WEBVTT

00:01.260 --> 00:07.100
Hello everyone, and welcome to my DEF CON talk all about locks and keying systems and how to hack them.

00:07.200 --> 00:10.600
There's going to be a lot of math and problem solving involved in what we're talking about today.

00:10.600 --> 00:14.240
So for those of you who like that sort of thing, I think you're going to really like this talk.

00:14.240 --> 00:21.220
For those of you who don't like that as much, I'll be releasing a number of software applications that will do all the hard work for you.

00:21.620 --> 00:25.260
This is all about decoding locks, despite the very verbose title.

00:25.260 --> 00:30.160
So taking all the information available and creating a key for a lock where we didn't otherwise have one.

00:30.640 --> 00:32.340
It's a fairly long talk.

00:32.860 --> 00:40.720
So if you're watching this on YouTube after, I'll put a comment below with links to times in the video so you can skip to the parts of the talk that happened to interest you.

00:41.360 --> 00:43.820
I will just mention that this feels incredibly weird.

00:43.820 --> 00:48.220
The energy is so low compared to giving a main or a talk on the main stage at DEF CON.

00:48.220 --> 00:53.100
So I will do my absolute best to stay engaged and keep you awake and to stay awake myself.

00:53.340 --> 01:00.040
But the good news here is that this talk involves a lot of software demos and me going through the software I'll be releasing.

01:00.040 --> 01:05.040
That would have been absolutely terrifying to do on a main stage at DEF CON.

01:05.220 --> 01:11.460
So what you get out of that is the speaker who is going to be a lot less stressed out and making a lot fewer mistakes.

01:12.580 --> 01:22.060
So take a look at your key ring and see the keys on there and see how much you understand about what they are beyond just shapes of metal and how they interact with the lock.

01:22.060 --> 01:25.320
And that's what we're going to be talking about all through today.

01:25.460 --> 01:32.240
The way we're going to attack that is looking at how locks and keys work and the introduction of the tools I'm releasing to analyze them.

01:32.240 --> 01:39.680
We'll look at the economics and practicality of brute forcing all possible keys and reading the pins in a lock to get information from that.

01:39.680 --> 01:43.660
We'll improve on impressioning by applying the extra information that we have.

01:43.660 --> 01:47.580
And we'll look at key-like systems and lock disassembly to get information.

01:47.840 --> 01:53.060
We'll then formally introduce information theory and see how it applies to mechanical locks and keys.

01:53.060 --> 02:04.020
We'll introduce master keying systems and derive master keys from multiple low-level keys and perform other rate-samplification attacks to create a master key where we didn't have one before.

02:04.040 --> 02:11.000
We'll look at a couple of special cases like construction keying, IC cores, and high-security secondary systems like Medeco and Multilock.

02:11.000 --> 02:15.620
And finally, we'll talk about what the blue team can do to remediate from these attacks.

02:15.820 --> 02:25.580
All of the software that I'm releasing as a part of this talk can be found at these links here, both a version that you can try right in your web browser as well as the source down below.

02:25.580 --> 02:31.300
So before we jump into the new content, we'll give a very brief overview of how locks work for those who might not be familiar.

02:31.560 --> 02:37.060
So we have a key and it enters the lock and interfaces with a number of pins.

02:37.060 --> 02:41.160
We have key pins close to the key and driver pins higher up.

02:41.160 --> 02:46.520
And if they all line up with the top of this plug, it will allow the plug to turn.

02:46.780 --> 02:47.880
What do I mean by that?

02:47.880 --> 02:50.840
Well, let's take a look at a 3D model for what this is representing.

02:50.840 --> 03:01.560
So here's a familiar lock and this inner insert called the plug, when all those pins line up, it allows it to turn.

03:01.560 --> 03:13.600
So if we look at the cross section of it here, when those pins line up as I showed in the two-dimensional diagram, that's what then allows that to happen.

03:13.600 --> 03:26.320
And if any of those pins are not at the right height, so we have a driver pin into the plug or a key pin up into the housing, then that will not allow it to turn and the lock remains locked.

03:26.480 --> 03:32.600
Within the plug, we have holes for the key pins to go into and those holes don't go all the way down.

03:32.600 --> 03:36.200
So that's what stops the pins from falling right out of the lock.

03:37.360 --> 03:43.140
And so in this cross section we see here, this is where the key enters and then this is where the pins are.

03:43.140 --> 03:50.320
And that's what we're representing in our two-dimensional facsimile that we have here.

03:50.320 --> 03:54.940
So the key goes in, it raises the pins to the right height, the lock opens.

03:55.280 --> 04:06.560
If some of these pins are, or these key cuts are too high or too low, then it will not open because we have a driver pin or a key pin in the way.

04:06.560 --> 04:11.380
And we can see these shear lines are now binding, the lock does not open.

04:11.920 --> 04:17.460
It's worth noting that the positions in the key are all discrete.

04:17.460 --> 04:24.200
So we can have a set number of intervals for depths that these positions can take on.

04:24.260 --> 04:32.920
And that is defined by what type of lock it is, as well as the position of the pins, of course, is defined by what type of lock it is.

04:32.920 --> 04:43.360
So you can play around with this software yourself to understand what that top profile of a key actually means in terms of what key code it creates.

04:45.300 --> 04:50.800
So this is an example of what a plug cut in half actually looks like.

04:50.800 --> 04:54.400
So we can see where the pins go and where the key goes in here.

04:54.980 --> 04:58.500
A key itself is just mechanically encoded information.

04:58.780 --> 05:01.960
So I showed how we can change the code to different heights.

05:02.180 --> 05:04.520
Key codes are a number that represents that.

05:04.520 --> 05:05.940
So this is a Schlage key.

05:05.940 --> 05:08.200
We read it from shoulder to tip.

05:08.260 --> 05:12.560
So in pin one, we have from zero down to nine.

05:12.560 --> 05:16.120
We have eight cut and we can get seven, et cetera.

05:16.120 --> 05:18.280
So here's a two, we have zero, one, two.

05:18.280 --> 05:23.020
And from that, we can get the full bidding code of eight, seven, five, two, seven.

05:23.120 --> 05:24.400
And that makes sense.

05:24.400 --> 05:32.020
When we look at the profile of this key, deep, shallower, shallower, very shallow, and back to deep again.

05:32.260 --> 05:40.280
The thickness of the key from the base to the points of this cut here is given by this chart for the Schlage system.

05:40.280 --> 05:46.220
So an eight cut is going to be 215 thousandths of an inch from these two positions.

05:46.860 --> 05:48.640
Here's another example we can see.

05:48.640 --> 05:50.440
So five, two, eight, six, four.

05:50.460 --> 05:52.380
We can see it makes about sense.

05:52.380 --> 05:58.500
There's a five in the middle, a two is high up, eight is low cut, and then it's increasing from there.

