Hacker News Reader

Comment by elromulous | Hacker News Reader

+1. LPL has disproven the claims of many "unpickable" locks.

If computer security has taught me anything, unhackable/impenetrable claims, cyber or physical, should be met with skepticism.

View on HN

I used to be huge Abloy Protec2 fanboy until I found out that they are very litigious, which made me wonder if their locks have been picked but the results were just taken down. I think they are still great locks. If anyone is going to break into my house there are easier and faster ways than picking the lock. However, the notion of an unpickable lock requires a lot of convincing for me to accept now.

https://www.youtube.com/watch?v=6UZ6tcvgd9U

The middle part is always what I tell people, yeah you locked the door but did you lock your window panes?

Kromer Protector, unpicked since the late 1800s. There are unpickable locks, you just can't afford them.

I have always said "if someone made it, someone can break it"

Nothing is unhackable/impenetrable. period.

Darn right there.

Is it can be opened with a key, there's nothing stopping something else emulating that key - even if resorting to brute force until the key pattern matches.

Right, but just like with e.g. cryptography, you need to make it more expensive to crack than whatever it's protecting.

Well yea, you could blow it apart with explosives, melt it with acid, or beat the key holder with a wrench until he gave you the key. But I think the idea around "picking" is to nondestructively operate the lock without using the key it is designed for or a copy of such.

Can you make a lock that reliably detects pick attempts and renders itself temporarily or permanently inoperable? (Not that very many lock users would prefer this security vs. availability tradeoff over what they're used to, probably.)

We've had theoretically-unbreakable cryptography for a long time now, particularly hash functions and encryption ciphers. There are still some weaknesses around timing attacks, and of course there's always the "wrench attack," but the algorithms themselves are as secure as we will ever need anything to be.

None of our block cipher or hash function primitives have unconditional security proofs; a lot of the reason to accept them is that the best-known attacks against the widely-used ones are very poor, even after a lot of knowledgeable people have studied them for a long time. But that doesn't logically exclude the possibility that there are unknown mathematical insights that would lead to much more effective attacks.

Often, protocols or constructions on top of these cryptographic primitives may have proofs that unconditionally reduce their security to the security of the primitives ("breaking this is at least as hard as AES", normally because "if you could break this, you could also break AES"), or in some cases proofs that do this by making only comparatively uncontroversial mathematical assumptions.

This is a good situation to be in, all things considered, and way better than the past, but it's not an ideal situation!

Outside of OTP no encryption is “theoretically unbreakable”. They all rely on unproven assumptions.

I'd go so far as to say that outside OTP, cryptography is always breakable.

You can always just guess keys. The aim of most secret key cryptography is to make sure there aren't much better strategies than that to break it, or if there are that the key sizes are sufficiently big it doesn't matter.

With OTP you can't guess keys, as there is a valid key for any possible message. It is unbreakable without the original key.

There is no proof that hash functions exist

Reply on news.ycombinator.com