined pick/decoder should also be easy to do.

It is an interesting idea, but if I am understanding it correctly, it would not take much longer than any cylinder to pick - I'm sorry.

I also find it interesting that we are giving up (for free) the sort of information that a consultancy or even testing house would be charging very many tens of thousands of Dollars for. Getting your new potential product tested and reviewed like this is usually a very serious expense for an inventor and I for one would appreciate it if I was just asked instead.

[raimundo]

I dont read the original post as coming from anyone connected with the patent research, but I take it at face value as coming from a new member who has heard of the lock and is seeking information.
I think its a very good post from a person who may be a valuable new resource to the lp10 community. Not stepping on others for their views of it, just stating my own.

[Legion303]

I have to disagree, Ray, but that's because I can see more information. :P

The original poster's internet connection comes from the same small (population < 22K) town where Acer Sequence Lock's servers are sitting (EDIT: my bad, their servers appear to be physically located in Oregon, just registered in the small town where the poster's ISP is located). It's a pretty funny astroturfing attempt. Honestly, if a company wants a free security evaluation of its locks, it can get it here just by issuing a simple challenge.

We'll need some sample locks, though. What do you say, Keefer? (Or is it Stephen, Clay, or Eric?)

-steve

[unlisted]

I have to disagree, Ray, but that's because I can see more information.

The original poster's internet connection comes from the same small (population < 22K) town where Acer Sequence Lock's servers are sitting. It's a pretty funny astroturfing attempt. Honestly, if a company wants a free security evaluation of its locks, it can get it here just by issuing a simple challenge.

We'll need some sample locks, though. What do you say, Keefer? (Or is it Stephen, Clay, or Eric?)

-steve

Thanks, I was being polite.. and was not sure how to "word" that...

[l0ckp1cker]

Well, I've seen the same poster making similar posts on another forum today, so we know 100% sure know the poster is connected to this lock.

Well, if he comes back to read this:

Send out some samples, I'm sure most of the people here are up for the challenge

[JK_the_CJer]

I also recommend issuing a challenge to us. I'm hanging out in the middle of nowhere in Africa with not much to do but pick locks; lemme at it

[Engineer]

If you click on "keeferO"'s details you can see he visited to post and popped back 15 minutes later (presumably to see if it had come up alright). Since then he has not been back.

There is a chance he has registered more than once, so is seeing the post under a different name, or indeed without logging in at all, since it is in the sections open to anyone to view.

JK_the_CJer (and others) - I don't think we could be provided with samples, I don't think they exist. This is all striking me as ideas only. Surely if anything other than a model was made (and it should have shown up even with a model!) then all the problems with the lock would have been obvious?

Anyone who wants to read the patent could have fun - The variations may not be covered by their patent?

I cannot believe the crass way they tried to stir up publicity - Clearly they know even less about computer security than locks. I'm no hacker, but even I know how to protect my identity if I was going to do something like this.