Using RFID-only on door lock to house?

Question

I'm thinking of equipping the door to my house with an RFID-reader and a custom arduino-like board to do the authentication.

My question is what is the recommended security level for a normal house (in Europe) lock? I'm thinking that i might need a PIN or other additional measures so that if someone finds my wallet with my rfid-card, they won't be able to gain access to my house.

What PIN-length would be "good enough?"

EDIT: There is already an app that can control your door from an iPhone. Wonder what my insurance company would think of that?

Housebreaking and burglary 3357 reported cases in 2010 for aproximatly 2.2 million private households gives a rate of .0015 burglaries per household. — this.josh, Sep 01 '11 at 07:24
You may be interested in this question http://security.stackexchange.com/questions/6719 The delay between attempts and the lockout period may be more important than the PIN length if you have to enter the PIN manually (with your fingers). — this.josh, Sep 01 '11 at 07:28
@Espo, the trioving locks are pretty damn secure. Check page 6 at http://www.blackhat.com/presentations/bh-europe-08/Deviant_Ollam/Whitepaper/bh-eu-08-deviant_ollam-WP.pdf — Dog eat cat world, Sep 01 '11 at 18:06
for what it's worth, it's my understanding that the point of entry is usually a window, so I wouldn't expect this to help much. — Sirex, Sep 02 '11 at 10:02

score 18 · Accepted Answer · answered Sep 01 '11 at 08:52

18

For home locks, I think that the proper way to analyze it is to think about money, and more specifically insurance. You put the kind of lock that will please your insurance company; with a custom lock, chances are that your insurance company will ask for more money every month -- or refuse to give you money if you are burgled (even if the burglar came in through, say, a window).

About PIN: PIN codes usually have relatively low entropy (only 10000 combinations with 4 decimal digits) and rely on auto-locking (e.g. the system which expects the PIN locks itself out after three wrong PINs). For a home door, this is not very good: you do not want to be locked out of your home because someone came by and idly played with the available keyboard. So you would need a relatively large PIN code, e.g. 8 digits. Also, PIN codes are susceptible to side-channel leakage: if you type the same code every day, the involved keys are likely to experience premature wear, revealing which digits are used in the PIN code.

You probably want to be able to enter your home even in case of a power shortage -- and you do not want to have your door opening automatically in that situation (see the Die Hard movie for an illustration). For that reason alone, I would recommend against your idea.

answered Sep 01 '11 at 08:52

Thomas Pornin

320,799
57
780
949

4

I like this answer. I recently was in a conversation about bike locks, which although made of pretty hard steel, are often easy to crack with bump keys. I recommended the usage of $20-flea-market-bikes in areas where it is likely that bikes get stolen instead of buying a $100 lock that can't protect your $1000 bike... Of course this doesn't apply to houses where naturally most of your stuff is stored. So insurance clearly is the better option there. – Kevin D. Sep 01 '11 at 09:17
6

Your point about a power outage is a good one. However, in the case of a fire causing loss of power, having the door remaining locked would also be undesirable. – JS1 Sep 01 '11 at 12:01
1

For authentication failure lockout: I think many cipher locks have built-in temporary lockout policies, but these usually only last for a few seconds before resetting. For power failures: Many cipher lock systems also have battery backups that will last for some hours or more, and it's usually a matter of how they're installed which will determine whether they will "fail safe" or "fail secure". – Iszi Sep 01 '11 at 13:08
2

A door lock has a functional conflict between providing security (staying closed as much as possible) and providing safety (opening quickly in an emergency). – this.josh Sep 01 '11 at 23:12
1

In the case of fire you only care that it is unlocked from the inside. The failure mode should make it degrade back to a *normal* lock. – Bradley Kreider Sep 02 '11 at 03:29
2

Those RFID locks tend to have a fail-save button so you can always get *out*. Look for that. Also, the one we have works without external power supply, so thats also no problem. However, the premier concern remains the insurance, as Thomas pointed out. The lock will most likely be insecure anyway, the question is what the insurance thinks about it. Many current RFID systems simply broadcast static codes, and the challenge-response types have repeatedly been shown to use weak crypto. – pepe Sep 02 '11 at 08:53
Good point, didn't think of the insurance-bit. Will probably go with a "standard" lock on the house, and then maybe use an RFID-reader on the garage. – Espo Sep 03 '11 at 12:45
@Espo: Hopefully, your garage doesn't have a door connecting it to the rest of the house - otherwise the arrangement doesn't make sense, any more than a strong lock on the front door and a weak lock on the side door; an attack (unauthorized entry) will most likely happen at the weakest point. – Piskvor left the building Sep 08 '11 at 10:33

score 10 · Answer 2 · answered Sep 01 '11 at 17:18

Can't be much worse than my garage door opener, whose remote just has a button on it. Everything depends on the implementation, but just doing something a little different will ward off anyone but a determined attacker, and there's no defeating a determined attacker.

By the way, door locks can't possibly be the most important security concern. Just guessing here, but do you have (glass) windows? Are your hinges on the inside of the door? Do you have a reinforced door jamb that can't just be kicked or knocked in with that little battering ram thingy the cops use?

In the end, I agree with Thomas - do whatever your insurance company will give you the biggest discount for and worry about something else. :-)

Have a cordless drill? ["With all except the two locks classified as high-security, even an ordinary cordless drill could drill out the cylinders in 2 minutes or less."](http://www.consumerreports.org/cro/home-garden/home-improvement/door-locks/door-lock-buying-advice/door-lock-getting-started/door-lock-getting-started.htm) — this.josh, Sep 01 '11 at 23:09

Bradley Kreider · Answer 3 · 2011-09-07T20:03:57.600

RFID is a very broad term. There are active (powered) RFID tokens and passive RFID tokens. Most likely you are thinking of passive (backscatter) RFID. The next thing to think of is the range. Common commercial RFID dongle systems use the HF band and have very limited range.

I only have experience with UHF RFID readers (915 MHz North America). These readers can pump out 4W EIRP (36 dBm). They need to pump out a lot of power to get range, because the passive RFID chip uses that power to transmit a response (backscatter) back to the interrogator.

The implication is that a lurker could use a large directional antenna with very high gain and snoop the response. I'm 5 years out of date, but when EPC Gen 2 came out most of the UHF passive tags didn't stop this kind of lurking.

Now back on topic:

Who is really going to go to the trouble to cobble obscure RFID gear to sniff your RFID tag?
How much money would they have to spend to go to this trouble? (does it make the next house more inviting)
Losing your token: You should be able to remotely disable tokens to minimize this problem. This is better than the situation of someone stealing your key, because you can revoke your token a lot easier than your key.
Most electronic locks can be setup with a failure mode that makes them fall back to a normal physical lock. For example, having the electronic part release the strike plate would allow you to open the door with a key or by using an electronic method.
There are some Zwave manufacturers that make electronic deadbolts, like Schalge that allow you to bridge your Zwave devices to your home network (opening up things like using your smart phone to unlock your door from anywhere)

Using RFID-only on door lock to house?

3 Answers3