Hello everyone, and welcome to my DEF CON talk
all about locks and keying systems and how to hack them.
There's going to be a lot of math and problem solving
involved in what we're talking about today.
So for those of you who like that sort of thing,
I think you're going to really like this talk.
For those of you who don't like that as much,
I'll be releasing a number of software applications
that will do all the hard work for you.
This is all about decoding locks,
despite the very verbose title.
So taking all the information available
and creating a key for a lock
where we didn't otherwise have one.
It's a fairly long talk.
So if you're watching this on YouTube after,
I'll put a comment below with links to times in the video
so you can skip to the parts of the talk
that happened to interest you.
I will just mention that this feels incredibly weird.
The energy is so low compared to giving a main
or a talk on the main stage at DEF CON.
So I will do my absolute best to stay engaged
and keep you awake and to stay awake myself.
But the good news here is that this talk involves
a lot of software demos
and me going through the software I'll be releasing.
That would have been absolutely terrifying
to do on a main stage at DEF CON.
So what you get out of that is the speaker
who is going to be a lot less stressed out
and making a lot fewer mistakes.
So take a look at your key ring and see the keys on there
and see how much you understand about what they are
beyond just shapes of metal
and how they interact with the lock.
And that's what we're going to be talking about
all through today.
The way we're going to attack that
is looking at how locks and keys work
and the introduction of the tools I'm releasing
to analyze them.
We'll look at the economics and practicality
of brute forcing all possible keys
and reading the pins in a lock to get information from that.
We'll improve on impressioning
by applying the extra information that we have.
And we'll look at key-like systems
and lock disassembly to get information.
We'll then formally introduce information theory
and see how it applies to mechanical locks and keys.
We'll introduce master keying systems
and derive master keys from multiple low-level keys
and perform other rate-samplification attacks
to create a master key where we didn't have one before.
We'll look at a couple of special cases
like construction keying, IC cores,
and high-security secondary systems
like Medeco and Multilock.
And finally, we'll talk about what the blue team can do
to remediate from these attacks.
All of the software that I'm releasing
as a part of this talk can be found at these links here,
both a version that you can try right in your web browser
as well as the source down below.
So before we jump into the new content,
we'll give a very brief overview of how locks work
for those who might not be familiar.
So we have a key and it enters the lock
and interfaces with a number of pins.
We have key pins close to the key
and driver pins higher up.
And if they all line up with the top of this plug,
it will allow the plug to turn.
What do I mean by that?
Well, let's take a look at a 3D model
for what this is representing.
So here's a familiar lock
and this inner insert called the plug,
when all those pins line up, it allows it to turn.
So if we look at the cross section of it here,
when those pins line up as I showed
in the two-dimensional diagram,
that's what then allows that to happen.
And if any of those pins are not at the right height,
so we have a driver pin into the plug
or a key pin up into the housing,
then that will not allow it to turn
and the lock remains locked.
Within the plug, we have holes for the key pins to go into
and those holes don't go all the way down.
So that's what stops the pins
from falling right out of the lock.
And so in this cross section we see here,
this is where the key enters
and then this is where the pins are.
And that's what we're representing
in our two-dimensional facsimile that we have here.
So the key goes in,
it raises the pins to the right height, the lock opens.
If some of these pins are,
or these key cuts are too high or too low,
then it will not open because we have a driver pin
or a key pin in the way.
And we can see these shear lines are now binding,
the lock does not open.
It's worth noting that the positions in the key
are all discrete.
So we can have a set number of intervals
for depths that these positions can take on.
And that is defined by what type of lock it is,
as well as the position of the pins, of course,
is defined by what type of lock it is.
So you can play around with this software yourself
to understand what that top profile of a key
actually means in terms of what key code it creates.
So this is an example of what a plug cut in half
actually looks like.
So we can see where the pins go
and where the key goes in here.
A key itself is just mechanically encoded information.
So I showed how we can change the code to different heights.
Key codes are a number that represents that.
So this is a Schlage key.
We read it from shoulder to tip.
So in pin one, we have from zero down to nine.
We have eight cut and we can get seven, et cetera.
So here's a two, we have zero, one, two.
And from that, we can get the full bidding code
of eight, seven, five, two, seven.
And that makes sense.
When we look at the profile of this key,
deep, shallower, shallower, very shallow,
and back to deep again.
The thickness of the key from the base
to the points of this cut here
is given by this chart for the Schlage system.
So an eight cut is going to be 215 thousandths of an inch
from these two positions.
Here's another example we can see.
So five, two, eight, six, four.
We can see it makes about sense.
There's a five in the middle, a two is high up,
eight is low cut, and then it's increasing from there.
One thing we need to be aware of
is the maximum adjacent cut specification.
We can't have a very shallow cut beside a very deep cut.
Or in one case, it's going to be too steep
and we can't put the key in or get it out.
Or in another case,
we're going to start impinging on the neighboring cuts.
So if you look at how a key is actually originated.
So we can see in this lower left corner here,
this cutter wheel that's taking bites out of the key.
And so we're moving it along
to predefined positions along the key,
and then cutting down to predefined depths into the key.
In this case, we're cutting it
to the bidding code one, two, three, four, five.
So here we are on the fifth position,
cutting it down to a five depth.
We can see that the way that cutter wheel cuts
into the pins actually creates a sloped angle.
And so here's an example of one key
where we have a code zero, four, zero, three, seven.
So that's again from shoulder to tip.
If we wanted to bring pin two down
so that it matches not this shear line, but this upper one,
we can start cutting the four down and it works,
down to a five, down to a six is fine.
But now these shallow slope sides around it
are getting very close to the neighbors.
And in fact, when we put it down to a seven,
those neighbors are now lowered by that.
So that's a bit of a problem for us.
It means that we cannot have a zero cut next to a seven cut.
Zero next to six is okay, but not seven.
So that's our maximum adjacent cut specification is six.
Likewise, we can't have a one next to a seven
or next to an eight, but it can be next to a seven.
So the difference there is six.
That's okay because it's maximum.
And that's a property of almost all pin tumbler locks.
And that's gonna limit what our key space is as well.
Here's a chart of the most common max that we see.
So most of them are seven.
They have, in the case of Schlage, Sargent, Yale and Weiser,
they have 10 different depths that are allowable.
So at seven, that's fairly permissive.
Kwikset only has six.
So that means that our max is a little bit less at four.
Now that we understand max,
we can start to look at the key spaces.
So the total number of differs,
or number of possible keys that exist on a system.
And naively, it's the number of depths
to the power of the number of spaces.
So for a Schlage key,
there are 10 depths to the power of five or six spaces,
for five or six pins, is 100,000 or a million.
And for Medeco, it's six depths to the power of five or six,
so seven or 46,000.
So we can calculate that fairly easily here.
A Schlage system with five pins and 10 depths,
we have 100,000 possibilities.
And six pins is going to be a million.
And if it's a Medeco lock with six pins, six steps,
that's 46,000 and that's six to the power of six.
We can also add in our max here.
So let's say that this is a Kwikset key
with five pins and six depths.
We can now scroll down and add some rules to this system
to limit what our key space would be.
So we start with 7,000.
We find under max and add a max of four,
for it being a Kwikset system.
And that now limits it to 6,306.
And we can see that the number of possible differs
is less with cuts very shallow and very deep.
So this number here, 941, means that 941 total differs
have a zero cut in pin one.
That's smaller than the number
that can have a one cut in pin one.
Because a zero cut can go up to four, that's within max,
but it can't go all the way to a five.
That would be too much of a difference.
That would be a max violation.
This one here can go to anything
because it's close enough to everything
that it will not violate max.
To take this to the extreme, we can reduce max down to one.
And so we now see the impact that has.
We're down to only 340 possible keys.
And if by some decoding that we'll talk about going forward,
we know that say the shear line in pin one is a three,
we now see the pin two can only be a two, three, or four.
Anything else is too far from it.
It's a max violation and that extends outwards.
So that is severely limiting now
the number of possible keys that are in our key space.
And we'll look at how to drive these rules
throughout the rest of this talk.
In this case, we're down to 74 possible keys in our space.
And so it's enumerating all of those key codes here.
So these are the bidding codes.
We could cut a key to these and try them.
And it might work in this lock.
We can take a brief look at keys versus passwords
in terms of the brute force ability of them.
So the cost to try a password is very close to zero,
not quite negligible.
In the case of a key, it's quite expensive.
We have to pay for the blank and cutting the key
and our time to actually go and physically try it.
That's all quite expensive and time consuming.
Keys can be, or passwords can be
an unlimited length and complexity.
Keys are severely limited in both length and complexity
due to the mechanical nature of them.
In a password, if it gets compromised, it's easy to change.
And a key is very costly and time consuming.
So what this means is with mechanical keys,
things are harder for both the red team and the blue team.
It's harder to brute force
and try a whole bunch of combinations.
But if a vulnerability is discovered by the red team,
it's a lot harder for the blue team
to actually mitigate it and work against that.
To try brute force attack economically,
if we look at just the cost of the blank,
and we assume that if we own a code cutting machine,
the marginal cost of cutting a new key on it
is just your time.
So keys are not particularly expensive in that case,
between 13 cents and $3.
And if you don't, you would have to use a locksmith
who might do it for three to 10,
possibly more for high security keys.
