The Lockout Slowdown Is Independent of PIN Length

The Lockout Slowdown Is Independent of PIN Length

Ada re-derives this chapter’s own numbers step by step, at full precision

ADA · CALCULATION AUDIT

The Lockout Slowdown Is Independent of PIN Length

A lab challenge pits an attacker against a 6-digit PIN — 1,000,000 combinations — behind a lockout that allows 3 guesses of 1 second each before a 60-second penalty. Exhausting the space then takes about 243 days against 11.57 days with no lockout, a 21x slowdown. This audit rebuilds both times and asks whether that 21x depends on the PIN length at all, or only on the dead time bolted onto each burst of guesses.

Companion to the chapter Lab: BLE Attacks and Defense — every number here comes from that chapter.

Try

A lab challenge pits an attacker against a 6-digit PIN — 1,000,000 combinations — behind a lockout that allows 3 guesses of 1 second each before a 60-second penalty. Calculate this case.

Observe

This audit rebuilds both times and asks whether that 21x depends on the PIN length at all, or only on the dead time bolted onto each burst of guesses. Check shows this.

Explain

The design meaning is that the 21x is not about the PIN at all: it equals the cycle-to-active-time ratio 63 s / 3 s = 21, and the million-combination space cancels out of the division. The lockout multiplier is set entirely by how much dead time you bolt onto each burst of guesses -- a longer PIN raises both attack times together and leaves the 21x untouched, so rate limitingsets the slowdown independently of PIN length. Check confirms it.

See the relationship before changing it

The figure reads from left to right. The blue input is lockout after three guesses. The middle card names the page’s rule. The green output is slowdown. The arrow matters: change the input, apply the rule once, then read the result with its unit.

Walk the arrow. The lockout adds dead time to each three-guess cycle.

Derive the baseline in four named moves

1. 1

   Name the input. The chapter baseline is 60 s.

2. 2

   Name the relationship. slowdown = (3 s guessing + lockout) / 3 s guessing

3. 3

   Substitute with units. (3 + 60) / 3 = 21.0 times

4. 4

   Read the result. Keep the unit beside the value, then use the result only inside the technical boundary below.

Predict, then change lockout after three guesses

Try Predict how slowdown responds when lockout after three guesses moves. Calculate lockout after three guesses; compare slowdown with that prediction.

Lockout after three guesses

60 s

Chapter baseline

Slowdown

Observe Return to 60 s. Recheck slowdown with lockout after three guesses at its chapter value.

Explain The lockout adds dead time to each three-guess cycle.

Check yourself

What should you do before trusting a moved-slider result?

Answer: Predict its direction, apply the displayed relationship, keep the units, and compare the reset value with the chapter’s worked baseline.

What does this small model leave out?

Answer: Only lockout after three guesses moves here. The slowdown calculation excludes field effects listed below.

Honesty note. The slowdown result holds lockout after three guesses as the only changing input. It is not a field prediction.

Technical boundaries

Excluded from the “The Lockout Slowdown Is Independent of PIN Length” calculation are distributed sources, denial-of-service through lockout, offline guessing, user recovery, or implementation flaws in the pairing stack; “The Lockout Slowdown Is Independent of PIN Length” therefore reports only its named fixtures.

Ada: Challenge 3 quotes a 21x lockout slowdown and a 243-day exhaustion time. Let me rebuild them from the stated policy – three attempts, 1 second each, then a 60-second lockout – and show why the 21x is what it is.

A 6-digit PIN has 10^6 = 1,000,000 combinations. Each lockout cycle spends 3 x 1 s + 60 s = 63 s to test 3 PINs:

• Worst case, exhaust all combinations: (1,000,000 / 3) x 63 = 21,000,000 s, and 21,000,000 / 86,400 = 243.06 days, about 243 days.
• Unlimited at 1 guess/second, worst case: 1,000,000 s, and 1,000,000 / 86,400 = 11.57 days.
• Slowdown: 21,000,000 / 1,000,000 = 21x.

The design meaning is that the 21x is not about the PIN at all: it equals the cycle-to-active-time ratio 63 s / 3 s = 21, and the million-combination space cancels out of the division. The lockout multiplier is set entirely by how much dead time you bolt onto each burst of guesses – a longer PIN raises both attack times together and leaves the 21x untouched, so rate limiting and key length are independent levers that must both be pulled.

Every number above is taken from the chapter’s own material and re-derived step by step.