05:58.860 --> 06:02.920
One thing we need to be aware of is the maximum adjacent cut specification.

06:03.060 --> 06:06.760
We can't have a very shallow cut beside a very deep cut.

06:06.820 --> 06:11.880
Or in one case, it's going to be too steep and we can't put the key in or get it out.

06:11.880 --> 06:17.040
Or in another case, we're going to start impinging on the neighboring cuts.

06:17.040 --> 06:20.000
So if you look at how a key is actually originated.

06:22.000 --> 06:28.560
So we can see in this lower left corner here, this cutter wheel that's taking bites out of the key.

06:28.620 --> 06:34.880
And so we're moving it along to predefined positions along the key, and then cutting down to predefined depths into the key.

06:34.880 --> 06:38.960
In this case, we're cutting it to the bidding code one, two, three, four, five.

06:38.960 --> 06:43.920
So here we are on the fifth position, cutting it down to a five depth.

06:44.400 --> 06:53.140
We can see that the way that cutter wheel cuts into the pins actually creates a sloped angle.

06:53.240 --> 06:59.100
And so here's an example of one key where we have a code zero, four, zero, three, seven.

06:59.100 --> 07:01.660
So that's again from shoulder to tip.

07:02.000 --> 07:12.640
If we wanted to bring pin two down so that it matches not this shear line, but this upper one, we can start cutting the four down and it works, down to a five, down to a six is fine.

07:12.640 --> 07:19.940
But now these shallow slope sides around it are getting very close to the neighbors.

07:19.940 --> 07:25.340
And in fact, when we put it down to a seven, those neighbors are now lowered by that.

07:25.340 --> 07:28.200
So that's a bit of a problem for us.

07:28.460 --> 07:33.720
It means that we cannot have a zero cut next to a seven cut.

07:33.720 --> 07:36.080
Zero next to six is okay, but not seven.

07:36.080 --> 07:40.620
So that's our maximum adjacent cut specification is six.

07:40.620 --> 07:45.820
Likewise, we can't have a one next to a seven or next to an eight, but it can be next to a seven.

07:45.820 --> 07:46.980
So the difference there is six.

07:46.980 --> 07:49.340
That's okay because it's maximum.

07:49.780 --> 07:53.900
And that's a property of almost all pin tumbler locks.

07:53.900 --> 07:58.000
And that's gonna limit what our key space is as well.

08:00.860 --> 08:03.800
Here's a chart of the most common max that we see.

08:03.800 --> 08:05.500
So most of them are seven.

08:05.500 --> 08:11.280
They have, in the case of Schlage, Sargent, Yale and Weiser, they have 10 different depths that are allowable.

08:11.280 --> 08:13.480
So at seven, that's fairly permissive.

08:13.520 --> 08:14.980
Kwikset only has six.

08:14.980 --> 08:18.480
So that means that our max is a little bit less at four.

08:19.940 --> 08:23.880
Now that we understand max, we can start to look at the key spaces.

08:23.880 --> 08:29.260
So the total number of differs, or number of possible keys that exist on a system.

08:29.300 --> 08:33.700
And naively, it's the number of depths to the power of the number of spaces.

08:33.700 --> 08:41.560
So for a Schlage key, there are 10 depths to the power of five or six spaces, for five or six pins, is 100,000 or a million.

08:41.560 --> 08:47.140
And for Medeco, it's six depths to the power of five or six, so seven or 46,000.

08:47.380 --> 08:50.480
So we can calculate that fairly easily here.

08:50.520 --> 08:55.780
A Schlage system with five pins and 10 depths, we have 100,000 possibilities.

08:56.100 --> 08:59.020
And six pins is going to be a million.

08:59.160 --> 09:06.500
And if it's a Medeco lock with six pins, six steps, that's 46,000 and that's six to the power of six.

09:06.780 --> 09:09.240
We can also add in our max here.

09:09.240 --> 09:15.300
So let's say that this is a Kwikset key with five pins and six depths.

09:15.300 --> 09:21.240
We can now scroll down and add some rules to this system to limit what our key space would be.

09:21.240 --> 09:23.200
So we start with 7,000.

09:23.200 --> 09:29.140
We find under max and add a max of four, for it being a Kwikset system.

09:29.140 --> 09:33.220
And that now limits it to 6,306.

09:33.220 --> 09:41.880
And we can see that the number of possible differs is less with cuts very shallow and very deep.

09:41.880 --> 09:48.800
So this number here, 941, means that 941 total differs have a zero cut in pin one.

09:48.940 --> 09:52.140
That's smaller than the number that can have a one cut in pin one.

09:52.140 --> 09:58.820
Because a zero cut can go up to four, that's within max, but it can't go all the way to a five.

09:58.820 --> 10:00.940
That would be too much of a difference.

10:00.940 --> 10:02.560
That would be a max violation.

10:02.780 --> 10:08.740
This one here can go to anything because it's close enough to everything that it will not violate max.

10:09.220 --> 10:13.640
To take this to the extreme, we can reduce max down to one.

10:13.720 --> 10:15.700
And so we now see the impact that has.

10:15.700 --> 10:18.400
We're down to only 340 possible keys.

10:18.860 --> 10:29.740
And if by some decoding that we'll talk about going forward, we know that say the shear line in pin one is a three, we now see the pin two can only be a two, three, or four.

10:29.740 --> 10:31.240
Anything else is too far from it.

10:31.240 --> 10:34.320
It's a max violation and that extends outwards.

10:34.320 --> 10:39.240
So that is severely limiting now the number of possible keys that are in our key space.

10:39.240 --> 10:43.000
And we'll look at how to drive these rules throughout the rest of this talk.

10:43.000 --> 10:46.460
In this case, we're down to 74 possible keys in our space.

10:46.460 --> 10:49.620
And so it's enumerating all of those key codes here.

10:49.620 --> 10:50.980
So these are the bidding codes.

10:50.980 --> 10:53.360
We could cut a key to these and try them.

10:53.360 --> 10:56.020
And it might work in this lock.

10:59.020 --> 11:04.900
We can take a brief look at keys versus passwords in terms of the brute force ability of them.

11:05.000 --> 11:09.580
So the cost to try a password is very close to zero, not quite negligible.

11:09.580 --> 11:11.340
In the case of a key, it's quite expensive.

11:11.340 --> 11:16.480
We have to pay for the blank and cutting the key and our time to actually go and physically try it.

11:16.480 --> 11:19.300
That's all quite expensive and time consuming.

11:19.880 --> 11:23.800
Keys can be, or passwords can be an unlimited length and complexity.

11:23.800 --> 11:30.540
Keys are severely limited in both length and complexity due to the mechanical nature of them.

11:30.700 --> 11:34.240
In a password, if it gets compromised, it's easy to change.