So for instance, if we can reduce the key space
of a given lock down to 1,000 possible keys,
using the software that I showed you
and applying rules that we're going to learn about soon,
we might be able to try all of those 1,000 keys for $450.
If we own a code machine, if the blanks are 45 cents each,
if we have to go to a locksmith to get them cut,
then he might charge $4 each for $4,000.
And at that price,
we're better off just buying our own code machine.
What's important about this though,
is that if whatever's being protected within that room
is worth less than $4,000,
it now becomes an economical attack
to actually brute force all of these possible keys
in the key space.
One really good example of a lock where this is
not just possible, but imminently feasible,
is the Sargent and Greenleaf Environmental Padlock.
It's a very well-built, beefy padlock
meant for highly punishing outdoor environments.
And there's very few small parts inside as well.
It's a disc detainer lock,
so it looks a bit different than the keys
we've looked at so far,
but we can analyze it exactly the same.
It has three different discs
and the key can be cut to either 180 degrees,
as we see in the middle here, 135 or 90 degrees.
So three discs and three different positions
that each one can be cut to.
Let's put that into our key space software.
So get rid of those rules.
And this is a disc detainer,
one based with three discs and three possible depths each.
And we see 27 is our total key space.
That is everything that that Sargent
and Greenleaf Environmental can possibly take on.
And that's three to the third power.
That makes sense.
And we see them all enumerated here.
It's a little bit more complicated than that,
because if we insert this key
and we turn it and open that lock,
one design feature is that they want it to be key retaining.
We can't pull the key out if the lock is open.
If this were, say, cut 180, 180, 180,
that would be possible to do, and we don't want that.
So we actually want to remove all of these key combinations
that would not be key retaining
that we can pull that key out of the lock for.
So 1, 1, 1 is no good.
1, 1, 2 is no good because 2 is lower than 1.
So it has to go up at least once.
So 1, 2, 1 is good.
1, 3, 1 is good.
1, 3, 2 is, but 1, 3, 3 is not,
because it doesn't go back up at least once throughout it.
So we can add a rule for that under max and stuff.
We can add a rule for key retaining,
and that's going to reduce those,
that key space to remove differs
that are not going to be key retaining
in this particular case.
And so we can see now that there's more
with a deeper cut in disc one
and a shallower cut in disc three.
And that's because if it steps down from 1, 2 to 3,
that's not going to be key retaining.
So we could create all 17 of these possible keys,
and that might make sense
because it'll work on all Sergeant
and Greenleaf environmental locks.
If we have, say, a budget limitation,
and we don't want to pay for 17 blanks,
which would be, we've put 41 here,
it would actually be a bit more
because these blanks are worth more,
but this is just an order of magnitude calculation.
We can click down here and click brute force save blanks,
where it'll run a little algorithm
to try to optimize for you,
cutting one blank and then filing it down.
So 1, 2, 1 follows 1, 3, 1 to 1, 3, 2, et cetera.
And that way we can test out the entire key space
in as few blanks as possible.
This particular algorithm here,
to find the optimal solution,
turns out to be an NP complete problem.
It ends up being reducible to the set cover problem,
but we have a somewhat suboptimal greedy algorithm
that I've implemented here,
that empirically I found is good enough
for getting us a decent algorithm
of saving ourselves some blanks.
So in this case, it goes from $41
to get all 17 blanks down to just 12,
since we only need five blanks now.
So that's the Sargent Greenleaf Environmental Padlock.
It's a very good padlock for what it's designed for.
It's not really designed for security of the key space,
and that's okay.
It was used for a number of years
back before people knew this.
And so it sort of benefited from security by obscurity.
But for that reason,
this particular lock is not used
for high security applications anymore.
So let's shift gears a little bit
and look at locks where we can try the entire key space,
not by reducing possible differs,
but by trying multiple at once.
So this is the Kwikset Smart Key Lock.
It's smart key, so to speak,
because it has this hole you can insert a special tool
to rekey the lock without ever taking it apart.
Kind of a cool design.
Unfortunately, it's manufactured
with extremely loose tolerances.
And what that allows is us to actually try half heights.
So normally, if you have a one cut
in a particular pin position,
that will work if the pin is a one
or a two will work for two.
What this lets you do is cut it to one and a half,
and that will work for both a one and a two.
So by allowing us to do that,
we can reduce it down to 200 and some odd possibilities.
So let's simulate that in our Keyspace software here.
So Kwikset locks, so it has five pins and six depths.
And then six to the five is 7,700, as we looked at before,
when we have to try all of one through six.
When half heights work though,
it turns into three to the five,
because we can use 1.5, 3.5, and 5.5
to try everything from one to six.
And so we can see here that trying out
all of these half height keys
to exhaust the entire Keyspace
would cost about $500 to make all of them.
And there actually exists commercial sets you can buy
that costs on that order as well
to try all of these different options.
So that is something that's out there
for the Kwikset keys,
the Kwikset SmartKey in particular.
And that is something that usually
wouldn't be your go-to attack methodology
because the Kwikset SmartKey,
by virtue of those loose tolerances, is easy to pick.
But if you wanted to use it to, say,
determine the key for one lock,
and then you could get in very quickly in future,
or if you had multiple locks
that you know are all keyed alike,
once you figure out the key for one,
it's going to work for the rest.
That's something that you can do.
Let's examine for a few minutes
why this actually works
and why locks sometimes accept keys
that are cut incorrectly.
So in this particular case,
we have a set of probability distributions.
So this is the one cut, two, three, four to six
for a Kwikset lock.
And we can notice that this is where it's supposed to be,
where it's supposed to be cut at.
And if we're a little bit above that or below that,
the probability falls off relatively slowly
so that if we go exactly between two cuts,
it still has a very high chance
of actually working on either the lower or the upper.
This distribution here, a fairly normal looking one,
exists because the Kwikset smart key lock
is a type of wafer tumbler.
So wafers are symmetric in what they'll actually accept.
And it's also one with very bad tolerances.
If we pump that down a little bit,
we start to get it accepting less and less.
And so a lower probability of actually having a key
that's cut halfway in between work.
And we can also look at what happens
with a pin tumbler lock.
In particular, when we have pins involved,
it becomes a much faster fall off
when the key is cut too high.
And the reason for that is because if we look at
what a pin tumbler lock looks like on the inside,
if that pin is too high,
it's going to stick out above this core here.
And when it sticks out above that core,
it is now physically blocked by the housing.
It needs to stick up into this.
And we cannot turn that core at all
if it's more than one or two thousands of an inch too high.
So both the fall off on the probability distribution
is significantly faster,
as well as the amount too high it can be
before it starts falling off is also significantly lower.
Whoops, that was the wrong slider there.
And so we get a probability distribution
that looks something a lot more like this
for a pin tumbler lock.
So this would be a quick set probability distribution
for accepting a one cut key.
So if it's a little bit too high, it falls off quickly.
If it's a bit low, it works out okay.
And then two through six as well.
In the case of a Schlage, we have 10 cuts
and they're much more closely spaced together.
So now we have, even though it's a pin tumbler lock,
which generally has better tolerances,
now we have a much higher probability of it working
if we are somewhat between these two positions.
As that Schlage lock gets worn out,
that increases as well significantly.
So a very worn out pin tumbler lock will now accept,
even if it's a full height below,
it'll still let it work a lot easier.
The way that that actually happens
is if we look at a lock here and we cut one height too low,
we can see that as that key jiggles
and moves in and out of the lock a little bit,
it only has to bump this driver pin up a tiny bit
for it to actually get lodged in the housing
and allow this key to turn.
And so that's something that does not have
this hard mechanical constraint of housing.
It just has to bump up a bit.
And that's why if a key is cut too low
for a pin tumbler lock,
it's a lot more permissive for what it will actually allow.
So for a very worn Schlage lock,
these are very close together.
And so being close together means that
the probability distributions overlap by a lot,
as well as it's quite wide in a worn lock.
We get it to be somewhat permissive as well
for what it will accept.
So that's lock tolerances.
That's sort of an interesting aside there.
This particular mathematical model that we've derived
is from both theoretical and then empirical confirmation
that this is actually how locks behave
when the keys are slightly too high and too low.
And this is of course an n-dimensional distribution
where there are n pins.
So what I was showing here is a slight simplification
of that.
So 243 keys is possible to brute force,
but not practical in many situations.
So what can we do to actually reduce
that key space even further?
One thing we can possibly do
is get a photograph of that key.
So oftentimes you see security guards
and users leaving keys lying out on the desk
in the public view.
This is one of the most egregious cases
of these key watchers with transparent windows
behind a publicly accessible desk
with the facility's keys visible
and photographable through that.
And of course, people like to wear keys
on their belt as well,
and that can be photographed as well.
If you can get a good enough photograph,
you can superimpose these depth and spacing lines
and determine directly from the photo
what that key code is.
And this is something that I've got another talk coming
in the next year or so about,
all about how to do this
and how to work with poor quality photographs
and releasing software to do this as well.
But that's not this talk.
What happens though if that photograph is not great quality
and how can we use other information
to help deduce what it is?
So here's an example of a vehicle key
that's left on a desk photographed
at a distance of about 10 feet.
We can try zooming in, but that doesn't do much for us.
This is incredibly grainy.
There is not a whole lot that we can tell from it.
