What Rate Limiting Does to a 6-Digit Passkey

What Rate Limiting Does to a 6-Digit Passkey

Ada re-derives this chapter’s own numbers step by step, at full precision

ADA · CALCULATION AUDIT

What Rate Limiting Does to a 6-Digit Passkey

A BLE device protects pairing with a random 6-digit passkey, one of 1,000,000 values, and the chapter clocks a brute-force attacker at 13.89 hours when nothing throttles 10 guesses a second. Add a retry delay of one attempt per 30 s and the same search stretches to 174 days — a 300x slowdown. This audit rebuilds both times and asks whether that 300x comes from the length of the passkey or purely from how hard the device throttles retries.

Companion to the chapter Encryption and the Key Hierarchy — every number here comes from that chapter.

Try

A BLE device protects pairing with a random 6-digit passkey, one of 1,000,000 values, and the chapter clocks a brute-force attacker at 13.89 hours when nothing throttles 10 guesses a second. Calculate this case.

Observe

Add a retry delay of one attempt per 30 s and the same search stretches to 174 days — a 300x slowdown. Check shows this.

Explain

The design meaning is in the ratio: 15,000,000 / 50,000 = 300x, and that 300 is just the rate ratio 10 / (1/30) = 300 -- the entropy term cancels entirely. Rate limiting's slowdown is set purely by how hard you throttle retries, not by how long the PIN is, which is why a modest 20-bit passkey plus a retry delay turns a same-afternoon attack (about 14 hours) into a months-longcampaign. Check confirms it.

See the relationship before changing it

The figure reads from left to right. The blue input is retry delay. The middle card names the page’s rule. The green output is average attack time. The arrow matters: change the input, apply the rule once, then read the result with its unit.

Walk the arrow. The passkey space stays fixed; the retry delay stretches time.

Derive the baseline in four named moves

1. 1

   Name the input. The chapter baseline is 30 s.

2. 2

   Name the relationship. time = 1,000,000 guesses x delay x 0.5 / 86,400

3. 3

   Substitute with units. 1,000,000 x 30 x 0.5 / 86,400 = 173.6 days

4. 4

   Read the result. Keep the unit beside the value, then use the result only inside the technical boundary below.

Predict, then change retry delay

Try Predict how average attack time responds when retry delay moves. Calculate retry delay; compare average attack time with that prediction.

Retry delay

30 s

Chapter baseline

Average attack time

Observe Return to 30 s. Recheck average attack time with retry delay at its chapter value.

Explain The passkey space stays fixed; the retry delay stretches time.

Check yourself

What should you do before trusting a moved-slider result?

Answer: Predict its direction, apply the displayed relationship, keep the units, and compare the reset value with the chapter’s worked baseline.

What does this small model leave out?

Answer: Only retry delay moves here. The average attack time calculation excludes field effects listed below.

Honesty note. The average attack time result holds retry delay as the only changing input. It is not a field prediction.

Technical boundaries

The fixed inputs for “What Rate Limiting Does to a 6-Digit Passkey” omit offline attacks, weak randomness, implementation leakage, distributed attackers, credential reuse, or compromise of stored keys; “What Rate Limiting Does to a 6-Digit Passkey” therefore reports only its named fixtures.

Ada: The Putting-Numbers panel gives a passkey brute-force time with and without rate limiting. Let me rebuild both from T_attack = (2^entropy / R) x 0.5 and see exactly where the protection comes from.

A random 6-digit passkey has log2(1,000,000) = 19.9316 bits of entropy, so 2^19.9316 = 1,000,000 guesses:

• Unlimited, 10 attempts/second: T = (1,000,000 / 10) x 0.5 = 50,000 s, and 50,000 / 3,600 = 13.89 hours.
• Rate-limited to one attempt per 30 s (R = 1/30): T = (1,000,000 / (1/30)) x 0.5 = 1,000,000 x 30 x 0.5 = 15,000,000 s, and 15,000,000 / 86,400 = 173.6 days, about the stated 174 days.

The design meaning is in the ratio: 15,000,000 / 50,000 = 300x, and that 300 is just the rate ratio 10 / (1/30) = 300 – the entropy term cancels entirely. Rate limiting’s slowdown is set purely by how hard you throttle retries, not by how long the PIN is, which is why a modest 20-bit passkey plus a retry delay turns a same-afternoon attack (about 14 hours) into a months-long one (about 174 days).

Every number above is taken from the chapter’s own material and re-derived step by step.