Resources for the global digital safety training community.

  1. Home
  2. Trainers' Curriculum
  3. Crypto Fundamentals
  4. Entropy and Password Security
  5. Combo Lock Picking

Activity - Discussion : Combo Lock-Picking

ADIDS Element

Activity and Discussion

Parent Topic(s)

Entropy and Password Security

Duration

45-90 minutes

Materials

  • Enough 3 digit combination locks to share among small participant groups, pre-set with a selection of passwords useful for the exercise, see below.
  • Markers or small stickers to label each lock
  • Key matching the labels to a code sheet (spreadsheet or piece of paper)

Preparation

  • Label each lock and retain a “key” matching the labels to their combinations.
  • Set each lock to a different code to “reward” different strategies of guessing:
    • Obvious pattern seeking: An “xxx” pattern - perhaps 555 or higher to not make that too easy.
    • More subtle pattern exhaustion: a number in an “xyx” or “xyz” pattern, but again, don’t make it too easy (565, 757, 123, etc)
    • “Popular” numbers - throw in a 666, 747, 888, 420, or similar number with relevant “meaning” (e.g. consider 747 if most people had to fly for the training?)
    • Brute force completion: Nothing in the 0–, 1–, or 2– range, but (otherwise) a truly random 3-digit code that pattern seekers are unlikely to find

Running the Activity

Step 1:

Have an open discussion on ways one might approach guessing a combination lock. Ensure the strategies above get mentioned.

Step 2:

Divide the participants into roughly equal groups (ideally 5 or fewer) to match with the number of locks you have prepared.

Give a time limit, or optionally consider giving as “homework” or something to do over a long break.

In these groups, have participants decide on their strategy to guess the lock codes and, work through their plan.

Let any group that finishes early either go on break or try another lock if available.

Note that if a group chooses a pure brute force attack, the maximum time is approximately 30 minutes at 2 seconds per guess.

Step 3:

When time is up, move on to the Discussion.

Leading the Discussion

  • Ask each team to discuss their strategy/strategies, and if it was successful
  • Congratulate any teams which were able to open their locks
  • Reveal the codes of all the locks.
  • Ask teams to consider if a different strategy have worked on their lock, or if their approach would have solved a different combination quickly.
  • After hearing the combinations, would you adapt your methodology?