Clearly, there's alot of confusion out there as to what all these codes do, what they protect, how to get them and how to manage them. I'd like to clear that confusion up a litle bit with this article.
The first thing you have to bear in mind is that your SIM card is actually the property of your network operator. SIM stands for "Subscriber Information Module". Stored in it is information that identifies you as the user of the phone in which the SIM is installed, and which ties that phone to your mobile phone number. Proof of this is if you swap SIMs with another phone and call your number it's the other phone that will ring, and if you place a call with your phone it's the other phone's owner who will be billed!
The PIN, or "Personal Identification Number" is a 4-digit code (well, actually, some phones allow up to 8 digits but it is nearly always 4 digits), stored in encrypted form in the SIM and which protects your SIM from unauthorised use. That it is the SIM being protected can be seen if you put your SIM in another phone. You'll only be able to use that phone after you've entered your PIN.
You set the PIN yourself. When you get the SIM it contains the default PIN set up by your mobile network operator or a random code that will be printed on the paperwork. Many operators in the UK will even send you a SIM that is set not to request a PIN at all, which is a bit pointless because such a SIM that is "intercepted" and falls into the wrong hands can be used straight away by anyone to place calls, on your account. Note that a PIN is still stored in the SIM even if the latter is set not to request one, and you have to enter the correct PIN in order to have the SIM activate the PIN request upon startup.
If you enter an incorrect PIN three times in succession, the SIM will lock itself and you'll have to enter the PUK (PIN Unlock Key) in order to unlock it and use the phone. Your operator can give you the PUK for your SIM. Only your operator can do this because the SIM is what is locked, not your phone, and the SIM is the property of your network operator. There's no point asking your phone manufacturer for the PUK because they can't help you. Some operators give you the PUK straight away and print it on the paperwork. Some display the PUK in your account on their website. Some will only give it over the phone or by mail. Most will charge you for it if you phone up asking for it when you can get it yourself simply by logging into your account on their website.
If the SIM has been locked, the phone will ask you for the PUK before going any further. Once you've entered the PUK correctly you are prompted for a new PIN. If you enter the PUK incorrectly ten (I think, but don't quote me on that) times in succession, the SIM is permanently deactivated and you have to request another from your operator.
The PIN does not, however, protect your phone in the event that someone steals it and uses their own SIM in it. This is where the security code (or lock code, they both refer to the same thing) comes into play. To be honest, it's not so much the phone as the data inside it that is protected by the security code. While I'm not prepared to give out that information here, someone who knows where to look on the Internet can find out how to reset the security code on a phone. The only downside is that it will also wipe clean any data that the phone contained. A thief doesn't care about your data as much as you care about other people not seeing it so, in a sense, it functions as intended in that a phone protected by a security code will not allow anyone who doesn't know that security code to access its data.
The default security code on all Nokia phones is 12345. That piece of information is widely known so there's no harm in publishing it here. You are strongly advised to change it to something more personal as soon as you have the phone.
The security code is requested whenever you attempt to clear the phone's settings (*#7780#), call timers or data meters or if you try and reformat it with a "soft reset" (*#7370#). You can also set the phone to request the security code if the SIM is changed (the first thing a thief is going to do is throw away your SIM and put a new one in so this feature will render the phone unusable by anyone but you). You can also lock the phone directly from the menu or after a certain duration of inactivity. More recent phones have a remote lock facility which will lock the phone if you send it a predefined message in a text message. This method assumes that your SIM is still in the phone by the time you get round to sending the lock message, which is not a very safe assumption to be honest.
The security code cannot be bypassed without wiping the phone clean. If there was a way to bypass it, it would be on the Internet before you'd have time to say "oops" and would render the whole concept of this security feature totally useless. This means that you only have one option if you forget the security code of your phone: take it to a service point with proof of ownership and ask them to reset the phone. This will have the effect of resetting the security code back to its default 12345, but it will also wipe everything in the phone's memory. Proof of ownership of the phone will be required so that the service point knows that it definitely is your phone and not one that you "found" or that "belongs to a friend" (hint hint, nudge nudge, you know what I mean).
The restriction code, often called "unlock code", is used to neutralise the SIM-lock. The SIM-lock is a mechanism set up by your mobile network operator to ensure that you cannot use a SIM from a competing network in a phone supplied by yours. It's pretty pointless on contract phones if you ask me because you're still tied to your network for 12, 18 or 24 months and you have to pay your line rental regardless of whether or not you use their services or someone else's for your calls. Regardless of any justification, it's what operators do.
The key phrase here is "it's what operators do". Your operator enforced the SIM-lock and, consequently, your operator is the only organisation that can supply the restriction code to neutralise it. There's no point asking Nokia or anyone else for the restriction code, they can't supply it. As for market stalls and shops that offer to unlock your phone, it might work, it might not work, it might brick your phone. There's no telling in advance. My own choice would be to spend the £15 or so and get the restriction code from the operator and unlock the phone legitimately.
So, to recap:
PIN: protects your SIM from unauthorised use.
PUK: unlocks the SIM in the event that you enter an incorrect PIN too many times in succession. Supplied by your operator.
Security/lock code: protects the data in your phone from prying eyes. Cannot be bypassed but can be reset by a service centre, in which case all data will be lost.
Restriction/unlock code: cancels the SIM-lock and lets you use SIM cards from competing networks. Supplied by your network operator and nobody else.