What Rate Limiting Does to a 6-Digit Passkey

What Rate Limiting Does to a 6-Digit Passkey

Ada re-derives this chapter’s own numbers step by step, at full precision

foundations
math-foundations
calculation-audit
bluetooth-ble
Ada ADA · CALCULATION AUDIT

What Rate Limiting Does to a 6-Digit Passkey

A BLE device protects pairing with a random 6-digit passkey, one of 1,000,000 values, and the chapter clocks a brute-force attacker at 13.89 hours when nothing throttles 10 guesses a second. Add a retry delay of one attempt per 30 s and the same search stretches to 174 days — a 300x slowdown. This audit rebuilds both times and asks whether that 300x comes from the length of the passkey or purely from how hard the device throttles retries.

Companion to the chapter Encryption and the Key Hierarchy — every number here comes from that chapter.

Try

A BLE device protects pairing with a random 6-digit passkey, one of 1,000,000 values, and the chapter clocks a brute-force attacker at 13.89 hours when nothing throttles 10 guesses a second. Calculate this case.

Observe

Add a retry delay of one attempt per 30 s and the same search stretches to 174 days — a 300x slowdown. Check shows this.

Explain

The design meaning is in the ratio: 15,000,000 / 50,000 = 300x, and that 300 is just the rate ratio 10 / (1/30) = 300 -- the entropy term cancels entirely. Rate limiting's slowdown is set purely by how hard you throttle retries, not by how long the PIN is, which is why a modest 20-bit passkey plus a retry delay turns a same-afternoon attack (about 14 hours) into a months-longcampaign. Check confirms it.

See the relationship before changing it

Change the input, apply the rule once, then read the result with its unit.

Derive the baseline in four named moves

  1. 1

    Name the input. The chapter baseline is 30 s.

  2. 2

    Name the relationship. time = 1,000,000 guesses x delay x 0.5 / 86,400

  3. 3

    Substitute with units. 1,000,000 x 30 x 0.5 / 86,400 = 173.6 days

  4. 4

    Read the result. Keep the unit beside the value, then use the result only inside the technical boundary below.

Predict, then change retry delay

Try Predict how average attack time responds when retry delay moves. Calculate retry delay; compare average attack time with that prediction.

30 s
Chapter baseline
Average attack time

Observe Return to 30 s. Recheck average attack time with retry delay at its chapter value.

Explain The passkey space stays fixed; the retry delay stretches time.

Check yourself

What should you do before trusting a moved-slider result?
Answer: Predict its direction, apply the displayed relationship, keep the units, and compare the reset value with the chapter’s worked baseline.
What does this small model leave out?
Answer: Only retry delay moves here. The average attack time calculation excludes field effects listed below.

Honesty note. The average attack time result holds retry delay as the only changing input. It is not a field prediction.

Technical boundaries

The calculation keeps a million possible passkeys and assumes success halfway through that space while changing the retry delay. It does not cover offline attacks, weak randomness, information leaked by the implementation, distributed attackers, reused credentials, or stolen stored keys.

Ada: The Putting-Numbers panel gives a passkey brute-force time with and without rate limiting. Let me rebuild both from T_attack = (2^entropy / R) x 0.5 and see exactly where the protection comes from.

A random 6-digit passkey has log2(1,000,000) = 19.9316 bits of entropy, so 2^19.9316 = 1,000,000 guesses:

  • Unlimited, 10 attempts/second: T = (1,000,000 / 10) x 0.5 = 50,000 s, and 50,000 / 3,600 = 13.89 hours.
  • Rate-limited to one attempt per 30 s (R = 1/30): T = (1,000,000 / (1/30)) x 0.5 = 1,000,000 x 30 x 0.5 = 15,000,000 s, and 15,000,000 / 86,400 = 173.6 days, about the stated 174 days.

The design meaning is in the ratio: 15,000,000 / 50,000 = 300x, and that 300 is just the rate ratio 10 / (1/30) = 300 – the entropy term cancels entirely. Rate limiting’s slowdown is set purely by how hard you throttle retries, not by how long the PIN is, which is why a modest 20-bit passkey plus a retry delay turns a same-afternoon attack (about 14 hours) into a months-long one (about 174 days).

Every number above is taken from the chapter’s own material and re-derived step by step.