So what can we do?
So let's first recognize that this is a Ford vehicle key.
And by looking it up,
we can find that it is eight positions
by five possible depths.
And it is a wafer tumbler lock.
And of course, Half-Lights will visit
in a few minutes about this.
We will come back to that.
But we have naively now 390,000 possible key differs
for this particular key.
Based on the photo, we can't get a whole lot,
but we can get something from it.
So we can go on over to our photos tab here
and add a rule, basically looking at that picture
and saying, well, we know that one pin
is a little bit high cut, one is low,
and see if we can narrow it down a little bit from there.
So we have eight pins here.
We can see in the middle,
these two, this is number four and five,
are lining up with the top blank height.
So this four and five, we can be relatively confident
even from this poor quality picture is a one cut.
And then six, seven, eight is beyond that.
Six is fairly deep.
It looks to be a three or deeper,
but it's not the deepest
because we have one that's deeper here.
So this is a three or a four.
And then beyond that, it's fairly shallow.
It might be a one, it might be a two.
It's likely not a three or anything deeper than that.
So we can start adding those rules in.
So four and five are both one cuts.
Six is fairly deep, but not the deepest.
And then seven and eight are fairly high cut,
but we don't know exactly what.
Popping back to our picture
and looking at the first few pins,
we see one, two, and three
kind of make this bite pattern here.
So this pin two is fairly deep.
We don't know if it's the absolute deepest,
but it's say a three, four, or a five.
And then pin three, well, we know it's not the shallowest.
We know it's not the deepest.
That's about all we can tell.
And pin one, well, we know it's fairly shallow.
So we can add that here as well.
So pin two is quite deep, a three, four, or five.
Pin three, we know it's not the shallowest or the deepest.
And pin one is quite shallow.
And we can add that rule here.
And we now get this 390,000 possibilities
reduced to 216.
That's pretty good, but that's still a lot to try.
The other thing that we can look at doing
is recognizing that this system
is actually on what's called code books.
So this particular type of Ford key
is one of only a few different differs
that will be manufactured, not all 390,000 possible ones.
And that's just done to make keying the locks up
easier at the factory effectively.
So we can add a rule for that as well under code books.
This is a Ford fleet keying system.
And by adding that, we now see that there's only one key
that's actually in the code books
that follows these rules that we determined.
And that's the 0151X.
And so getting a better picture,
if we're able to come back and get one,
we would see that it is indeed an 0151X
that we were photographing.
And we can see now from this much better picture,
we can read off the code.
So we have a two cut here, it's slightly below the blank,
followed by a very deep, this is a four or a five,
followed by three, one, one, three, two, two.
And so we can see from looking at it here
that that is indeed what we found for this particular key.
So that is a combination of both
the photograph limitations that we found,
as well as knowing that it must be in the code books.
So if you remove this rule,
we can see that the code books
actually only have 1,700 possibilities.
And that gives us a lot of narrowing down
of what that particular key can be.
And in pin eight, it can never be a one depth
because it starts to taper off at the tip of the key there.
So a one will not physically fit on that key.
So that's sort of a cool example
of combining code books with photographs
to determine what a key's final code is.
We can also combine it with these half heights
that we talked about before.
So if half heights are available
for this particular type of key,
if cutting it halfway between a one and a two
will work for both a one and a two,
we can see the effect that would have,
and that would reduce it from 1,700 possibilities to 460
that would try out all possible locks
that would be manufactured based on these code books.
And for many vehicle locks,
because they're wafer tumblers,
they have relatively loose tolerances,
that is actually the case.
You have both code books and half heights will work.
And so you have many of what's called try out key sets
for vehicle locks,
which is a number of keys that will try out
most or all of the code book keys that are possible
that will let you then determine what key is used
in a particular vehicle or a particular fleet of vehicles.
Auto jigglers are sort of the next stage down from that.
And so they are not keys at all.
They allow you to move them up and down and angle them
and sort of do some fuzzing
to try even more combinations quickly.
And the high quality auto jigglers
were somewhat intelligently designed
to be effectively these try out key sets,
except adding that degree of freedom
for up, down, in, out, tilt, tilt,
so that we have rather than just,
or rather than 80 or 400,
we have only 10 of them that can work on
many, many automotive locks
and not manufacturer specific either.
And of course, further down that continuum is raking,
which works in a similar way.
So what happens if we don't have a key to photograph
or other information like that?
Well, then we can decode by looking at the lock itself.
So here's sort of a funny example
where the key pin is visible in its entirety
through the front of the lock.
And so from this, we can tell the length of the key pin
and therefore the depth of the first cut on that key.
We can look deeper in the lock using this device here,
which is called a lock scope.
So it's like the autoscopes that are used
to look into your ear at the doctor's office.
And they shine light through the back of this lock.
And we can see then every pin through it
with a little magnifier that's inside of it.
So this is cool.
We can't tell a whole lot from this.
Wouldn't it be nice if just by looking
at the bottom of the pins,
we could actually tell how long they were
in terms of their total length?
Well, enter colored painting kits.
I kid you not, and they are colored,
I kid you not, by length.
So by seeing the color of the pins
that we actually look at in this lock scope,
we can tell how long our key pins are
and therefore the key code.
So that last picture was a locksmith's rekeying version.
This is for an end user and we see colored pins as well.
It makes it a little bit easier to use,
but you can read the pins from that.
So here's an example of looking down a sergeant lock
with that lock scope.
And we can see there's gold, green, gold, green, gold.
It's a little hard to see at the end,
but that's a purple pin at the very end.
Looking at the sergeant chart,
we can see that a gold bottom pin
must be a one, four, seven, or zero,
which is what sergeant calls its 10 depth.
Green is three, six, nine,
and purple is two, five, eight.
So based on that, we can actually go ahead
and severely limit what the key could possibly be
for this particular system.
This is a sergeant system, it has six pins and 10 depths,
and we use one base numbering.
And we'll go ahead, and under photos,
we can add that particular rule.
And so we tell it that it is a sergeant system
and that we have gold, green, gold, green, gold, purple.
And that reduces our key space from a million
down to 1728.
It's worth noting, incidentally,
that half height is not gonna help us here,
even if this lock accepts it, which it doesn't,
because half height would not be able to try
both of two combinations three apart.
And so we get 1728 as well,
with just a slightly squished chart there.
So this is not bad, it's a lot better than a million,
but we need to do a bit better than that
to get a single working key.
One thing we can notice is that if this pin one is a zero,
then pin two cannot be a nine,
that would be a max violation.
So sergeant has a max of seven.
We can go ahead and add that on in there.
And so now we've reduced to 1166,
that's getting a little bit better.
What else can we do?
Well, remember looking at this lock,
we have this shear line visible.
And so that tells us that this is a zero cut
in this particular position.
So a very high cut depth on that key.
We can go further and use a lock pick
to lift up that first pin and look at the second
to see if we can see something similar.
And we don't, but...
So here's the lock pick in there.
But on the third pin, we do.
We can see a shear line at that same position
telling us that that third pin is also a one cut.
And we can continue backwards through the lock,
seeing that there are not any visible shear lines
beyond that.
So how does that apply to the lock that we have here?
Well, we can go to known shear lines
and we know that pin one has a one as a shear line,
pin three has a one.
We can add that rule.
And now that severely limits our key space down to 44.
Moreover, because we looked all the way back,
we know that pin five does not have a shear line at one.
So it's only possibilities are four, seven, and 10.
So we can put that into there.
And now we're down to 32 different keys.
This is something that's very brute forcible.
It's easy to make 32 and try it.
That'll cost us about $10 and take three minutes
to try 32 keys out.
Not bad, but we can do better than that.
And the way we can do better than that is impressioning
in particular with this extra information
that's available to us.
Before we talk about how to impression this particular lock
with extra information,
let's talk a little bit about how impressioning works
in general.
So we put the key in, we put a blank key in.
We cut all zero-bidded, the highest possible cuts.
And when we turn the key, there's a couple pins that bind
that don't let the lock turn.
If we turn it really, really hard,
then those pins are going to bind really, really hard.
And if we then wiggle the key in and out,
up and down a little bit,
those pins that are binding really hard
are gonna leave a mark on the key
that we can then look at.
So if we impression this,
one of these pins that's binding is gonna leave a mark.
Can we take the key out and look at that mark
and see it's in position two?
So cut two is not a zero cut,
because if it were, if that were a shear line,
then the pin would not have bound,
wouldn't have left that mark.
So we cut it down, put the key in and impression again.
And we take it out and we see now there's no more mark
on pin two, but there's one on pin four,
which tells us that pin four is binding.
It's not a zero.
We cut it down and we repeat the process.
And so pin four is still leaving an impression mark.
So we file it down one more time, impression it,
take it out, pin four is still leaving an impression mark,
file it down one more time, take it out, impression it.
And now we see that pin five is the only one binding.
So pin four has stopped leaving an impression mark
and pin five is now.
So we know it's not a zero cut, we file it down
and then we're going to repeat that process,
until when we try to impression and it's the right code,
the lock is just going to open.
So that's how impressioning works in general,
starting from a blank and ending with any particular lock
or with a key for that particular lock.
One piece of software that I'm releasing a modification
of this is a little game that you can try.
So you put it in and you could make the lock visible
or not as you see fit, impression it
and take the key back out again.