11:34.240 --> 11:36.720
And a key is very costly and time consuming.

11:36.720 --> 11:41.980
So what this means is with mechanical keys, things are harder for both the red team and the blue team.

11:41.980 --> 11:45.740
It's harder to brute force and try a whole bunch of combinations.

11:45.820 --> 11:55.860
But if a vulnerability is discovered by the red team, it's a lot harder for the blue team to actually mitigate it and work against that.

11:57.360 --> 12:09.620
To try brute force attack economically, if we look at just the cost of the blank, and we assume that if we own a code cutting machine, the marginal cost of cutting a new key on it is just your time.

12:10.100 --> 12:14.620
So keys are not particularly expensive in that case, between 13 cents and $3.

12:14.900 --> 12:21.500
And if you don't, you would have to use a locksmith who might do it for three to 10, possibly more for high security keys.

12:21.500 --> 12:36.320
So for instance, if we can reduce the key space of a given lock down to 1,000 possible keys, using the software that I showed you and applying rules that we're going to learn about soon, we might be able to try all of those 1,000 keys for $450.

12:36.320 --> 12:46.520
If we own a code machine, if the blanks are 45 cents each, if we have to go to a locksmith to get them cut, then he might charge $4 each for $4,000.

12:46.920 --> 12:50.260
And at that price, we're better off just buying our own code machine.

12:51.780 --> 13:05.800
What's important about this though, is that if whatever's being protected within that room is worth less than $4,000, it now becomes an economical attack to actually brute force all of these possible keys in the key space.

13:06.300 --> 13:15.640
One really good example of a lock where this is not just possible, but imminently feasible, is the Sargent and Greenleaf Environmental Padlock.

13:15.640 --> 13:21.500
It's a very well-built, beefy padlock meant for highly punishing outdoor environments.

13:21.540 --> 13:24.720
And there's very few small parts inside as well.

13:24.720 --> 13:30.760
It's a disc detainer lock, so it looks a bit different than the keys we've looked at so far, but we can analyze it exactly the same.

13:30.760 --> 13:40.580
It has three different discs and the key can be cut to either 180 degrees, as we see in the middle here, 135 or 90 degrees.

13:40.580 --> 13:46.920
So three discs and three different positions that each one can be cut to.

13:47.660 --> 13:50.320
Let's put that into our key space software.

13:50.320 --> 13:51.940
So get rid of those rules.

13:51.940 --> 14:00.080
And this is a disc detainer, one based with three discs and three possible depths each.

14:00.080 --> 14:03.720
And we see 27 is our total key space.

14:03.720 --> 14:08.940
That is everything that that Sargent and Greenleaf Environmental can possibly take on.

14:10.260 --> 14:12.020
And that's three to the third power.

14:12.020 --> 14:12.740
That makes sense.

14:12.740 --> 14:15.480
And we see them all enumerated here.

14:16.280 --> 14:27.120
It's a little bit more complicated than that, because if we insert this key and we turn it and open that lock, one design feature is that they want it to be key retaining.

14:27.120 --> 14:29.640
We can't pull the key out if the lock is open.

14:29.700 --> 14:36.400
If this were, say, cut 180, 180, 180, that would be possible to do, and we don't want that.

14:36.680 --> 14:44.260
So we actually want to remove all of these key combinations that would not be key retaining that we can pull that key out of the lock for.

14:44.260 --> 14:46.400
So 1, 1, 1 is no good.

14:46.540 --> 14:49.960
1, 1, 2 is no good because 2 is lower than 1.

14:49.960 --> 14:52.120
So it has to go up at least once.

14:52.120 --> 14:53.840
So 1, 2, 1 is good.

14:54.300 --> 14:55.640
1, 3, 1 is good.

14:55.640 --> 15:01.200
1, 3, 2 is, but 1, 3, 3 is not, because it doesn't go back up at least once throughout it.

15:01.580 --> 15:04.220
So we can add a rule for that under max and stuff.

15:04.220 --> 15:17.340
We can add a rule for key retaining, and that's going to reduce those, that key space to remove differs that are not going to be key retaining in this particular case.

15:17.620 --> 15:24.600
And so we can see now that there's more with a deeper cut in disc one and a shallower cut in disc three.

15:24.600 --> 15:31.660
And that's because if it steps down from 1, 2 to 3, that's not going to be key retaining.

15:31.760 --> 15:40.540
So we could create all 17 of these possible keys, and that might make sense because it'll work on all Sergeant and Greenleaf environmental locks.

15:40.620 --> 15:52.860
If we have, say, a budget limitation, and we don't want to pay for 17 blanks, which would be, we've put 41 here, it would actually be a bit more because these blanks are worth more, but this is just an order of magnitude calculation.

15:53.200 --> 16:02.040
We can click down here and click brute force save blanks, where it'll run a little algorithm to try to optimize for you, cutting one blank and then filing it down.

16:02.040 --> 16:05.560
So 1, 2, 1 follows 1, 3, 1 to 1, 3, 2, et cetera.

16:05.760 --> 16:09.960
And that way we can test out the entire key space in as few blanks as possible.

16:09.960 --> 16:16.620
This particular algorithm here, to find the optimal solution, turns out to be an NP complete problem.

16:16.620 --> 16:34.940
It ends up being reducible to the set cover problem, but we have a somewhat suboptimal greedy algorithm that I've implemented here, that empirically I found is good enough for getting us a decent algorithm of saving ourselves some blanks.

16:34.940 --> 16:44.400
So in this case, it goes from $41 to get all 17 blanks down to just 12, since we only need five blanks now.

16:44.420 --> 16:47.420
So that's the Sargent Greenleaf Environmental Padlock.

16:47.420 --> 16:49.900
It's a very good padlock for what it's designed for.

16:49.900 --> 16:54.620
It's not really designed for security of the key space, and that's okay.

16:54.620 --> 16:58.840
It was used for a number of years back before people knew this.

16:58.840 --> 17:01.580
And so it sort of benefited from security by obscurity.

17:01.580 --> 17:08.000
But for that reason, this particular lock is not used for high security applications anymore.

17:08.540 --> 17:18.920
So let's shift gears a little bit and look at locks where we can try the entire key space, not by reducing possible differs, but by trying multiple at once.

17:19.040 --> 17:22.100
So this is the Kwikset Smart Key Lock.

17:22.100 --> 17:28.920
It's smart key, so to speak, because it has this hole you can insert a special tool to rekey the lock without ever taking it apart.

17:28.920 --> 17:30.600
Kind of a cool design.

17:30.600 --> 17:34.700
Unfortunately, it's manufactured with extremely loose tolerances.

17:35.100 --> 17:38.620
And what that allows is us to actually try half heights.

17:38.880 --> 17:47.920
So normally, if you have a one cut in a particular pin position, that will work if the pin is a one or a two will work for two.

