Why a Short PIN Is Safe Here

A short PIN is safe on Lomenett because an attacker only ever gets a handful of guesses on the one chip that can unlock the vault, and then that chip destroys the key forever. There are no copies to attack, no retries to farm, and no lockout to wait out. This page explains why that's true here and almost nowhere else.

Why short PINs are normally a bad idea

A 4-digit PIN has 10,000 combinations, and a laptop can try 10,000 of anything before you finish reading this sentence. So the usual advice is right, because a short PIN on a normal gadget can be attacked as fast as a computer allows. The thief doesn't even guess on the device. They copy the encrypted data off it and attack the copy in private.

We proved this to ourselves the hard way. Our early prototype protected the vault with a PIN and nothing else, so we attacked it the way a thief would, dumped the flash off a test unit, and recovered the live PIN in about 17 seconds. That prototype never shipped, and it's the reason every Lomenett has a dedicated secure element.

What the secure element does

Lomenett's secure element is an NXP SE050E, a separate tamper-resistant chip that is Common Criteria EAL6+ certified and belongs to the same class of part used in bank cards. It holds the real key and enforces the rules around it.

  • The key never comes out. The key that protects your vault is generated inside the SE050 and never leaves it. It isn't in the flash memory, so dumping the flash gets ciphertext and no key, and the 17-second attack that cracked our prototype returns nothing.
  • The chip decides whether to unlock. Your PIN goes to the secure element, entered on the device itself with the thumbwheel and never typed on a computer. The chip decides whether to release the key, and it counts wrong attempts in its own hardware rather than in flash or firmware, so the counter can't be reset by pulling the battery or reflashing the device.
  • Too many wrong PINs and the key is destroyed permanently. After a handful of failures the SE050 destroys the key and the vault becomes unreadable for everyone, forever. This is not a timeout and not a cooldown, because the key no longer exists.
  • The chip can't be cloned. The key is bound to that one physical chip, so copying the entire flash onto another board accomplishes nothing, because the other board's secure element doesn't have your key and can't be tricked into faking it. There is exactly one chip in the world that can open your vault.

Put those together and the math changes completely. The attacker doesn't get 10,000 tries per second on a copy, because they get a handful of tries, total, ever, on the one chip that matters. A 4-digit PIN holds up well against a handful of guesses, and every failed guess uses up one of the attacker's few chances rather than just their time.

So why not require a long password anyway?

Because you'd have to enter it on a thumbwheel every time you log in, and because it wouldn't add much. The hardware limit is doing the work a long password normally does, so a short PIN you actually remember, backed by a chip that stops responding after a few failures, works out better in practice than a long password you'd end up writing down. We built a device for humans, and humans can keep four digits in their heads.

The honest catch: the chip doesn't know you

The secure element can't tell a thief from an owner having a bad morning, so if you fumble your PIN too many times yourself, the key is destroyed just the same. That's the deal, and it has to be, because a lockout we could undo for you is a lockout a thief could undo too.

It's also not a disaster, because destruction of the device key never destroys your passwords. You restore from your encrypted backup file with your recovery phrase, the same as if you'd lost the stick. The device itself is replaceable, and the vault survives through the backup that you hold.

Where this fits in the bigger picture

The secure element is one piece of a simple design. With no radios, no cloud, and no app, the only way to attack a Lomenett is to hold it, and holding it puts the attacker in front of the chip described above. The full map of what that does and doesn't protect is in our attack surface, and the blunt answer to the obvious follow-up lives at can Lomenett be hacked?

Lomenett is a password typer, meaning an offline USB stick that stores up to 1,000 logins and types them for you, and it is launching soon. The PIN can be short because the hardware behind it is serious, and we'd rather explain that than ask you to trust it.