And then you can sort of practice your impressioning
that way until you eventually get the key for it.
So that's something you might enjoy.
But let's look at how that applies
to this particular system here.
If we wanted to impression this lock,
so let's start by creating a lock here.
We don't actually need to start with a blank
because if we look at our key space,
a one, one, one, et cetera, cannot possibly be the code.
The highest cut our code can be is one, three,
one, three, four, two.
And in our impressioning tab, it tells us that.
So that's what we actually wanna start
by cutting our key to.
One, three, one, three, four, two.
And we put it into the lock.
Now this lock, to give it a couple examples
for what our actual code is inside the lock
might be a one, six, one, three,
four, eight.
So that's what the key is we're ultimately searching for,
but of course we don't know that yet.
So we're gonna impression this key and take it out.
And we see that position two is binding.
So position two is not actually the correct cut.
And so what we'll do is scroll on up
and say that pin two is not at depth three.
It's not at depth three because it was cut to depth three
and it's leaving an impression mark.
So we'll add that rule.
That's telling us to try a six next.
And we know a six is going to work
because it's the only position left that pin two can be.
So our impression mark should show up somewhere else.
So we're gonna file our key down to a six depth,
put it in and impression it and take it out again.
And we now see that pin five is binding
and pin five is now leaving a mark.
So we can scroll on up and tell it that pin five,
which was cut to a two has, sorry, not pin five,
my apologies, pin six, the last pin.
So pin six that was cut to a two has no shear line there
because it leaves an impression mark.
And so we'll add that rule to the system,
no shear line there.
And it tells us the next tryout is one, six, one, three,
four, five, because five is the next value
that pin six can take on.
So we try that.
Pin six, we'll cut it down from a two to a five
and we'll put it in and impression it.
And when we take it out,
we'll see this impression mark left on pin six.
So we know that pin six is not a five depth either.
And so we'll tell it that, no shear line at depth five.
And so it tells us to try an eight now.
And we can see that this has to be what pin six is.
So if this doesn't work, we've done something wrong.
So we'll file it down to an eight
and we'll put our key in and we'll hit impression.
And this time the lock opens
because we found the correct code.
So as we can see, one, six, one, three, four, eight.
This was done in only three impressioning steps,
whereas it would have taken 19 to get down
to this particular code using impressioning
with no other information,
just going down one at a time at a time.
So very, very powerful tool that will let us decode locks
with the impressioning technique.
So let's look at another arrangement
that can be useful to us, which is key to like systems.
So password reuse is generally accepted to be a poor form.
Key reuse is common and called key to like
and seen in many cases.
So there's a whole big old list here.
Many of them, if you're interested in this,
I encourage you to check out
Howard Payne and Devia Toloff's amazing talk,
This Key is Your Key, This Key is My Key at Hope 11.
And it touches on a whole bunch of these and what they do.
Here's a couple that I've discovered
that wasn't mentioned in that talk
that I think are interesting.
So one is construction cores.
So if you ever see an interchangeable core
that's got a color on it, black, red, or green,
that's usually a construction core.
It's just used when the building's under construction
and it gets swapped out once it's done.
These are all key to like.
So if you find, say, a green best or a black Schlage,
you can look up what the code is and cut a key for that
without doing any more decoding.
Traffic controller boxes are like that as well.
This little upper box is for emergency services
to manually control the light.
And those keys are universal across North America.
And then this lower keyhole is for maintaining the system.
And there's only a couple of those different keys
that are used across North America.
Here's a great example of a bunch of key to like systems.
So we have an enter phone box here.
This is a Miracom box.
So opening it up to service the box,
this is a Miracom 549 key,
and that's universal for all of these Miracom boxes.
It's also got a postal key here
so that the post worker can open the box
or can open the door and get in and deliver your mail.
This box beside it is a little key box
that the power company uses to get in
because presumably this particular facility
will have a customer-owned transformer vault
somewhere with inside.
We also see these two building-owned keys.
We don't know what they're for,
but lots of ways to get through this door,
three of which are key to like systems.
Here's an example of a postal lock box.
This one is a Abloy postal lock.
So in Canada, our coastal service uses Abloy.
Very, very good choice.
It's somewhat negated by this door king lock here,
which is not only a poor tolerance wafer lock,
but it's also key to like.
And these door king keys, any of them will open it.
If it's not something that we already know
what the key is for the key to like system,
we can determine what that key is by disassembling the lock.
And then once we get the key for one lock,
it's gonna work for all of them if they're key to like.
So to do that, we need to get the lock out somehow.
So once the door is open,
you can unscrew the retaining screw
and then unscrew the lock,
at which point we can take off the tail piece
and get these pins to shear line somehow,
either shimming through the back or picking.
And then we can look at what the pins are
on the inside of it.
So in this particular case, we have a lock.
We can see how long these pins are.
And that particular pattern that the pins make,
if we invert it, so it's upside down,
that's gonna give us what the key looks like.
And so we can see we put the key in
and it doesn't need work.
And we can figure out what exactly
that key is going to look like from the lock.
If you don't wanna have to shim through the back,
you can also take off this brass plate,
which is an awful task to do, but it does work.
And if you wanna have a bit more time
to do this decoding and disassembly,
one thing you can do as well is replace it,
temporarily at least, with a lock that looks like this.
And that's going to work no matter what key enters the lock.
So anyone that tries to get in is not going to be blocked
and no one's gonna be the wiser
while you have the lock out for disassembly.
Metakos are very nice to us.
They have these nice set screws at the top.
And so we can pull that out and dump the pin stack.
And so we can see in this pin stack here,
we have a key pin.
We can read both the angle and the depth of it from that.
This one happens to have some master wafers,
so it's not key to like,
and we'll talk about how to handle that later,
but we can see a 25 thousandths of an inch one wafer
and a 50 thousand two wafer.
In this case, we only needed to remove
these first two pin stacks
because we got some information about the lock already
and the first two pin stacks were the only things
that we needed more information about.
And of course, because of these set screws,
we don't have to worry about this awful brass piece
or shimming it, et cetera.
If you're interested in this sort of thing,
I strongly recommend you check out Molok's amazing talk,
Please Do Not Duplicate Attacking the Knox Blocks
from DEF CON 26.
It's all about doing attacks like this,
taking locks apart and looking at the Knox block systems,
which is key to like across many jurisdictions
in North America.
So that's key to like systems.
What we can do with that is start to analyze everything
that we've looked at so far
and figure out how to formalize it
and how to determine what the best next step is.
And we can do that by looking at information theory.
So you've likely heard of the concept
of the entropy of a password before.
We'll talk a bit about what exactly that means.
So information is stuff we know
and entropy is stuff we don't know.
So in the case of a stoplight, it's either red or green
and that is information.
That's in the case of red or green, one bit of information
because it's a zero or a one, that's ignoring yellow.
When it's a random variable,
that's something we don't know and so that's entropy.
And so a key or a password has entropy
because we do not know it
and we're trying to determine it
to get into that particular lock.
So how do we measure the entropy?
So it's in bits.
So a coin flip is a zero or a one,
so it has one bit of entropy.
A random number from zero to 255 is eight bits,
since eight bits can encode number zero to 255.
A random number one to 10 has 3.32 bits.
Well, how do we have a fractional number of bits?
Well, we can think of it like the following.
We have three random numbers, one to 10,
that is a three digit number.
And so that can be encoded with one to a thousand
or zero to 999.
And that fits very well into 10 bits,
which can encode zero to 1023.
So two to the 10 minus one.
So 10 bits will easily encode zero to 999
with not a whole lot left over.
And so 10 bits divided by three,
because we're storing three random numbers inside of it,
is 3.33, which is very close to that 3.32 figure.
If we extend the number that we're storing,
so instead of three random numbers,
we try to store six or nine or a thousand
as that tends to infinity,
this number tends to 3.32.
This is mathematically represented with a log.
So the entropy of a piece of information
can be thought of as the number of bits
it takes to write it down,
or write down a number from zero to the total value
that that information can possibly be.
And so that would be the log base two of that number.
So the number of bits of entropy,
which is represented by the Greek letter eta,
or eta in modern Greek,
for a random variable with n outcomes
is just log base two of n.
So a fair coin flip has two possible outcomes.
Log base two of two is,
that should not say two bits, that is a typo, one bit.
A random number from zero to 255
is log base two of 256,
because zero is not counted here,
so, or is counted here.
So that's 256 possible options, which is eight bits.
And a random number of one to 10
is log base two of 10, which is 3.322,
what we looked at before.
So a couple of examples of entropy within keys.
That is the number of bits in the piece of information,
so the key to the password,
once we do have that information.
So an eight character ASCII password,
so that's eight bytes times eight bits per byte
is 256 bits of entropy.
This, many of you will be screaming at your monitor,
is wrong, because some characters
are more likely than others.
Some characters are not used at all in most passwords.
And of course, dictionary attacks exist,
so certain passwords are more common than others.
And so that does reduce the entropy.
We'll look at why in a little bit.
For a 10 digit passcode, three characters long,
assuming all combinations are equally likely,
we have 9.97 bits, which makes sense.
A thousand combinations is a little bit shy of 1024,
which would be exactly 10 bits.
An EVA MCS, so that's the magnetic coding system key.
It has four rotors and eight positions each for each rotor.
