The Lockout Slowdown Is Independent of PIN Length
The Lockout Slowdown Is Independent of PIN Length
Ada re-derives this chapter’s own numbers step by step, at full precision
ADA · CALCULATION AUDIT
The Lockout Slowdown Is Independent of PIN Length
A lab challenge pits an attacker against a 6-digit PIN — 1,000,000 combinations — behind a lockout that allows 3 guesses of 1 second each before a 60-second penalty. Exhausting the space then takes about 243 days against 11.57 days with no lockout, a 21x slowdown. This audit rebuilds both times and asks whether that 21x depends on the PIN length at all, or only on the dead time bolted onto each burst of guesses.
Companion to the chapter Lab: BLE Attacks and Defense — every number here comes from that chapter.
A lab challenge pits an attacker against a 6-digit PIN — 1,000,000 combinations — behind a lockout that allows 3 guesses of 1 second each before a 60-second penalty. Calculate this case.
This audit rebuilds both times and asks whether that 21x depends on the PIN length at all, or only on the dead time bolted onto each burst of guesses. Check shows this.
The design meaning is that the 21x is not about the PIN at all: it equals the cycle-to-active-time ratio 63 s / 3 s = 21, and the million-combination space cancels out of the division. The lockout multiplier is set entirely by how much dead time you bolt onto each burst of guesses -- a longer PIN raises both attack times together and leaves the 21x untouched, so rate limitingsets the slowdown independently of PIN length. Check confirms it.
See the relationship before changing it
Change the input, apply the rule once, then read the result with its unit.
Derive the baseline in four named moves
- 1
Name the input. The chapter baseline is 60 s.
- 2
Name the relationship. slowdown = (3 s guessing + lockout) / 3 s guessing
- 3
Substitute with units. (3 + 60) / 3 = 21.0 times
- 4
Read the result. Keep the unit beside the value, then use the result only inside the technical boundary below.
Predict, then change lockout after three guesses
Try Predict how slowdown responds when lockout after three guesses moves. Calculate lockout after three guesses; compare slowdown with that prediction.
Observe Return to 60 s. Recheck slowdown with lockout after three guesses at its chapter value.
Explain The lockout adds dead time to each three-guess cycle.
Check yourself
What should you do before trusting a moved-slider result?
What does this small model leave out?
Technical boundaries
Every cycle contains three one-second guesses followed by the chosen lockout. The slowdown does not include attacks from multiple sources, lockout-based denial of service, offline guessing, user recovery, or flaws in the pairing software.
Ada: Challenge 3 quotes a 21x lockout slowdown and a 243-day exhaustion time. Let me rebuild them from the stated policy – three attempts, 1 second each, then a 60-second lockout – and show why the 21x is what it is.
A 6-digit PIN has 10^6 = 1,000,000 combinations. Each lockout cycle spends 3 x 1 s + 60 s = 63 s to test 3 PINs:
- Worst case, exhaust all combinations:
(1,000,000 / 3) x 63 = 21,000,000 s, and21,000,000 / 86,400 = 243.06 days, about243 days. - Unlimited at 1 guess/second, worst case:
1,000,000 s, and1,000,000 / 86,400 = 11.57 days. - Slowdown:
21,000,000 / 1,000,000 = 21x.
The design meaning is that the 21x is not about the PIN at all: it equals the cycle-to-active-time ratio 63 s / 3 s = 21, and the million-combination space cancels out of the division. The lockout multiplier is set entirely by how much dead time you bolt onto each burst of guesses – a longer PIN raises both attack times together and leaves the 21x untouched, so rate limiting and key length are independent levers that must both be pulled.
Every number above is taken from the chapter’s own material and re-derived step by step.