There’s an old Meilink Safe in my basement. It is a fire-resistant, high-security safe. It hasn’t been opened since sometime before 1992. I have no idea what is in it. It could have anything in it… I’ve tilted it from side to side, and heard something inside it that could be coins. I suspect there may be something of value in it, but I really don’t know. My curiousity is lit.
There are two ways to get in a safe, destructive and non-destructive. The destructive method would probably involve contacting a local locksmith or safe technician to come by and drill a hole in it, insert a scope, and manually align the combination, and pop the safe open. If I were to choose to do that, the safe might be repairable, but would no longer be very fire resistant. It would lose some of its value as a safe. I like the safe and I like the idea of having a safe in the basement. I would like to use the safe, as a safe. I think it would be a shame to open it using destructive methods. I’m not going to do it this way.
SO – the non-destructive way to open a safe like this involves manipulating the safe’s combination until it opens. I have three options: I could pay a local locksmith or safe technician to do it. I could contact Meilink provide proof of ownership, the serial number, and for a fee they would give me the original factory combination which may still work. The third way is – I could do it myself. I’ve decided to do it myself. I really like the idea of a challenge and I want to learn something new. It isn’t going to be easy, but in addition to having the safe, and having access, I will get to learn something.
I’ve watched the Mythbusters attempt to pick the combination lock on a Meilink safe. Within their artificial time limit, they could not open it non-destructively. They resorted to drilling the safe. In that video, they were working on a time-schedule. I have more time to crack my safe. I’ve read MANY books and papers on cracking safes – manipulating safes. I’ve read about lock construction – about how turning the dial turns the wheels, how the mechanisms are made, etc. My career, broadly speaking, is computers, and Matt Blaze’s “Safecracking for the computer scientist” could have been written for ME, personally. Leonard Gallion’s “How Mechanical Safes Work” was useful too. I’ve probably watched 50 videos on YouTube. (As an unrelated side note, for someone visual like me, YouTube is a FANTASTIC way to learn almost anything.) And I registered on a lockpicking website.
So – what have I learned? Beyond the secrecy of the locksmith profession – a sort of extra layer of security through obscurity, I have learned that persisting with the “learn how to crack a safe” approach, is going to be EXTREMELY challenging. Why is that?
Ultimately, safes are designed to be … safe. They are designed to keep people out. With a 100-number dial, there could be either 3 or 4 numbers. Theoretically – if there are 3 numbers, that means there are 1 million possible combinations. 4 numbers means there are something on the order of 100 million combinations. I say theoretically, because in reality, there will be less, because some numbers cannot be used, and there may be some play, slush, or inexactness requirements of the combination numbers. (In locksmith terms, a dialing tolerance.) Dialing tolerance is my GOOD FRIEND because a larger tolerance means there are fewer possible combinations. Assuming a “1″ number of dialing tolerence, and a combination of 25-50-25-50, it is entirely possible that 24-49-24-49, 25-50-25-50, 26-51-26-51, or any combination of (24-26)(49-51)(24-26)(49-51) would open the safe. It may not seem like much, but that sort of slush could reduce 1 million combinations to somewhere between 64,000 and 300,763. Some of the numbers on the wheel cannot be used – there are places that can ONLY be used for setting a new combination, and other places that can ONLY be used for opening the lock. If those places account for 20% of the wheel’s number, that lowers the total combination possibilities to something between 51,200 – 242,406. That’s better than 1 million, but still would be exhaustive to manually dial. It gets better than that because some lock makers don’t want safe owners to set “bad” combinations. They don’t want you to set your combination, for instance, to 2-4-6-8, or 50-49-48-47… To quote from Matt Blaze’s paper,
“A typical example is Sargent and Greenleaf[Cos01], which recommends for its three-number locks the combination as a whole not consist of a monotonically increasing or decreasing series, that adjacent numbers differ by at least ten graduations,and that 25% of the dial be avoided for the final number (although the mechanism itself on S&G locks requires avoiding only 6% of the dial). Acceptable combinations under these recommendations comprise less than 50% of the usable combination keyspace.”
This leaves only 22,330 combinations. That’s quite an improvement from 1 million, but I am not going to map out 22 thousand combinations and try them all. It is more valuable, I think, to understand the premise, than to do a brute-force type of attack.
I’ve learned that almost all Meilink safes of this vintage were made with either a Yale or a Sargent & Greenleaf lock. It would be great to know what TYPE of lock mechanism it has, – because knowing the model or type of lock would help me narrow whether it was a 3 or 4 number combination. Unfortunately, the combination lock mechanism doesn’t seem to be a Yale, and does not seem to be S&G either.
I’ve manipulated the lock many dozens of times, spinning it slowly, rapidly, listening, feeling, and noting clicks, sticks, clanks, and all sorts of actual and false points at which it seems there may be something happening. There are about 20 of those. I’ve recorded those numbers in spreadsheets, and developed a mathematical way to extrapolate all possible combinations from the group of numbers that seems to make noise or feeling differences in the turning of the dial.
Assuming I’ve felt and/or heard the right points – I have a list of numbers. My quest has begun.
What kind of quests do you plan this year? How are you approaching your personal quest? Are you taking a destructive or a non-destructive path? Are you paying for results, or working for results, or some combination? Do you have a safe in your basement? Do you have a potential treasure waiting to be unlocked and discovered? How are you gaining knowledge?
(Followup: it took me just over 2 months – checking through possible combinations, but I did get into the safe. It contained a few generic National Republican Medallions from President Reagan, one partial set of faux silver-plated silverware, and some worthless costume jewelry.)