So that's eight to the power of four,
4,096, or 12 bits exactly of entropy.
And a Schlage five pin system has five to the power
of 10 or 100,000 combinations,
log two of 100,000 is 16.6 bits.
So that's a couple of examples
of how much entropy is in a system.
In the software that we have here,
it gives you that at the start
and at the end of the rules that you've applied.
So in this particular case, if we look at a Schlage system,
whoopsies, five pins with 10 possible depths,
so 100,000, and then we have 16.6 right there.
And you can play around with that to see what happens
as you change the number of depths and pins.
So if there are N possibilities
and all possibilities are equally likely,
then the entropy is given by log two of N.
But if some possibilities are more likely than others,
entropy goes down.
So in a dictionary based attack on passwords,
because they follow these dictionaries,
it is easier to guess that there's less entropy
in those passwords.
And so in the example of keys,
we see many key systems avoiding very deep cuts
because that makes the key more prone to breaking.
And there's other ways that you can do keys
to make it harder to pick.
And so that does slightly reduce
the amount of entropy present in your key.
The fact that certain differs are less probable than others.
So to look at a very simple example here,
we have a master key that we've decoded
as either a 14767 or a 94767.
So looking at these two options naively,
we have, or we could say there might be a 50-50 chance
of each of these two options.
And so since there's two, it's a zero or a one,
this is one bit of entropy.
We can expand this calculation a little bit
by looking at the individual probabilities.
So there's a probability of 0.5 of it being 14767
and 0.5 of nine.
So we have minus 0.5 log two of 0.5.
So that's the probability of the first one.
Then the exact same thing,
because the probability of the second is the same.
And we do a little bit of arithmetic using our log rules.
And we find that that simplifies
to log base two of two or one bit.
The question is though, are these equiprobable?
And so if this were a non-master key, then it might be,
but knowing that this is a master key,
there's a couple of cues we can take.
So here's our 14767.
This is very typical of what master keys
very frequently look like.
When we take this down to a nine,
there's a number of problems with it.
One is it has a very deep cut in pin one.
This is prone to breaking off in the lock.
And I generally want to avoid keys breaking off in locks,
but especially master keys,
because if that gets stuck in there
and a bad actor is able to get it out,
that's a problem for you.
The other thing that happens here
is this is now a very low cut key.
And for reasons we'll talk about shortly,
having a low cut master key is something you want to avoid.
So it's highly unlikely that this 94767
would be the code that the locksmith chose
to be the master key.
So we can assess perhaps a 95% chance
that it's this one cut and a 5% chance
that it's this nine cut.
And crunching those numbers, we have 0.95.
So our probability times log two of 0.95
plus 0.05 times log two of 0.05.
And we find our entropy is now 0.2 bits, 0.3 rounding.
So that is significantly lower
owing to this high difference in probabilities
between these two options.
In the extreme case,
so we can sort of intuitively understand this,
if one option is certain
and the other option is impossible,
well, that's zero bits of entropy
because there's nothing unknown in this case.
So in general, the entropy where the probabilities
are not equal is going to be the sum of each probability
times the log two of each probability,
and then minus that,
because log of a number less than one
is going to be a negative.
And so this definition is a fairly beautiful derivation
of it that I won't go into now for obvious reasons,
but I encourage you to look it up.
So we can now extend this concept
and do a little bit more useful with it
by looking at joint and conditional entropy
and mutual information for different rules
in terms of which ones are giving us
more and less information.
So let's just get rid of this block to start.
So what we'll do here is consider a very simple system
with only three pins and only two possible depths for each.
And so we can see that this has three bits of entropy in it,
and that makes sense.
We have a zero or a one, zero, one, zero, one,
three times over, so that's three bits.
And we've enumerated all of the eight possible options here.
And of course, log base two of eight is three,
so that also makes a lot of sense.
So let's say that we have,
let's say a photograph of the key or something,
but that photograph only shows us pin one.
And that tells us that pin one is a zero.
So that now tells us, well, pin one is a zero.
We don't know anything about pin two or pin three.
That gives us one bit of information.
It makes sense.
And we're now down to two bits of conditional entropy.
That's conditional on this rule being the case here.
And then we get another photo and it's a bit better.
It shows us that pin one is a zero and pin two is a zero.
And so now we've limited pin one and pin two to zero, zero.
And so we have one bit of entropy left
because this rule has given us two.
And if we have a third photograph,
say that shows that pin three is limited to zero,
but we can't see pin one or pin two.
Now we have the final key
because we know that they're all zero, zero, zero.
So this is fairly simplistic and fairly obvious, I assume,
but we can analyze it in terms of the information content
provided in each of these three rules.
So looking at it intuitively,
rule one gave us one bit of information,
rule two gives us two, and rule three gives us one,
as well as rule two shares one bit with rule one.
In terms of the conditional entropy given by rule one
relative to rule two.
So given everything that rule two gives us,
rule one gives us nothing extra.
Given everything that rule one gives us,
rule two gives us one bit extra,
and they share one bit, common to both of them,
and rule three, of course, shares nothing with the other two.
So we can analyze this automatically with the software here
by clicking calculate conditional entropies down below.
And let's compare rules one and two, just to start.
And we see exactly what I mentioned there.
So rule one, within this circle, we see it gives us one bit,
and rule two, within its circle, gives us two bits.
One bit is shared with rule one, and one bit is on its own.
And so that one on its own is, of course, position two,
where this is the only one
that tells us anything about pin two.
And then the total information given by both
is the sum of what's in here.
So that's the joint entropy reduction, which is two bits.
Comparing rule one and rule three,
we see that they both give us one bit,
and there's nothing shared between them, which makes sense.
We have pin one, pin three, nothing shared.
And we can compare all of them.
And so we see now that within these,
we have a total of three bits given.
And for the system that started out as three bits,
that will reduce us to a final key.
And those three bits,
one of which is shared between rules one and two,
one of which is just given by rule two,
one of which is just given by rule three.
And then there's nothing, say, that's shared
by all three of them,
or that's just given by rule one, et cetera.
So this is a fairly useful way of analyzing
the rules that we've determined that limit the system
and determining which one is most useful to us.
And are we sharing a lot of information?
If we are, that indicates
that we're not being particularly efficient
with what work we're doing
to find out this information put into this system.
Ideally, the less shared information,
the more total information we're actually going to get
out of all of the rules in this particular system.
So that is conditional entropy.
Mutual information, by the way,
is the term that we use to talk about the information
that is, well, mutual between
two different random variables,
or in this case, two different rules
that impose a constraint on the system.
So in the case that we looked at before
with this 0151X key,
we have the conditional entropy given by the code book
is a lot, almost nine bits,
which makes sense.
We're going from 390,000 to 1,700 possibilities.
And given by the photo is a fair bit as well,
because we were able to determine some severe limitations
on many of the pins that exist.
And there's not a lot of shared information.
The result of that is between these two rules,
they give us all of the entropy that existed
in that particular key.
There's a good reason
that they don't share a lot of information.
And that's because, well,
what is the uncertainty that exists in a photo?
Well, the uncertainty is, you know,
is this a two or a three?
You know, is one position off?
In the case of a code book,
what they do with code books is very different.
They're not going to make a code
that's off by just one cut and one pin
from another item in the code book.
They're all going to be wildly different
if you're reducing 390,000 possible differs
into 1,700 in the code book.
So because they're wildly different,
the information given to us by the code book
is very, very different than the information
given by the photo.
There's not a lot of overlap.
And as a result there,
these two rules put together
are very useful to give us a lot of information
about this system.
So we've talked about loads of techniques
to determine the key for a lock
when we don't have a key at all.
How about if we have a key for some lock
on some master system,
and we want to turn it into a grand master key
that's going to work for all of those locks?
To understand how to do that,
let's look a little bit at how mastering works in general.
Any lock on a master system
is going to accept multiple keys.
And it does that by having more than one shear lines
in at least some of the pins.
So in this case, we have two shear lines in every pin stack.
One of these shear lines in each pin stack
is for the change key,
and one is going to be for the master key.
So there's two different shear lines,
and a different one is always gonna be used,
one for change and one for master.
Master key actually is necessary
in the context of multiple locks.
So in here we have Alice's lock
and her key A1,
and it's going to work in her lock.
And we're also going to have a sub master, MKA,
that will work in her lock and a grand master.
But Bob can't put his key in her lock.
It's not going to work.
It binds in pin three,
and Charlie's is completely off.
It's also not going to work.
So that's what works in Alice's lock.
In Bob's lock, Alice's key is not going to work
because it's not the right key.
It's just a change key.
But Bob's key, of course, will.
Charlie's key won't.
And the master MKA will,
because Bob is on the A system.
He's A2.
And the grand master is going to work as well.
In Charlie's lock, he's on the B system.
So MKA is not going to work.
Alice's key, of course,
and Bob's key are both also not going to work.
Charlie's key will, of course.
And the grand master will as well.
So what we have is a two-level hierarchy system
where we have a master key MKA
that works for Alice's and Bob's lock,
which are on the A system,
but not for Charlie's, which is on the B system,
and a grand master key that works for all of them.
The way that this happens is the grand master key
uses the grand master shear lines
in all positions on all locks.
The MKA uses the grand master shear lines
in just these last three positions,
but not the first two.
