In many stories, a mysterious indent in a wall acts as a lock to a secret vault full of ancient treasures. The way to unlock this archaic door? A strangely shaped stone. By placing it into the indent, the vault opens.

Unfortunately, this idea ran into a problem when I was trying to adapt it for my world. It isn't that magic can't be used to activate the mechanism, as this ancient civilisation was one comprised of powerful mages. They could easily make a lock fulfilling all the criteria here... except that something the same shape as the indent would still open it. That' my problem - the issue arises in trying to make the lock secure.

Whenever I see an example of this idea, I always think to myself 'why didn't someone get curious and make something the same shape of the indent to 1) see what happened, if anything; or 2) fill in the gap and make the wall look better?'

So to put it simply: How, without using magic, could a lock of this type be made secure to counterfeit keys?

I say without magic for two reasons. Mostly, because it's more interesting. But partially because I can imagine a location as important as an ancient temple being protected from magic to counter vandals. The lock system itself uses magic to recognise when something of the right shape has been inserted. However, the key itself cannot have runes or anything magic to identify it.

What I'm looking for is a way to make this lock 'immune' by counterfeit keys without using magic. I've considered having the key made of a special material, but then I'm not sure how to make 1) the lock recognise the material without the use of the minor magic explained above; and 2) the lock needs to be 'immune', for want of a better word, to a different key of the same material.

EDIT: further information on request. The civilisation's magic does all the normal magic things (beams of light, fire, etc) and can react differently in certain situations (in light or dark, hot or cold, touched or not). Their technology level and culture in general is similar to that of the ancient Egyptians except for metalwork, which has developed to a renaissance level of precision due to extremely powerful catalysts being available to stoke the fires. They have no way to determine DNA / blood type, but could determine weight or size using the simple magic explained in the lock. The temple is made of a sandstone-type material, all marked with runes to stop decay or destruction. The modern era has no way to bypass these runes - to access the vault, they'll need to go through the lock.

A further explanation on the lock: the lock itself is protected from damage like the rest of the temple. However, it can contain runes to detect light, weight, size - any simple measurement. (Of course, any answers that they couldn't detect, such as radiation, are always interesting and just as appreciated!) The key cannot contain magical properties of any sort, but can be made of magnetic metals, crystals, stone, or any other such material. Furthermore, as the society has a far deeper understanding of metals than other materials, they can create more sophisticated metalwork than masonry or ceramics. Once the lock has been opened, a signal will be sent to the door, triggering runes that break down the stone. In addition, it will also disable the decay runes, allowing the temple to fall apart in years to come. The civilisation built the temple in the final years before they were invaded and massacred. Its aim was to preserve its contents until a successor obtained the key from somewhere and unlocked the vault.

The unlockers are at pretty much our tech level minus 20 years, except for computing.... If they had atom perfect recreation, they could copy the key no matter what we did! They're sure magic existed, but can't prove it scientifically or use it. In reality, they DO have all the time in the world to get into this vault... but really want to do it before our 20-year old researchers grow senile and die.

Oh, and security by obscurity is not security. It can go in addition to strong security and further its strength, but 8 million key holes with a regular key isn't really an answer.

I would have added this originally, but I wasn't sure how important materials and such were. Anyway, it's here now!

  • 2
    $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$ May 1, 2017 at 1:02
  • $\begingroup$ Probably not enough for an answer but - if they were good with metal and the stone could be magnetized, maybe it required something akin to a modern magnetic security badge? I think after all those years it'd be plausible that the reader would no longer be working, no longer be magnetized, and therefore just not work. $\endgroup$
    – Michael
    May 2, 2017 at 1:48
  • $\begingroup$ They claim to have developed an uncopyable key: urbanalps.com/en You may find some inspiration there. $\endgroup$
    – James
    May 2, 2017 at 8:39
  • $\begingroup$ Just two comments. 1) pay attention to using the weight: the key can lose some during the centuries or be damaged in a small way.. 2) the most trivial way to protect against brute force attacks is the lockout mechanism. If an attacker tries to input your password for N times it cannot input it again for X seconds. You can implement a similar protection: if the key is wrong the temple doors shut for a month: short enough to allow for a second try in a short time, but long enough to discourage brute force attacks $\endgroup$
    – frarugi87
    May 2, 2017 at 9:16
  • $\begingroup$ en.wikipedia.org/wiki/Physical_Unclonable_Function $\endgroup$
    – k-l
    May 2, 2017 at 17:54

32 Answers 32


An Enigma machine performs its encryption by passing electrical signals through its codewheels. The codewheel itself contains wires that conduct electricity from a given position on one side of the wheel to a different position on the other side.

