The new Master Lock Speed Dial

[Blank_Reg]

Hope its ok that I necropost on this.

I am about to post a long boring video about this lock, but I want to share my 4 digit brute forcing and decoding sheet I made.

https://drive.google.com/file/d/1u3AgRIjficr5jQgkzEi9W6LfUoCii-G_/view?usp=sharing


It only takes 2 minutes and 30 seconds to reach 50% of the 4 direction input space. 8 minutes to check the whole space. I'd love for people to test this on their speed dials set to a 4 direction code and let me know what you think.

[femurat]

Hope its ok that I necropost on this.

It's always fine to reply to an old thread when you add something useful!

I'll dig out my padlock and let you know.

Cheers

[GWiens2001]

The problem is that the combination is not limited to four moves. It can have no moves (yes, it can be set to no combination). It can have three. Or five. Or 6,834,221 moves to open. Mine are set to 10 moves to open.

Gordon

[Blank_Reg]

I am aware of that and am specifically handling the case of a 4 move code.

[GWiens2001]

Excellent. Just want to be sure.

The lock does come with a four move combination, and most people never change it, so four is a good starting number.

Gordon

[Blank_Reg]

It cuts both ways, when you exhaust all states visitable by a 4 move sequence you have also simultaneously visited alot of the states that would be arrived at by sequences of other lengths. So when you decide you want to also check for longer codes, it turns out you already have.

My 4 move brute force sequence is 636 moves long. I am still calculating a brute force sequence that covers everything from 0-6 moves to see how long it is, its increase in length will be far smaller than the 16x one might expect from the keyspace size inrease. We will see how long it ends up.

As you say, 4 moves is a natural target, if you see a lock with the sticker still on it, you can be pretty sure it takes a 4 move code.

[mh]

Or 6,834,221 moves to open.

While you may have used that many moves to program it, the lock has only 7,501 programmable states, and a much shorter sequence will collide.
According to the table on the last page of my paper, any sequence that has more than 11 moves collides with a shorter sequence that will also open.

My Flash / Action Script tool http://visualizer.tosl.org/ helped with visualizing this, until Adobe Flash stopped working end of 2020. Did anyone manage to install Gnash (“GNU Flash”) successfully on a recent macOS?

[Blank_Reg]

If anyone has trouble sleeping tonight they can just watch my '3 attacks' video
https://www.youtube.com/watch?v=aAXUoO-VYY0

I think the only truly novel attack in my video is the vibration one, and I haven't got it to work on real locks yet, I just don't have enough vibrators haha.

mh: Gnash is running your visualizer for me on linux amd64 but I think there is a bug where I don't see wheel positions and sequences, I can't tell because I don't know what normal behaviour is.

[mh]

Blank_Reg: Did you get gnash from a package manager (which one)? Or build from source?

[Blank_Reg]

the ubuntu mainstream (if i recall) apt package worked for me.

[Blank_Reg]

Made this today. Not pictured: the face which is totally stock.

[GWiens2001]

Very interesting. Did you use the color marks to keep track of the rotation of wheels?

Gordon

[Blank_Reg]

Yes, I can see the address of the all the wheels because I can see three stripes at all times,

I mainly did this to understand "error" states but It also really shows the (-1)(0)(+1) relationship between the wheels on the last move. Mh talked about that in his decoding paper but I didn't understand it till I saw this cutaway work.

I found your cutaway pics on another forum too! https://www.keypicking.com/viewtopic.php?f=111&t=11599

still waiting for MH to re-up his cutaway pics

[GWiens2001]

Didn't want to clutter up your thread which already has pictures with more of them.

Gordon

[mh]

FYI, I now published the old "mh's Visualizer" ActionScript source code here: https://github.com/mh-/AxisVisualizer