So that way you can tell,
is this on the A system?
And all A system locks start with 3-1.
So Alice's key does as does Bob's key.
It starts with 3-1,
and therefore MKA, which also starts with 3-1,
is going to work on Bob's lock.
If we try MKA in Charlie's lock,
it's going to work on the last three pins
because MKA is at the master level on these three pins.
Notice that it shares the last three pins
with the grand master key,
but it is not going to work in Charlie's lock
because MKA is not the master depth
in these first two pins.
We need the grand master key for that.
So we have a multi-level mastering system
that allows certain master keys to open only some locks,
the individual keys only open their own,
and a top-level master key that opens everything.
So that is an example of a three-level system.
This is two-level with just a master
and change keys below it.
This is what we just looked at.
So a grand master key under which we have MKA,
and there would be hypothetically an MKB as well,
and then change keys under that.
So here's Alice and Bob, and Charlie is somewhere over here.
We can have higher levels,
and this requires splitting up the pins more
in the way that we showed you,
or using secondary locking elements.
So looking at our sergeant lock again,
it had this visible shear line here,
and above it is this red pin.
A red driver pin is only used for key pin 456.
We see that this is a zero,
so we know that it's actually a master pin.
So we can start to determine what the other shear line is
in this particular sergeant lock.
And once we know what both shear lines are,
we can then start to determine
which one is going to be the master
and deducing the master key from that.
When we lift up the first two pins
and see that the master wafer on pin three is gold,
we can do the same thing
and determine that the second shear line
is going to match one of three, four, or eight,
plus the one that we know is in there already.
If we have a lock on a master system
and a key for that lock,
we can use that key to actually disassemble the lock.
And it's a whole lot easier
because we can use the key to open the door
and to then unscrew the lock from an open door.
We can also put the key in
and use it to remove the core from the lock.
And then we can look at the pins
and see what they actually say.
So to look at a demo,
in this case, we have our mastered system
and our change key here.
And the mastered pin depths that we find
are two, eight, two, four, et cetera.
And we get this for reading these pins here.
If we put that into our analysis software,
two, eight, two, four, three, five, et cetera,
we find that now the master key
can take on one of each of these two positions in the lock.
And so there's five bits of entropy, which makes sense.
There's two positions in five pins.
And that gives us 32 possible keys
that could work as the master key for this locking system.
We can, of course, create all 32 and try them.
We can create only some, 10,
and then file them down until we've tried all 32 of these.
But we can do better than that
because we have the change key code
and we know that it's a change key, two, four, five, three, one.
And so we know that whichever shear lines
that change key interacts with when it's using the lock
is not going to be the master shear lines.
Therefore, the other shear lines will be the master.
So if we take eight, two, three,
sorry, if we take a change key, two, four, five, three, one,
and we put that into our analysis software,
so known change key, two, four, five, three, one,
it's going to remove two, four, five, three, and one
from the possible depths that this master key could be.
And it's going to leave us
with the other remaining one in each pin stack,
which will be a single master key left, eight, two, three,
nine, nine.
And in fact, that is what we find as the master key
in this particular system.
So that's pretty neat.
Given just a key for a mastered lock
and access to the lock itself,
we can actually derive the master key entirely from that.
The other thing we can do
if we don't want to disassemble locks
is we can combine information
from a number of these low-level change keys
and use that to determine
what the master key could possibly be in a system.
So let's say we have a Schlage system,
so five pins and 10 depths each,
and Schlage is zero base numbering.
The master key in this system
could be any one of a hundred thousand possibilities.
If we know what one change key is,
let's say it's two, six, three, five, zero.
And we go ahead and add that as a rule.
We now have, instead of 10 to the five,
we have nine to the five.
So a little better, but not great.
What we do see though is that in a Schlage system,
remember I talked about how if we have a pin
that's one too low or a little bit too high,
the lock might still accept it for a very worn out lock.
And that would be a bad thing
for a lock to accidentally accept
a key that's not a master key as if it were.
So what Schlage does to avoid that
is uses what's called the two-step system.
Every position that any key in this system will take
in pin one is going to be even, pin two will be even,
pin three will be odd, et cetera.
So we're always skipping every other depth
to make sure that we don't have anything that's too close
and is going to create problems
with keys operating locks they're not supposed to.
So what that means when we turn on the two-step system here
is it severely limits our key space.
Now pin one must be even, so zero, two, four, six, eight,
but it can't be a two because that's what our change key is.
And we do that for the rest of the pins
and we get 1024 possibilities, so four to the power of five.
We can get another change key.
And so this is going to be two-step as well, of course.
So that's, let's say, six, four, one, three, two.
If we have another person conspiring to get in on this plan
to derive the master key.
And now we have only three possibilities each.
And if two more people sign on, so four, two, seven, nine,
six, and we've eliminated even more of the possibilities.
And finally, eight, six, three, one, eight.
And we've now got it down to only four possible master keys.
So we could absolutely just make these four
and try them out and hope that one is going to work.
Well, we know one's going to work,
but we can do better than that.
We know that pin one is a zero cut.
Pin two is a zero or an eight,
but an eight is a max violation.
It's too far from pin one, which is zero.
So we know it's zero as well.
And now if you look at pin three,
it could be a five or a nine,
but a nine now is too far from a zero,
which we know pin two is.
So in fact, the master key is going to be 00574.
And if we add this max rule of seven,
we find that that's the case.
So by combining these multiple change keys,
we've been able to derive the master key
without taking a lock apart,
just by using the information on those change keys.
From an information theory perspective,
we can calculate these conditional entropies
from the rules that we've been looking at.
And we see that we have a lot of shared information
between them.
That's because each of these rules tells us
that it's on a two-step system,
which knocks out one out of every two position
in every single pin.
So that's a lot of information that gives us,
four and a half bits,
as well as we're knocking out an additional depth
from each pin from each of these keys that we have.
And so that's these two bits here.
So between all that,
it gives us a lot of information
that we can then use to determine
what that master code actually is.
So we can actually derive the master key for a system
using just one lock and one key for that lock
without ever taking that lock apart,
using a technique called Wright's amplification.
So this has been known to locksmiths for decades.
And it was first made known in the InfoSec community
with the 2003 paper by Matt Blaze.
The general technique looks like this.
So Alice has a key for her lock.
And of course it works on her lock.
And she knows that the master key,
whatever it is,
is going to operate on different shear lines
than her key does.
So she needs to find what the other shear lines are
in her lock.
The way she can do that,
is while looking at her key,
it has a zero cut in pin three.
So that's a good place to start
because we can start varying
what that depth is just in pin three.
And if we leave everything else to say,
it's going to work.
So if the lock does not open,
it's only because of the pin three.
And if it does,
we know we found a shear line in pin three.
So cut zero is what her key is.
So it's definitely going to work.
She brings it down to a cut one.
Can we try it?
And it doesn't work.
So she pulls it out
and tries a cut two
and tries it in her lock.
And it does work.
So now Alice knows that she's actually deduced
the master shear line in pin three.
And that's because it's the other shear line
that works in her lock.
So she can take her modified key.
So Alice's key
and file it down to a two
and try it in Bob's lock.
And it also works
because Bob's lock is very close to hers
on the same system.
Bob is a two, she's a one.
Alice can then go and take her modified key.
So we take Alice's key
and we modify it from a zero down to a two.
And we can try it in Charlie's lock.
And it doesn't work, which is no surprise.
Charlie's lock is B34.
It's very far from Alice's.
And she's only found one of the master deaths.
So she's going to need to repeat this.
Her new sub master key is 31234.
She can get a new key cut that's at 01234
and try the zero cut to see if it might be a shear line.
And as it turns out, it is.
So we now have a master death in pin one and pin three.
So now we get a key cut 00234.
And we try that.
It does not work in her lock.
So she pulls it out and files it down to a one
to try the next position.
And of course it does work,
which we knew because that was what her key was originally.
So we take it down to a two and we try it.
It doesn't work.
Take it down to a three, try that in her lock.
And it does work.
So now we found the master depths for pin one, two,
and three in Alice's lock by finding the other shear lines.
We can keep going.
03234.
We're going to get a new key cut with four as the highest.
So 02304, and we'll put that in.
And she tries it and it doesn't work.
And so she files it down to a one, tries it.
It doesn't work.
Two tries, doesn't work.
Three tries.
It does work, but we sort of knew that
that was what her key was originally.
So we keep going.
A four, we try it, doesn't work.
File it down to a five, we try it and it does work.
So now Alice has found the master depth
in pins one through four using her lock.
And so now we have 0325 is our master depths.
And then we want to find out what the master is
in pin five as well.
So we put it to a zero, but that's a max violation.
So we put it to a one and we try that.
And it does not work.
You put it down to a two and it does work.
And Alice's key originally was a four.
So we now have a two as our master depth in pin five.
So our master code should be 03252.
Alice can try this in Bob's lock as a sanity check.
So 03252, and she tries it and it does work.
So that's a very good sign.
And then Charlie's lock is the real test.
03252.
And she tries that and it works in Charlie's lock as well.
So by sweeping all possible depths in each pin
within Alice's lock and seeing if it still works
on each depth, Alice is able to discover
what the other shear lines are in her lock
by modifying her currently working key
and in doing so deduce the grand master key
that is going to work in every lock on this system.