The key (which need not actually be key-shaped) is a simplified variant of said codewheel. It is solid black except for small patches (circles, symbols, glyphs, etc.) of metal that connect inside the key itself, and the lock will only open when the proper connections have been made. Without the proper technology it is incredibly difficult to figure out which metal bits connect, or that the bits should even be connected. For additional security, have the key fabricated from unobtanium that resists both magical analysis and physical damage.

I realize that this is essentially "security by obscurity", but consider both that the method to penetrate the obscurity (i.e. replicate the key) may require technical knowledge that is beyond what the civilization is capable of, or is even working towards.

  • $\begingroup$ This is just a combination lock, but the lock is on the key. $\endgroup$
    – Schwern
    Apr 30, 2017 at 18:46

"8 million key holes" isn't necessarily security by obscurity. It's a second factor — "something you know". Basically, it's like a 7-digit numerical password. It may be more practical to have several different keys and need to have both right, but fewer actual locks. (For example, you could simply have 7 rows of ten, with each row needing the right key to be "unlocked". If we really want exactly 8 million, the top row could just be 8.)

Require a number of turns of the key in order to make an attempt — maybe make it take a minute. 4 million minutes is over seven and a half years, which is a long time to stand there (day and night) for a 50% chance of being right.

To prevent over-the-shoulder attacks, you could have the proper keyhole change based on the time and day — or, change in a repeatable but hard to guess way on every successful use. (TOTP/HOTP.) It's a little harder and less secure than the cryptographic random number generators used for real two factor, but should be pretty good in practice (and for that matter, figuring out the secret can be a plot device).

If 8 million doesn't seem high enough — because we all know that million-to-one chances happen nine times out of ten — you could use something which is clearly astronomically high. For example, if you have 12 stones (of different colors and shapes) and 12×12 grid on which they must be arranged in a certain way, that gives... 49,633,807,532,904,958,383,820,800 possibilities.

  • $\begingroup$ I agree that it can make a strong system stronger, but I wouldn't trust all my treasures in a system solely reliant on luck. On the other hand, if we had said uncopyable key, I would want 2-factor authentication or misleading design. And you've actually hit upon something that simply hadn't crossed my mind - actually implementing it in a story! $\endgroup$
    – Sirama
    Apr 30, 2017 at 15:30
  • $\begingroup$ When you get to numbers like 8 million, it's not really luck anymore. You have guessing-entropy of around 2²² — 22 bits. I know that in stories, million to one chances succeed nine times out of ten, but in the real world, the updated NIST guidelines specify a minimum of 20 bits when a rate-limiting factor is involved, as it is here. $\endgroup$
    – mattdm
    Apr 30, 2017 at 15:38
  • $\begingroup$ If you don't want to explain that to your u̶s̶e̶r̶s readers, you can use a number where it's clear the answer will be astronomically high. 21 stones which need to be placed in the right order will give you 51,090,942,171,709,440,000 possibilities, which is 64 bits of guessing-entropy — above the NIST standard for keys without a time limit. $\endgroup$
    – mattdm
    Apr 30, 2017 at 15:48
  • $\begingroup$ This just changes what the key is. The key is now N items in a proper order: a password. Passwords can be copied. $\endgroup$
    – Schwern
    Apr 30, 2017 at 20:28
  • $\begingroup$ @Schwern No, the key is having the N items. And, as noted in the answer, you can make the pattern change (with time or with successful use) in order to avoid copying (just as we do with HOTP/TOTP 2FA). $\endgroup$
    – mattdm
    Apr 30, 2017 at 23:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .