Matt Blaze1d ago

Physical security and cryptography can learn from each other, part 11367:

Hotels wisely don't put the room number on guest keycards so if someone finds your card, they'd have to exhaustively search the hotel to find the room it opens.

Some hotels now have elevators programmed to only let you call the floor for which your keycard is coded, preventing guests from wandering to other floors.

But it also means the elevator can be used as an efficient oracle to determine the floor of a found key.

Show threadMatt Blaze1d ago
In other words, restricting the elevator in this way is a bad tradeoff. It makes it harder for guests to visit their friends on other floors, but it reduces the complexity for an outsider burglar from O(|rooms|) to O(|floors|) + O(|rooms_per_floor|), a much more feasible search space.
Show threadMatt Blaze1d ago
(The point here is not about securing any specific hotel or keycard system. The point is that thinking about security in abstract terms can reveal properties and weaknesses that aren't otherwise obvious.)
Show threadNorman Wilson
@mattblaze Are you trying to piss off the locksmiths again?
6:33pmWeb