So one additional interesting lock configuration
that gives us a little bit of information
is a construction keyed system.
So let's take a look at what that actually is.
In a construction lock system,
we have instead of one master wafer, a smaller ball bearing.
And that acts as a master wafer
while the building is under construction,
being used by the construction master key.
So it goes in and it works
and that ball bearing is below the shear line.
And so it operates as a master wafer.
What happens though, when construction is done
and the user comes along with the grand master key
is it is a little bit higher by that ball bearing
than the construction master.
And it goes in and it lifts that ball bearing
above the shear line.
Well, what happens then,
the construction core is a little bit special as well.
It contains a number of holes in it
that are going to line up with the top of the pin stack
when that core starts to get turned.
That ball bearing that's now in the upper pin stack
is actually going to get dropped into one of these holes,
at which point it stays trapped there forever.
So in the lock, when the new user of the building
turns this key, this ball bearing is going to drop out
and it stays gone forever,
or it stays trapped in that hole,
at which point it's like that ball bearing
or that shear line no longer exists.
So the grand master key continues to work,
but if the construction worker ever comes back
and tries to get the construction master to work,
it's not going to, it's going to bind in this shear line
because that ball bearing is gone.
So there's two things we can do with this.
One is, if a construction worker
still has the construction master
and wants to make it work again,
all he has to do is know that there was a ball bearing
in pin one and its depth was four.
And so from six, four, nine, four, three,
we can get a key cut to two, four, nine, four, three.
So that's four higher in pin one.
And that is now going to match the new GMK shear line
and it is going to work.
The second thing that we can notice
is that for our new grand master key,
it can't be deeper than a cut six,
because if it is deeper than a cut six,
then the construction key that must have gone with it
is four less than that.
Well, four less than six is a 10 cut,
and that's not possible in this particular system,
which goes from one to 10.
So we can add that to our rule set.
And we have 10,000 possibilities
reduced to 80,000 after max.
And we add a construction key and rule
that in pin one, there was a ball bearing with thickness four
and the master construction key
also has to have a max of seven.
And it'll take the computer a few seconds to crunch that.
And we see that these bottom four positions
cannot be that master key
because there would have been no possible construction key
to make from it.
The max requirement for the construction key
and the grand master key
with a difference of four in pin one
further limits what lock or what key differs
are available to be our master key.
So that's one interesting type of system.
Another is what's called interchangeable core systems.
So if you have ever seen locks that look like this,
they have a figure eight shape around them.
That's because that figure eight shape
is actually removable.
And there's a little locking log that keeps it in place,
but with a special key called a control key,
we can remove it.
So the way that this works
is we have our IC core that looks something like this.
And when we normally operate it,
it's going to turn just the plug
and the core stays in place.
But when we use a special control key,
it's going to turn slightly
and retract this IC locking log.
The way that that works is if we look at
just the core and the IC collar,
we have two shear lines.
One is matching where the plug is,
and one is a little bit higher,
and it's going to be just for the IC collar.
So if our pins have a shear line all matching the plug,
then the plug is going to turn,
but the collar will not.
And so this is a standard unlocking of this lock.
If however, the pins extend up
and we have a shear line across these two pins,
and then the upper shear line on the IC collar,
and then these two as well,
then what happens is our interchangeable collar
gets retracted and it allows us
to remove this particular lock.
This is very interesting when we look at systems
that do not have an IC collar
that extends across all the pins.
In this case, it only uses pins three and four,
and that creates a number of interesting properties.
So one of those properties is,
let's make this into a Medeco system.
We can see this collar here.
And so we have this lower shear line with the plug
and this upper shear line for the IC collar.
And that's what we're going to look at
when we examine how these locks work
in terms of the bidding.
So what's powerful about how they work
in terms of the bidding,
in terms of getting us information,
is the way many locksmiths do it up.
And so we'll use Medeco as an example,
because as we'll see,
it creates a very restricted set of possible master keys
for IC core systems in many, many cases.
So we have our change key and we put it into the lock
and it unlocks to the regular shear line.
And so we turn the key, it unlocks regularly.
And our master key is completely different bits, of course,
completely different heights,
but it also unlocks to our regular shear line
and the interchangeable shear line binds.
So that does not actually open.
However, when we put in our core remove key,
it now binds between the core and the IC collar,
but has a shear line at the top of the IC collar.
So when we turn that, it's going to turn the IC collar
and release it and allow us to remove that IC core.
And we see now that it works on this upper shear line,
as well as, of course,
the lower ones have to work for the plug to turn as well.
What many locksmiths do
in order to avoid having to have multiple shear lines
in a pin stack,
and also avoid limitations on the mastering system,
is they will have the change key,
or sorry, the core remove key,
simply be three positions higher than the master key
in those two IC collar control pins.
It doesn't have to be done this way.
We could do something a little bit different.
We could have our core remove key,
say be something a bit lower,
and then have our core control position be at an eight cut.
So that wouldn't be ever possible to create a key that deep,
but it will remove the core.
But many locksmiths don't do that
because it requires more pins,
as well as it restricts the size of your mastering system.
And this is true, particularly for Medeco.
We see empirically about two thirds of the time
this being done with the grandmaster key
and the core remove key just being three positions different
in those two middle positions.
In Medeco, that becomes incredibly powerful actually
for deducing what the master key is going to be.
So in a 12 cut Medeco key,
so Medeco can have two cuts, double cuts in some positions
or all of them to create a high level master key.
And we'll talk a little bit more later
about what that specifically means.
But because these double cuts are so wide,
the max is very small.
It's a two between a double cut and a double cut.
And so that already, that max of two severely limits
what a Medeco system can take on.
So Medeco system would have six depths, usually six pins
and it has a max of only two.
And so that reduces us from 46,000
down to only 7,300 possible combinations.
But what the IC core does is significantly more restrictive
because if we want to make the IC control key three higher
than the master key,
that means that the master key can't be a one, two or three
in pins three and four.
And so we'll add that rule there as well.
And the master control key has to adhere to max in addition.
So we'll see the effect that that has when we add this rule
and it'll take a second to compute.
And so what we see is,
these three positions cannot be held
by pins three or four in the master system.
So the master is forced down to four, five and six.
In addition, pin two can't be a one
because that's a max violation.
Master must be four or lower.
So it can't go up three, the max is two.
Pins six or pin two and pin five can't be a six depth
because that would be a max violation
for the interchangeable core control key.
If our grand master key is the deepest, it's a six cut.
That means our IC core is three higher or a three cut.
And we can't have a six beside a three
in our interchangeable core master key.
So that significantly reduces the key space available
in these types of medical systems.
Right now, it's down to 784.
It gets even more restricted than that
for the following reason.
It's generally a good idea
to have our master key use at least one pin
in the highest position.
And that way we can make sure that none of our change keys
will be able to be filed down into a master key.
We could have one a bit lower,
but that's then gonna restrict how large
our master system can grow while adhering to that rule.
If we look at the limitations imposed
by this particular system,
we'll see that there's only two places
that that one cut can go, pin one or pin six.
So if we add a requirement that one pin must be high cut,
and it'll take a minute to compute that as well,
we're gonna see that we're now down
to 159 possible master keys.
That is a significant limitation,
and that's given very little information
about our Medeco system.
It's given that we have a large facility,
so we can assume that they were planning
for potentially needing to expand to a master key
that's double cut in all positions.
And we see at least one interchangeable cord
somewhere on that system.
And that's it.
Knowing those two things,
we can infer that with about a two thirds probability,
our master key is going to be limited
to one of these 159.
It gets even less than that,
because it usually makes sense to put
your one depth in pin one,
and that way the key is nice and sturdy,
it's not gonna break.
We don't wanna put a very deep cut in pin one,
or that grand master key is liable to break off.
And so when we add that particular requirement,
it then is only 84 differs that follow through in pin one,
and we can see max restricts this incredibly tightly.
So there's the 84 possible situations that could exist
if locksmiths do what a lot of them do
when designing medical systems,
which is follow these constraints.
It limits the key space significantly.
Now they don't need to.
They don't need to use a pin at the highest one.
They could put it in pin six instead.
And of course they could do up their IC system
so that it doesn't require their master key to be low
in pins three and four.
But most locksmiths don't really think about
the key space reduction that they are creating
in terms of brute forcing this master key
when they're designing that system.
And so that's why this is something that's so common to see.
A couple other things that we can note
about this particular system
is that if we have a master key or even a change key,
so just this change key,
now all we need to do is vary and do right simplification
on these two middle pins
to determine what the core remove key is.
Pin three is a five.
And so if we add three to it, it goes to four, three, two.
And now we've hit the IC control line.
And then pin four, we can vary in either direction
to try to hit the IC control line for it as well.
So we only actually have to vary one pin
to go from our change key to an operable control key.
It's just going to be for this lock.
But what it lets us do is remove the IC core
and then we can take it apart
and disassembly of the lock
then will let us derive the master key from that.
Other types of locks have a similar situation.
So Schlage and Yale control keys
use a slightly different technology.
They have a special seventh pin in the back
where if the key is a bit longer,
in the case of Schlage,
it has this special nose on it sticking out.
It's going to actuate that seventh pin,
which will pull in this little retaining lug.
And when it does that, you can then remove the core.