17:47.920 --> 17:52.940
What this lets you do is cut it to one and a half, and that will work for both a one and a two.

17:54.500 --> 18:01.580
So by allowing us to do that, we can reduce it down to 200 and some odd possibilities.

18:01.580 --> 18:07.080
So let's simulate that in our Keyspace software here.

18:07.080 --> 18:10.680
So Kwikset locks, so it has five pins and six depths.

18:10.680 --> 18:18.860
And then six to the five is 7,700, as we looked at before, when we have to try all of one through six.

18:18.920 --> 18:28.760
When half heights work though, it turns into three to the five, because we can use 1.5, 3.5, and 5.5 to try everything from one to six.

18:28.960 --> 18:38.220
And so we can see here that trying out all of these half height keys to exhaust the entire Keyspace would cost about $500 to make all of them.

18:38.480 --> 18:49.080
And there actually exists commercial sets you can buy that costs on that order as well to try all of these different options.

18:49.080 --> 18:57.000
So that is something that's out there for the Kwikset keys, the Kwikset SmartKey in particular.

18:57.000 --> 19:09.480
And that is something that usually wouldn't be your go-to attack methodology because the Kwikset SmartKey, by virtue of those loose tolerances, is easy to pick.

19:09.540 --> 19:24.540
But if you wanted to use it to, say, determine the key for one lock, and then you could get in very quickly in future, or if you had multiple locks that you know are all keyed alike, once you figure out the key for one, it's going to work for the rest.

19:24.540 --> 19:26.300
That's something that you can do.

19:26.300 --> 19:36.800
Let's examine for a few minutes why this actually works and why locks sometimes accept keys that are cut incorrectly.

19:37.020 --> 19:42.520
So in this particular case, we have a set of probability distributions.

19:42.520 --> 19:50.500
So this is the one cut, two, three, four to six for a Kwikset lock.

19:50.740 --> 19:55.540
And we can notice that this is where it's supposed to be, where it's supposed to be cut at.

19:55.540 --> 20:10.700
And if we're a little bit above that or below that, the probability falls off relatively slowly so that if we go exactly between two cuts, it still has a very high chance of actually working on either the lower or the upper.

20:11.020 --> 20:20.760
This distribution here, a fairly normal looking one, exists because the Kwikset smart key lock is a type of wafer tumbler.

20:20.760 --> 20:23.980
So wafers are symmetric in what they'll actually accept.

20:23.980 --> 20:28.160
And it's also one with very bad tolerances.

20:28.580 --> 20:35.140
If we pump that down a little bit, we start to get it accepting less and less.

20:35.140 --> 20:40.600
And so a lower probability of actually having a key that's cut halfway in between work.

20:40.880 --> 20:45.200
And we can also look at what happens with a pin tumbler lock.

20:45.200 --> 20:55.260
In particular, when we have pins involved, it becomes a much faster fall off when the key is cut too high.

20:55.260 --> 21:11.740
And the reason for that is because if we look at what a pin tumbler lock looks like on the inside, if that pin is too high, it's going to stick out above this core here.

21:11.740 --> 21:18.340
And when it sticks out above that core, it is now physically blocked by the housing.

21:18.340 --> 21:21.700
It needs to stick up into this.

21:21.700 --> 21:27.680
And we cannot turn that core at all if it's more than one or two thousands of an inch too high.

21:27.840 --> 21:41.080
So both the fall off on the probability distribution is significantly faster, as well as the amount too high it can be before it starts falling off is also significantly lower.

21:41.080 --> 21:43.000
Whoops, that was the wrong slider there.

21:43.100 --> 21:52.020
And so we get a probability distribution that looks something a lot more like this for a pin tumbler lock.

21:52.020 --> 21:59.200
So this would be a quick set probability distribution for accepting a one cut key.

21:59.200 --> 22:01.480
So if it's a little bit too high, it falls off quickly.

22:01.480 --> 22:03.560
If it's a bit low, it works out okay.

22:03.560 --> 22:06.480
And then two through six as well.

22:07.840 --> 22:13.920
In the case of a Schlage, we have 10 cuts and they're much more closely spaced together.

22:14.040 --> 22:27.220
So now we have, even though it's a pin tumbler lock, which generally has better tolerances, now we have a much higher probability of it working if we are somewhat between these two positions.

22:27.220 --> 22:33.540
As that Schlage lock gets worn out, that increases as well significantly.

22:33.540 --> 22:44.140
So a very worn out pin tumbler lock will now accept, even if it's a full height below, it'll still let it work a lot easier.

22:44.140 --> 23:05.220
The way that that actually happens is if we look at a lock here and we cut one height too low, we can see that as that key jiggles and moves in and out of the lock a little bit, it only has to bump this driver pin up a tiny bit for it to actually get lodged in the housing and allow this key to turn.

23:05.300 --> 23:10.000
And so that's something that does not have this hard mechanical constraint of housing.

23:10.000 --> 23:11.800
It just has to bump up a bit.

23:11.800 --> 23:18.760
And that's why if a key is cut too low for a pin tumbler lock, it's a lot more permissive for what it will actually allow.

23:18.820 --> 23:23.540
So for a very worn Schlage lock, these are very close together.

23:23.540 --> 23:33.340
And so being close together means that the probability distributions overlap by a lot, as well as it's quite wide in a worn lock.

23:33.340 --> 23:38.720
We get it to be somewhat permissive as well for what it will accept.

23:42.410 --> 23:44.730
So that's lock tolerances.

23:44.730 --> 23:46.990
That's sort of an interesting aside there.

23:46.990 --> 24:00.550
This particular mathematical model that we've derived is from both theoretical and then empirical confirmation that this is actually how locks behave when the keys are slightly too high and too low.

24:00.550 --> 24:04.350
And this is of course an n-dimensional distribution where there are n pins.

24:04.350 --> 24:09.330
So what I was showing here is a slight simplification of that.

24:09.830 --> 24:16.710
So 243 keys is possible to brute force, but not practical in many situations.

24:16.710 --> 24:20.410
So what can we do to actually reduce that key space even further?

24:20.410 --> 24:24.310
One thing we can possibly do is get a photograph of that key.

24:24.310 --> 24:29.970
So oftentimes you see security guards and users leaving keys lying out on the desk in the public view.

24:29.970 --> 24:42.330
This is one of the most egregious cases of these key watchers with transparent windows behind a publicly accessible desk with the facility's keys visible and photographable through that.

24:42.610 --> 24:47.270
And of course, people like to wear keys on their belt as well, and that can be photographed as well.

24:47.350 --> 24:56.290
If you can get a good enough photograph, you can superimpose these depth and spacing lines and determine directly from the photo what that key code is.

