The Lockout Slowdown Is Independent of PIN Length

Ada re-derives this chapter’s own numbers step by step, at full precision

ADA · CALCULATION AUDIT

The Lockout Slowdown Is Independent of PIN Length

A lab challenge pits an attacker against a 6-digit PIN — 1,000,000 combinations — behind a lockout that allows 3 guesses of 1 second each before a 60-second penalty. Exhausting the space then takes about 243 days against 11.57 days with no lockout, a 21x slowdown. This audit rebuilds both times and asks whether that 21x depends on the PIN length at all, or only on the dead time bolted onto each burst of guesses.

Companion to the chapter Lab: BLE Attacks and Defense — every number here comes from that chapter.

Ada: Challenge 3 quotes a 21x lockout slowdown and a 243-day exhaustion time. Let me rebuild them from the stated policy – three attempts, 1 second each, then a 60-second lockout – and show why the 21x is what it is.

A 6-digit PIN has 10^6 = 1,000,000 combinations. Each lockout cycle spends 3 x 1 s + 60 s = 63 s to test 3 PINs:

• Worst case, exhaust all combinations: (1,000,000 / 3) x 63 = 21,000,000 s, and 21,000,000 / 86,400 = 243.06 days, about 243 days.
• Unlimited at 1 guess/second, worst case: 1,000,000 s, and 1,000,000 / 86,400 = 11.57 days.
• Slowdown: 21,000,000 / 1,000,000 = 21x.

The design meaning is that the 21x is not about the PIN at all: it equals the cycle-to-active-time ratio 63 s / 3 s = 21, and the million-combination space cancels out of the division. The lockout multiplier is set entirely by how much dead time you bolt onto each burst of guesses – a longer PIN raises both attack times together and leaves the 21x untouched, so rate limiting and key length are independent levers that must both be pulled.

Every number above is taken from the chapter’s own material and re-derived step by step.