So if you have an operable key for this particular lock,
all you need to do is copy that key
onto a slightly longer blank
that contains this little nose on it.
And you can use that key to remove the core,
at which point you can then disassemble it
and deduce the master key.
Let's look at some right-samplification attacks
in some special secondary locking systems.
So we'll start with Multilock,
which has got a nice pin-in-pin system
that we can attack using all the other techniques
that we've talked about in this talk.
But it also has side pins that are used for mastering.
And effectively, these side pins
are going to fit into these side dimples
drilled into the key.
And in this case, we have a correct key.
The side dimples are all there,
so the side pins are able to fit into it.
And they don't impede rotation of the plug.
When an incorrect key is inserted,
there are no dimples,
and so the side pins are forced out into the plug.
And that's actually going to stop us
from rotating that key.
This is used for mastering.
So we have, in this case,
a key that's got four of the five holes drilled.
This is its correct lock.
So these four pins are present,
and the key is able to turn.
For a lock that is not supposed to be able to open,
there'll be a pin populated here as well.
And this lack of a hole prevents that pin
from moving out of the housing,
and it will stop the key from turning.
This is, of course, a trivial thing to amplify.
We just drill an additional hole,
and now all of the mastering that's done
with these side pins has been defeated.
This key will work in anything
regardless of the side pins.
And then we just have to use the other techniques
to right-samplify the top cuts as well.
So that's a very simple right-samplification attack.
You can do something very, very similar
by filing metal off of sectional keyways.
So sometimes mastering is done by having a keyway
that will not enter the keyway of some other lock
that's not supposed to open, or a key that won't.
But then we have a master blank
that's going to enter both of these locks
because it's got metal missing from it.
And so all we need to do to right-samplify there
is take our key that works on
one of the low-level keyways
and just copy that bidding code onto our all section blank
at which point it's going to then enter all of these locks
and we'll be able to open them as well.
With Medeco Biaxial, we see something quite similar.
So Medeco Biaxial has potential for double cuts.
And what we can have is in a particular pin position,
the pin has got this beveled edge to it,
so it goes to one side or another.
It can bevel towards the shoulder of the key and be a forecut
or towards the tip of the key and be an aft cut.
In a master key that's got double cuts,
regardless of whether the lock that we're in
has a forepin or an aft pin,
it's going to interact with that key properly and open it up.
And Medeco uses this for mastering as well.
So a lower level key or a lower level master
might be missing one of these cuts.
We can very easily right-samplify that if we have some mid-level master.
So here's MKA.
It's got five single cuts and a double cut in pin six.
And then we have any old key on the B system.
And so what we see, for instance, is this pin six,
that is a double cut.
Pin five, we have an aft and it's a right cut.
In this key on the B system, in pin five,
we have a fore and it's a left cut.
So what we can do is take a left cut and add it to the fore position
on our MKA at these same master depths.
And that's actually going to amplify this key into a full GMK
that's going to work on all locks,
even if it has an aft pin in that position.
Sorry, a fore pin in that position.
And so we do that for all other positions
where the fore-aft of our B key differs from our MKA.
And we've effectively now amplified the power of our MKA key to be a full GMK
using the information of these angles that we see on this key here.
So now that we understand how the basics of Medico Biaxial works,
we can add a few tools to our arsenal to decode non-mastered Medico systems.
So if we start with a six-pin Medico system,
if it's non-mastered, it's going to follow Medico's code books.
And so the depths are going to follow those code books.
Give the computer a second to compute.
And what we see immediately is that pin one, two, five, and six
will never be a one in a non-mastered system,
at least for this older version of code books
that we're going to be looking at today,
which is true for just about every Medico system created before 2008.
So immediately we see that if we wanted to impression this lock,
and you can impression Medico locks,
we'd start with two, two, one, one, two, two.
And as we went through impressioning this,
we would end up skipping a whole bunch,
increasingly so as we get closer and closer to the final key.
So the code books helps with that.
And of course, if we have a photo that's close
but isn't quite enough to get the exact fitting,
combining that with code books is usually enough
to determine what the depths are.
Medico also has angles though, and the angles also have code books.
So if we add that the code books must follow
Medico's non-mastered angle books,
we see that right away, some of them are given already.
So if we happen to have a pin three in the aft position,
it's going to be a right cut.
This can be useful now that we have this,
if we know whether a particular lock is a four or an aft in each position.
How do we tell that?
Well, here's a little device that we designed that does exactly that.
So here's one version where you take a blank,
you cut a little notch into the six aft position,
and then you stick it into the lock and it will clunk, clunk, clunk
all the way along as each pin fits into it.
Based on how far it clunks, if it aligns with these lines for the fours or not,
you can tell which is for an aft.
Here's another design that can be cut down from any key, not just a blank.
We have a little tip at the end with a notch in it, again, in the six aft position.
And we can clunk, clunk, clunk it along and make some marker marks on the key,
and then decode it afterwards and determine whether this means
for an aft in each of these positions.
So for instance, if we know that we have a lock in front of us,
and we've decoded the for and aft, and if we find it to be, let's say, aft,
for, aft, for, for, aft, in that particular case, what actually happens is
we completely get the angle sidebar code figured out for us.
I'm just going to remove the depths because they kill the compute time for now.
If we aren't so lucky, this is the only case of fors and afts where that happens.
Let's say we get a for here and an aft there.
So now we have a number of possibilities.
We can help to decode what those angles are based on an innovation that
Mark Webber Tobias and Tobias Bluzmanis came out with a number of years ago,
which is Medeco bump keys, which takes advantage of flaws in their angle codebooks.
But these bump keys, there's a set of four of them.
And if we can get one of them to work once on this lock,
then we can use that to create a key that will work very easily forevermore
by identifying, well, one of these bump keys worked.
And that's going to go ahead and figure out what those remaining unknown angles are
based on the fact that that particular version of the bump key happened to work.
If, say, even that isn't enough for us.
So in this case, pin six, it could be a Q, which is a right cut or a B, which is a center cut.
Right is 20 degree angle and center is zero.
And another thing that Tobias has found out is that, like I mentioned before,
with some blocks being able to accept half height cuts in the heights,
it'll accept half angle cuts.
So I can make a key at 10 degrees, halfway between center and right.
And that will actually operate this lock.
So a number of techniques that we can use to decode Medeco systems.
So we've covered a lot of techniques for how to use various sources of information
to come down to a bidding code.
So a number that represents what the key should be cut to, what depth that should be.
But how do we take that and turn that into an actual usable key?
Well, we could start with the key blank and file it down ourselves manually.
That's a perfectly valid way of doing it.
We can also use a machine if we happen to own a key machine, but many of us don't.
And we could also try using a locksmith.
So the general procedure for that is to identify the blank.
It's often printed right on it.
So WR5 for this Weiser or Y1 for this Yale.
Determine the bidding code that you want using the techniques we talked about
and go to a locksmith, so not a hardware store or a 7-Eleven,
and ask if they can cut a key by code.
If they say yes, give them the blank name and the code, such as a Schlage SC1
with bidding code 04285, and they will usually cut it for you for the duplicating rate.
If they happen to say that key is restricted, I can't cut you that.
Check out the talk that myself and my brother Bobby gave last year entitled
Duplicating Restricted Mechanical Keys at DEF CON 27.
We'll talk a little bit about defenses, which is a huge field and could be a talk on its own.
But the most salient points there is avoid very large mastering systems.
If the only reason you have building A and building B mastered together
is so that the superintendent can carry one GMK instead of two,
that's really not worth the added risk for that added convenience.
You also don't want to master high security and low security facilities on one system.
So I've seen cases where a nuclear facility was mastered together with public washrooms.
The access control of those public washrooms is significantly less,
and information from those locks can be used to infiltrate the nuclear facility.
That's absolutely something that you want to be separating in your mastering system.
A missing lock is as bad as a missing GMK.
So if a lock goes missing and it can't be accounted for,
you need to consider the possibility that someone has
disassembled and decoded it and made the key.
You can consider alternatives to the two-step system
and other various systems that we've talked about that can be exploited.
Specific to those attacks,
this is somewhat dependent on whether it's actually in your threat model.
This is not in the threat model for the majority of applications.
You can use a restricted keying system that won't stop a determined attacker,
but it can slow them down and it can drive the cost up
and potentially deter them from carrying out the attack in certain cases.
Your facility ultimately should be secure even if an attacker has the GMK.
So you want to use secondary security systems,
such as guards and alarms and a proper detection and response mechanism.
All that a mechanical lock does is keep honest people honest,
and there's loads of ways past it,
both keying and forcible entry and all sorts of other methods that DEFCON is all about.
And use interchangeable core or electronic components or something
to make re-keying easier if that becomes necessary.
You want to have a response plan in place for if the unthinkable happens
and your GMK or a key to a particular important area gets compromised.
If you see something like this, so a lock goes missing
and you're not sure how that happened, you want to take that seriously.
And for heaven's sakes, don't do this.
So thank you very much. I encourage you to go try it.
Here are all the links to the applications that I'm releasing.
Try them out for yourself and see what you can discover with them.
I'd like to extend an enormous thank you to Josh, Karen, Jenny and Bobby
for their help in getting this talk prepared.
In particular to Jenny, she absolutely saved the day
with editing this video at the last minute.
And I'd be happy to take your questions.
Thank you very much.