I previously wrote about key lock boxes here. In that original post, I described how these lockboxes seem to work and how their limitations mean that there aren’t as many combinations as it may first seem.

At that time, I’d only considered setting four different numbers on the box. I now realise it is possible to set just one number or all ten. So, the number of combinations does increase as a potential lockbox hacker doesn’t know how many numbers to try. But what is the best number of numbers to enable on a lockbox? I actually thought that five numbers would be worse than four, but a comment on the previous post by Aneirin, with formula, now makes wonder whether five is the optimum. However, I think the formula provided by Aneirin doesn’t take into account that only one of each number can be chosen. The formula does account for numbers being entered in any order.

Aneirin provided this formula:
(n!)/((n-r)! * (r!)) = number of combinations
n is the number of buttons on the lockbox – which is normally 10
r is the n is the number of buttons you enable

For those of you who don’t already know, the ! means factorial. So for example 5! = 5x4x3x2x1 although * seems preferred than x, but both means multiplied by/times.

Because n = 10 that means 10! = 3,628,800.

Here’s a table of results of 3,628,800 divided by ((10-r)! * (r!)):

R= 10-r= (n-r)! r! result of ((10-r)! * (r!)) 3,628,800 divided by ((10-r)! * (r!))
1 9 362,880 1 362,880 10
2 8 40,320 2 80,640 45
3 7 5,040 6 30,240 120
4 6 720 24 17,280 210
5 5 120 120 14,400 252
6 4 24 720 17,280 210
7 3 6 5,040 30,240 120
8 2 2 40,320 80,640 45
9 1 1 362,880 362,880 10

The formula doesn’t seem to work when r=10 as my calculation came out as 3,628,800 and I know that can’t be true as if you set all ten buttons, you could just enter any combination of ten numbers and the box would open. Maybe Aneirin is still reading this and can explain why the math fails?

My calculation for a four number combination was 161 – the table above says 210, but as I said, I don’t think Aneirin has accounted for the fact that only one of each number can be chosen.

On the basis that a potential lockbox hacker doesn’t know how many numbers in the combination, that means the total number of combinations could now be 10+45+120+210+252+210+120+45+10 = 1012 – in reality I think most people set four numbers and I also still think the numbers are less than this.

I still think that these boxes are flawed in that;
only one of each number can be chosen, and
it doesn’t matter what order the numbers are entered.