Few days ago I’ve seen that one company is producing a strange kind of electronic door handles. Such devices could be unlocked by inputting a correct PIN code using a classical 10-digit keyboard. The solution is mainly suited for short-term apartment rentals in order to address the problem of key delivery - such rental company usually has from a few to several dozen of houses spread across the whole city or district. The company has the possibility to generate a PIN code for the customer and such code will only work from the day of arrival till the day of his departure. Moreover: the door handle doesn’t have any database of PIN codes and is not connected to the Internet/3G/WiFi/Bluetooth/anything.

How it can know that the particular PIN code is valid for today without performing an online check? A little bit of cryptography may be helpful here.

# Implementation in Python

First, let’s convert regular dates into a single integer. My proposition is to count days since epoch, but it can be arbitrary unique representation:

1
2
3
4

import datetime
def days_since_epoch(date):
return (date - datetime.date(1970, 1, 1)).days

Now, we need to design a function `f(secret_key, date_from, date_to) -> pin_code`

, where `secret_key`

is some random
string of bytes, which is different for each door handle. Let’s just hash these three arguments together using SHA-1:

1
2
3
4
5
6
7
8
9
10
11

import struct
import hashlib
def make_code(secret_key, date_from, date_to):
days_from = days_since_epoch(date_from)
days_to = days_since_epoch(date_to)
d_range = date_to - date_from
packed_dates = struct.pack(">II", days_from, days_to)
pin_raw = hashlib.sha1(packed_dates + secret_key).digest()

Now we have to do something in order to shorten the `pin_raw`

value, because nobody would like to enter such a long PIN
code. I would also like to encode it in such a way, to be able to deduce `d_range`

value from each PIN code. Let’s
rewrite our PIN code in the following form:

In order to fulfill the length constraint on PIN, we may define pin_raw_short as:

1
2

# 2^64 / 1639344 = 1.12525e+13, so we don't introduce a huge bias this way
pin_raw_short = struct.unpack('>Q', pin_raw[:8])[0] % 1639344

This way the maximal value of `pin`

can be \(1639343 \cdot 61 + 60 = 99999922 < 10^8 - 1\). For each PIN code
generate this way, it’s possible to extract `d_range`

parameter using equation:

1

d_range = pin mod 61

This information will be extremely useful in order to accelerate the PIN check process.

Now, how to check if a given PIN code is valid for current date?

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

def check_code(secret_key, pin):
range_len = pin % 61
date_from = datetime.datetime.now().date()
date_to = date_from + datetime.timedelta(days=range_len)
for _ in range(range_len+1):
iter_pin = make_code(secret_key, date_from, date_to)
if pin == iter_pin:
return True
date_from = date_from - datetime.timedelta(days=1)
date_to = date_to - datetime.timedelta(days=1)
return False

So basically we extract the date range from the PIN code and check for all possible combinations of dates.
For instance, given `range_len = 3`

and that the current date is `2017-12-10`

the algorithm will check following codes:

1
2
3
4

make_code(secret_key, datetime.date(2017, 12, 10), datetime.date(2017, 12, 13))
make_code(secret_key, datetime.date(2017, 12, 9), datetime.date(2017, 12, 12))
make_code(secret_key, datetime.date(2017, 12, 8), datetime.date(2017, 12, 11))
make_code(secret_key, datetime.date(2017, 12, 7), datetime.date(2017, 12, 10))

If any of them will match the PIN code entered by the user, we will let him in.

Be aware that if `current_date == date_from`

or `current_date == date_to`

, we have to introduce some additional time constraints. E.g. “on the day of arrival, guest may only enter after 2 pm”.

# Summary: Security-point-of-view

I’m pretty not sure if there aren’t any flaws. Knowing the structure of the code, we would have to find at least one
valid PIN, where there are at most 61 valid PINs at the same time (for `d_range = 60`

). The `pin_raw_short`

may have
up to 1639344 different values, so the probability of correct guess is
\(\mathbb{P}(A) = \frac{61}{1639344} \approx 3.721 \cdot 10^{-5}\).

Classical brute-force attack would be \(\mathbb{P}(B) = \frac{\frac{60 \cdot 61}{2}}{10^8} = \frac{1829}{100000000} = 1.829 \cdot 10^{-5}\), because there are \(10^8\) possible PINs and for a given date we have \(2 + 3 + ... + 61 = 1829\) valid PINs at the same time.

Knowing few codes we could also try to brute-force `secret_key`

, but it would be quite hard to crack 16 byte random
value.

# Summary: Hardware-point-of-view

Computing SHA-1 multiple times could be expensive on platforms like 8-bit AVR. For `d_range = 60`

we would need to compute SHA-1 61 times in order to determine whether somebody is permitted to access or not. I’ve tested in practice that using SHA-1 hash implementation provided by AVR-Crypto-Lib it is possible to achieve 186 Hash/second rate for single block hashes on Atmega328@16MHz. This is quite okay, since theoretically we are able to check any PIN code within half of a second (don’t forget that we also perform some other operations than plain hashing).

PS. Later on I’ve realized that it’s better to replace SHA-1 with some faster MAC algorithm like SipHash. It will work much faster on a microprocessor and the output is only 8 bytes, so it’s possible to perform modulo natively without prior truncation.