24:56.290 --> 25:08.830
And this is something that I've got another talk coming in the next year or so about, all about how to do this and how to work with poor quality photographs and releasing software to do this as well.

25:08.830 --> 25:10.750
But that's not this talk.

25:11.410 --> 25:21.290
What happens though if that photograph is not great quality and how can we use other information to help deduce what it is?

25:21.290 --> 25:28.750
So here's an example of a vehicle key that's left on a desk photographed at a distance of about 10 feet.

25:28.990 --> 25:31.510
We can try zooming in, but that doesn't do much for us.

25:31.510 --> 25:32.870
This is incredibly grainy.

25:32.870 --> 25:35.630
There is not a whole lot that we can tell from it.

25:35.630 --> 25:37.450
So what can we do?

25:37.890 --> 25:42.930
So let's first recognize that this is a Ford vehicle key.

25:43.110 --> 25:53.450
And by looking it up, we can find that it is eight positions by five possible depths.

25:54.150 --> 25:58.490
And it is a wafer tumbler lock.

25:58.890 --> 26:03.530
And of course, Half-Lights will visit in a few minutes about this.

26:03.530 --> 26:05.230
We will come back to that.

26:05.230 --> 26:11.990
But we have naively now 390,000 possible key differs for this particular key.

26:12.190 --> 26:16.650
Based on the photo, we can't get a whole lot, but we can get something from it.

26:16.650 --> 26:31.790
So we can go on over to our photos tab here and add a rule, basically looking at that picture and saying, well, we know that one pin is a little bit high cut, one is low, and see if we can narrow it down a little bit from there.

26:32.370 --> 26:34.330
So we have eight pins here.

26:34.330 --> 26:44.310
We can see in the middle, these two, this is number four and five, are lining up with the top blank height.

26:44.350 --> 26:50.690
So this four and five, we can be relatively confident even from this poor quality picture is a one cut.

26:50.730 --> 26:54.010
And then six, seven, eight is beyond that.

26:54.010 --> 26:55.750
Six is fairly deep.

26:55.950 --> 27:02.270
It looks to be a three or deeper, but it's not the deepest because we have one that's deeper here.

27:02.270 --> 27:03.690
So this is a three or a four.

27:04.050 --> 27:07.030
And then beyond that, it's fairly shallow.

27:07.030 --> 27:09.550
It might be a one, it might be a two.

27:09.550 --> 27:12.250
It's likely not a three or anything deeper than that.

27:12.250 --> 27:15.830
So we can start adding those rules in.

27:15.830 --> 27:19.750
So four and five are both one cuts.

27:19.830 --> 27:24.510
Six is fairly deep, but not the deepest.

27:24.590 --> 27:31.350
And then seven and eight are fairly high cut, but we don't know exactly what.

27:31.410 --> 27:38.350
Popping back to our picture and looking at the first few pins, we see one, two, and three kind of make this bite pattern here.

27:39.150 --> 27:42.390
So this pin two is fairly deep.

27:42.390 --> 27:46.630
We don't know if it's the absolute deepest, but it's say a three, four, or a five.

27:46.690 --> 27:49.830
And then pin three, well, we know it's not the shallowest.

27:49.830 --> 27:50.810
We know it's not the deepest.

27:50.810 --> 27:52.370
That's about all we can tell.

27:52.790 --> 27:55.450
And pin one, well, we know it's fairly shallow.

27:55.530 --> 27:59.030
So we can add that here as well.

27:59.030 --> 28:01.630
So pin two is quite deep, a three, four, or five.

28:01.630 --> 28:04.950
Pin three, we know it's not the shallowest or the deepest.

28:04.970 --> 28:07.630
And pin one is quite shallow.

28:07.790 --> 28:09.970
And we can add that rule here.

28:10.130 --> 28:15.670
And we now get this 390,000 possibilities reduced to 216.

28:15.750 --> 28:20.730
That's pretty good, but that's still a lot to try.

28:20.730 --> 28:28.970
The other thing that we can look at doing is recognizing that this system is actually on what's called code books.

28:28.970 --> 28:41.870
So this particular type of Ford key is one of only a few different differs that will be manufactured, not all 390,000 possible ones.

28:42.350 --> 28:49.090
And that's just done to make keying the locks up easier at the factory effectively.

28:49.130 --> 28:52.750
So we can add a rule for that as well under code books.

28:52.750 --> 28:57.030
This is a Ford fleet keying system.

28:57.030 --> 29:05.630
And by adding that, we now see that there's only one key that's actually in the code books that follows these rules that we determined.

29:05.730 --> 29:08.590
And that's the 0151X.

29:09.070 --> 29:18.190
And so getting a better picture, if we're able to come back and get one, we would see that it is indeed an 0151X that we were photographing.

29:18.190 --> 29:22.430
And we can see now from this much better picture, we can read off the code.

29:22.570 --> 29:32.670
So we have a two cut here, it's slightly below the blank, followed by a very deep, this is a four or a five, followed by three, one, one, three, two, two.

29:32.790 --> 29:41.250
And so we can see from looking at it here that that is indeed what we found for this particular key.

29:41.250 --> 29:50.370
So that is a combination of both the photograph limitations that we found, as well as knowing that it must be in the code books.

29:50.530 --> 29:55.970
So if you remove this rule, we can see that the code books actually only have 1,700 possibilities.

29:55.970 --> 30:00.890
And that gives us a lot of narrowing down of what that particular key can be.

30:00.890 --> 30:07.250
And in pin eight, it can never be a one depth because it starts to taper off at the tip of the key there.

30:07.250 --> 30:10.710
So a one will not physically fit on that key.

30:11.350 --> 30:21.450
So that's sort of a cool example of combining code books with photographs to determine what a key's final code is.

30:21.970 --> 30:26.750
We can also combine it with these half heights that we talked about before.

30:26.750 --> 30:49.030
So if half heights are available for this particular type of key, if cutting it halfway between a one and a two will work for both a one and a two, we can see the effect that would have, and that would reduce it from 1,700 possibilities to 460 that would try out all possible locks that would be manufactured based on these code books.

30:49.250 --> 30:56.250
And for many vehicle locks, because they're wafer tumblers, they have relatively loose tolerances, that is actually the case.

30:56.250 --> 31:00.210
You have both code books and half heights will work.

31:00.210 --> 31:19.770
And so you have many of what's called try out key sets for vehicle locks, which is a number of keys that will try out most or all of the code book keys that are possible that will let you then determine what key is used in a particular vehicle or a particular fleet of vehicles.

31:20.550 --> 31:25.330
Auto jigglers are sort of the next stage down from that.

31:25.330 --> 31:27.570
And so they are not keys at all.

31:27.570 --> 31:35.590
They allow you to move them up and down and angle them and sort of do some fuzzing to try even more combinations quickly.

31:35.590 --> 31:59.670
And the high quality auto jigglers were somewhat intelligently designed to be effectively these try out key sets, except adding that degree of freedom for up, down, in, out, tilt, tilt, so that we have rather than just, or rather than 80 or 400, we have only 10 of them that can work on many,

31:59.670 --> 32:03.850
many automotive locks and not manufacturer specific either.

32:03.850 --> 32:09.350
And of course, further down that continuum is raking, which works in a similar way.

32:09.350 --> 32:13.410
So what happens if we don't have a key to photograph or other information like that?

32:13.410 --> 32:16.650
Well, then we can decode by looking at the lock itself.

32:16.650 --> 32:22.070
So here's sort of a funny example where the key pin is visible in its entirety through the front of the lock.

32:22.070 --> 32:27.050
And so from this, we can tell the length of the key pin and therefore the depth of the first cut on that key.

32:27.110 --> 32:31.570
We can look deeper in the lock using this device here, which is called a lock scope.

32:31.570 --> 32:36.390
So it's like the autoscopes that are used to look into your ear at the doctor's office.

32:36.390 --> 32:39.590
And they shine light through the back of this lock.

32:39.590 --> 32:44.190
And we can see then every pin through it with a little magnifier that's inside of it.

32:44.390 --> 32:45.850
So this is cool.

32:45.850 --> 32:47.550
We can't tell a whole lot from this.

32:47.550 --> 32:53.710
Wouldn't it be nice if just by looking at the bottom of the pins, we could actually tell how long they were in terms of their total length?

32:54.070 --> 32:56.990
Well, enter colored painting kits.

32:57.470 --> 33:02.690
I kid you not, and they are colored, I kid you not, by length.

33:02.810 --> 33:13.070
So by seeing the color of the pins that we actually look at in this lock scope, we can tell how long our key pins are and therefore the key code.

33:13.810 --> 33:18.350
So that last picture was a locksmith's rekeying version.

33:18.350 --> 33:21.290
This is for an end user and we see colored pins as well.

33:21.290 --> 33:25.490
It makes it a little bit easier to use, but you can read the pins from that.

33:25.730 --> 33:30.110
So here's an example of looking down a sergeant lock with that lock scope.

33:30.110 --> 33:34.310
And we can see there's gold, green, gold, green, gold.

33:34.310 --> 33:38.210
It's a little hard to see at the end, but that's a purple pin at the very end.

33:38.730 --> 33:48.510
Looking at the sergeant chart, we can see that a gold bottom pin must be a one, four, seven, or zero, which is what sergeant calls its 10 depth.

33:48.510 --> 33:55.330
Green is three, six, nine, and purple is two, five, eight.

33:55.330 --> 34:03.410
So based on that, we can actually go ahead and severely limit what the key could possibly be for this particular system.

34:03.650 --> 34:11.010
This is a sergeant system, it has six pins and 10 depths, and we use one base numbering.

34:11.870 --> 34:16.350
And we'll go ahead, and under photos, we can add that particular rule.

34:16.490 --> 34:27.110
And so we tell it that it is a sergeant system and that we have gold, green, gold, green, gold, purple.

34:27.110 --> 34:31.710
And that reduces our key space from a million down to 1728.

34:31.990 --> 34:43.310
It's worth noting, incidentally, that half height is not gonna help us here, even if this lock accepts it, which it doesn't, because half height would not be able to try both of two combinations three apart.

34:43.310 --> 34:48.150
And so we get 1728 as well, with just a slightly squished chart there.

34:48.670 --> 34:55.170
So this is not bad, it's a lot better than a million, but we need to do a bit better than that to get a single working key.

34:55.470 --> 35:02.470
One thing we can notice is that if this pin one is a zero, then pin two cannot be a nine, that would be a max violation.

35:02.590 --> 35:04.670
So sergeant has a max of seven.

35:04.670 --> 35:07.610
We can go ahead and add that on in there.

35:07.830 --> 35:11.430
And so now we've reduced to 1166, that's getting a little bit better.

35:11.690 --> 35:12.850
What else can we do?

35:12.850 --> 35:16.750
Well, remember looking at this lock, we have this shear line visible.

35:16.770 --> 35:22.550
And so that tells us that this is a zero cut in this particular position.

35:22.550 --> 35:28.910
So a very high cut depth on that key.

35:29.070 --> 35:36.250
We can go further and use a lock pick to lift up that first pin and look at the second to see if we can see something similar.

35:36.290 --> 35:38.110
And we don't, but...

35:38.110 --> 35:40.070
So here's the lock pick in there.

35:40.090 --> 35:42.590
But on the third pin, we do.

35:42.590 --> 35:49.670
We can see a shear line at that same position telling us that that third pin is also a one cut.

35:49.670 --> 35:55.750
And we can continue backwards through the lock, seeing that there are not any visible shear lines beyond that.

35:56.090 --> 36:00.450
So how does that apply to the lock that we have here?

36:00.590 --> 36:06.690
Well, we can go to known shear lines and we know that pin one has a one as a shear line, pin three has a one.

36:06.690 --> 36:07.930
We can add that rule.

36:07.930 --> 36:10.890
And now that severely limits our key space down to 44.

36:11.290 --> 36:16.530
Moreover, because we looked all the way back, we know that pin five does not have a shear line at one.

36:16.530 --> 36:20.390
So it's only possibilities are four, seven, and 10.

36:20.830 --> 36:24.490
So we can put that into there.

36:25.250 --> 36:28.250
And now we're down to 32 different keys.

36:28.250 --> 36:30.730
This is something that's very brute forcible.

36:30.730 --> 36:33.130
It's easy to make 32 and try it.

36:33.130 --> 36:37.890
That'll cost us about $10 and take three minutes to try 32 keys out.

36:37.890 --> 36:40.810
Not bad, but we can do better than that.

36:40.810 --> 36:47.150
And the way we can do better than that is impressioning in particular with this extra information that's available to us.

36:47.710 --> 36:55.290
Before we talk about how to impression this particular lock with extra information, let's talk a little bit about how impressioning works in general.

36:55.550 --> 37:00.290
So we put the key in, we put a blank key in.

37:00.290 --> 37:03.470
We cut all zero-bidded, the highest possible cuts.

37:03.690 --> 37:08.330
And when we turn the key, there's a couple pins that bind that don't let the lock turn.

37:08.350 --> 37:14.330
If we turn it really, really hard, then those pins are going to bind really, really hard.

37:14.330 --> 37:25.010
And if we then wiggle the key in and out, up and down a little bit, those pins that are binding really hard are gonna leave a mark on the key that we can then look at.

37:25.490 --> 37:30.430
So if we impression this, one of these pins that's binding is gonna leave a mark.

37:30.630 --> 37:34.870
Can we take the key out and look at that mark and see it's in position two?

37:35.110 --> 37:42.430
So cut two is not a zero cut, because if it were, if that were a shear line, then the pin would not have bound, wouldn't have left that mark.

37:42.590 --> 37:45.910
So we cut it down, put the key in and impression again.

37:46.090 --> 37:52.670
And we take it out and we see now there's no more mark on pin two, but there's one on pin four, which tells us that pin four is binding.

37:52.670 --> 37:53.910
It's not a zero.

37:53.910 --> 37:57.050
We cut it down and we repeat the process.

37:57.550 --> 38:00.270
And so pin four is still leaving an impression mark.

38:00.410 --> 38:09.730
So we file it down one more time, impression it, take it out, pin four is still leaving an impression mark, file it down one more time, take it out, impression it.

38:09.730 --> 38:12.290
And now we see that pin five is the only one binding.

38:12.290 --> 38:16.390
So pin four has stopped leaving an impression mark and pin five is now.

38:16.430 --> 38:28.050
So we know it's not a zero cut, we file it down and then we're going to repeat that process, until when we try to impression and it's the right code, the lock is just going to open.

38:28.590 --> 38:36.830
So that's how impressioning works in general, starting from a blank and ending with any particular lock or with a key for that particular lock.

38:36.830 --> 38:43.350
One piece of software that I'm releasing a modification of this is a little game that you can try.

38:43.350 --> 38:50.470
So you put it in and you could make the lock visible or not as you see fit, impression it and take the key back out again.

38:50.470 --> 38:55.590
And then you can sort of practice your impressioning that way until you eventually get the key for it.

38:55.590 --> 38:57.270
So that's something you might enjoy.

38:57.330 --> 39:01.210
But let's look at how that applies to this particular system here.

39:01.730 --> 39:06.430
If we wanted to impression this lock, so let's start by creating a lock here.

39:07.070 --> 39:17.090
We don't actually need to start with a blank because if we look at our key space, a one, one, one, et cetera, cannot possibly be the code.

39:17.090 --> 39:22.870
The highest cut our code can be is one, three, one, three, four, two.

39:23.190 --> 39:25.910
And in our impressioning tab, it tells us that.

39:25.910 --> 39:29.870
So that's what we actually wanna start by cutting our key to.

39:29.870 --> 39:31.730
One, three, one, three, four, two.

39:31.910 --> 39:34.110
And we put it into the lock.

39:34.330 --> 39:50.670
Now this lock, to give it a couple examples for what our actual code is inside the lock might be a one, six, one, three, four, eight.

39:51.630 --> 39:56.250
So that's what the key is we're ultimately searching for, but of course we don't know that yet.

39:56.810 --> 40:00.050
So we're gonna impression this key and take it out.

40:00.050 --> 40:03.270
And we see that position two is binding.

40:03.390 --> 40:07.570
So position two is not actually the correct cut.

40:08.010 --> 40:13.870
And so what we'll do is scroll on up and say that pin two is not at depth three.

40:13.870 --> 40:18.010
It's not at depth three because it was cut to depth three and it's leaving an impression mark.

40:18.010 --> 40:19.350
So we'll add that rule.

40:19.350 --> 40:22.310
That's telling us to try a six next.

40:22.310 --> 40:26.990
And we know a six is going to work because it's the only position left that pin two can be.

40:27.270 --> 40:29.810
So our impression mark should show up somewhere else.

40:29.810 --> 40:37.090
So we're gonna file our key down to a six depth, put it in and impression it and take it out again.

40:37.090 --> 40:42.550
And we now see that pin five is binding and pin five is now leaving a mark.

40:42.550 --> 40:53.710
So we can scroll on up and tell it that pin five, which was cut to a two has, sorry, not pin five, my apologies, pin six, the last pin.

40:54.090 --> 40:59.290
So pin six that was cut to a two has no shear line there because it leaves an impression mark.

40:59.290 --> 41:02.770
And so we'll add that rule to the system, no shear line there.

41:02.850 --> 41:11.230
And it tells us the next tryout is one, six, one, three, four, five, because five is the next value that pin six can take on.

41:11.830 --> 41:12.910
So we try that.

41:12.910 --> 41:19.510
Pin six, we'll cut it down from a two to a five and we'll put it in and impression it.

41:19.590 --> 41:23.230
And when we take it out, we'll see this impression mark left on pin six.

41:23.230 --> 41:26.690
So we know that pin six is not a five depth either.

41:27.270 --> 41:30.250
And so we'll tell it that, no shear line at depth five.

41:30.290 --> 41:32.710
And so it tells us to try an eight now.

41:32.770 --> 41:35.130
And we can see that this has to be what pin six is.

41:35.130 --> 41:37.370
So if this doesn't work, we've done something wrong.

41:37.370 --> 41:42.490
So we'll file it down to an eight and we'll put our key in and we'll hit impression.

41:43.190 --> 41:46.850
And this time the lock opens because we found the correct code.

41:46.850 --> 41:50.590
So as we can see, one, six, one, three, four, eight.

41:50.790 --> 42:06.230
This was done in only three impressioning steps, whereas it would have taken 19 to get down to this particular code using impressioning with no other information, just going down one at a time at a time.

42:06.230 --> 42:13.470
So very, very powerful tool that will let us decode locks with the impressioning technique.

42:13.550 --> 42:17.570
So let's look at another arrangement that can be useful to us, which is key to like systems.

42:17.570 --> 42:21.130
So password reuse is generally accepted to be a poor form.

42:21.170 --> 42:25.090
Key reuse is common and called key to like and seen in many cases.

42:25.230 --> 42:27.670
So there's a whole big old list here.

42:27.690 --> 42:36.750
Many of them, if you're interested in this, I encourage you to check out Howard Payne and Devia Toloff's amazing talk, This Key is Your Key, This Key is My Key at Hope 11.

42:36.850 --> 42:39.770
And it touches on a whole bunch of these and what they do.

42:39.910 --> 42:44.390
Here's a couple that I've discovered that wasn't mentioned in that talk that I think are interesting.

42:44.410 --> 42:47.170
So one is construction cores.

42:47.370 --> 42:55.970
So if you ever see an interchangeable core that's got a color on it, black, red, or green, that's usually a construction core.

42:55.970 --> 42:59.870
It's just used when the building's under construction and it gets swapped out once it's done.

42:59.870 --> 43:01.470
These are all key to like.

43:01.470 --> 43:10.770
So if you find, say, a green best or a black Schlage, you can look up what the code is and cut a key for that without doing any more decoding.

43:11.030 --> 43:13.610
Traffic controller boxes are like that as well.

43:13.610 --> 43:17.910
This little upper box is for emergency services to manually control the light.

43:17.910 --> 43:20.570
And those keys are universal across North America.

43:20.570 --> 43:23.730
And then this lower keyhole is for maintaining the system.

43:23.730 --> 43:28.890
And there's only a couple of those different keys that are used across North America.

43:28.890 --> 43:31.970
Here's a great example of a bunch of key to like systems.

43:31.970 --> 43:33.890
So we have an enter phone box here.

43:33.890 --> 43:35.310
This is a Miracom box.

43:35.310 --> 43:42.770
So opening it up to service the box, this is a Miracom 549 key, and that's universal for all of these Miracom boxes.

43:42.770 --> 43:51.450
It's also got a postal key here so that the post worker can open the box or can open the door and get in and deliver your mail.

43:51.510 --> 44:02.930
This box beside it is a little key box that the power company uses to get in because presumably this particular facility will have a customer-owned transformer vault somewhere with inside.

44:03.190 --> 44:07.150
We also see these two building-owned keys.

44:07.150 --> 44:12.730
We don't know what they're for, but lots of ways to get through this door, three of which are key to like systems.

44:13.050 --> 44:15.470
Here's an example of a postal lock box.

44:15.470 --> 44:18.550
This one is a Abloy postal lock.

44:18.550 --> 44:21.610
So in Canada, our coastal service uses Abloy.

44:21.610 --> 44:23.190
Very, very good choice.

44:23.190 --> 44:31.730
It's somewhat negated by this door king lock here, which is not only a poor tolerance wafer lock, but it's also key to like.

44:31.870 --> 44:35.710
And these door king keys, any of them will open it.

44:36.190 --> 44:43.590
If it's not something that we already know what the key is for the key to like system, we can determine what that key is by disassembling the lock.

44:43.590 --> 44:48.190
And then once we get the key for one lock, it's gonna work for all of them if they're key to like.

44:48.470 --> 44:53.170
So to do that, we need to get the lock out somehow.

44:53.170 --> 45:06.810
So once the door is open, you can unscrew the retaining screw and then unscrew the lock, at which point we can take off the tail piece and get these pins to shear line somehow, either shimming through the back or picking.

45:06.850 --> 45:10.630
And then we can look at what the pins are on the inside of it.

45:10.710 --> 45:14.210
So in this particular case, we have a lock.

45:14.210 --> 45:16.530
We can see how long these pins are.

45:16.690 --> 45:23.170
And that particular pattern that the pins make, if we invert it, so it's upside down, that's gonna give us what the key looks like.

45:23.170 --> 45:26.130
And so we can see we put the key in and it doesn't need work.

45:26.130 --> 45:30.650
And we can figure out what exactly that key is going to look like from the lock.

45:31.210 --> 45:38.010
If you don't wanna have to shim through the back, you can also take off this brass plate, which is an awful task to do, but it does work.

45:38.810 --> 45:49.530
And if you wanna have a bit more time to do this decoding and disassembly, one thing you can do as well is replace it, temporarily at least, with a lock that looks like this.

45:49.530 --> 45:53.570
And that's going to work no matter what key enters the lock.

45:53.630 --> 46:01.970
So anyone that tries to get in is not going to be blocked and no one's gonna be the wiser while you have the lock out for disassembly.

46:03.370 --> 46:05.070
Metakos are very nice to us.

46:05.070 --> 46:07.590
They have these nice set screws at the top.

46:07.590 --> 46:10.310
And so we can pull that out and dump the pin stack.

46:10.310 --> 46:13.230
And so we can see in this pin stack here, we have a key pin.

46:13.230 --> 46:18.030
We can read both the angle and the depth of it from that.

46:18.030 --> 46:28.670
This one happens to have some master wafers, so it's not key to like, and we'll talk about how to handle that later, but we can see a 25 thousandths of an inch one wafer and a 50 thousand two wafer.

46:28.670 --> 46:42.030
In this case, we only needed to remove these first two pin stacks because we got some information about the lock already and the first two pin stacks were the only things that we needed more information about.

46:42.550 --> 46:48.870
And of course, because of these set screws, we don't have to worry about this awful brass piece or shimming it, et cetera.

46:49.010 --> 46:57.190
If you're interested in this sort of thing, I strongly recommend you check out Molok's amazing talk, Please Do Not Duplicate Attacking the Knox Blocks from DEF CON 26.

46:57.430 --> 47:07.990
It's all about doing attacks like this, taking locks apart and looking at the Knox block systems, which is key to like across many jurisdictions in North America.

47:08.610 --> 47:10.350
So that's key to like systems.

47:10.350 --> 47:22.110
What we can do with that is start to analyze everything that we've looked at so far and figure out how to formalize it and how to determine what the best next step is.

47:22.110 --> 47:25.170
And we can do that by looking at information theory.

47:26.390 --> 47:31.090
So you've likely heard of the concept of the entropy of a password before.

47:31.090 --> 47:33.410
We'll talk a bit about what exactly that means.

47:33.410 --> 47:38.350
So information is stuff we know and entropy is stuff we don't know.

47:38.530 --> 47:42.370
So in the case of a stoplight, it's either red or green and that is information.

47:42.370 --> 47:48.770
That's in the case of red or green, one bit of information because it's a zero or a one, that's ignoring yellow.

47:49.430 --> 47:53.830
When it's a random variable, that's something we don't know and so that's entropy.

47:54.130 --> 48:01.410
And so a key or a password has entropy because we do not know it and we're trying to determine it to get into that particular lock.

48:02.250 --> 48:04.210
So how do we measure the entropy?

48:04.350 --> 48:05.330
So it's in bits.

48:05.330 --> 48:08.550
So a coin flip is a zero or a one, so it has one bit of entropy.

48:08.570 --> 48:16.010
A random number from zero to 255 is eight bits, since eight bits can encode number zero to 255.

48:16.050 --> 48:20.250
A random number one to 10 has 3.32 bits.

48:20.250 --> 48:23.730
Well, how do we have a fractional number of bits?

48:23.730 --> 48:26.130
Well, we can think of it like the following.

48:26.170 --> 48:30.510
We have three random numbers, one to 10, that is a three digit number.

48:30.510 --> 48:34.650
And so that can be encoded with one to a thousand or zero to 999.

48:34.690 --> 48:39.430
And that fits very well into 10 bits, which can encode zero to 1023.

48:39.430 --> 48:41.750
So two to the 10 minus one.

48:42.370 --> 48:48.050
So 10 bits will easily encode zero to 999 with not a whole lot left over.

48:48.050 --> 48:56.710
And so 10 bits divided by three, because we're storing three random numbers inside of it, is 3.33, which is very close to that 3.32 figure.

48:56.710 --> 49:07.670
If we extend the number that we're storing, so instead of three random numbers, we try to store six or nine or a thousand as that tends to infinity, this number tends to 3.32.

49:09.450 --> 49:13.170
This is mathematically represented with a log.

49:13.170 --> 49:28.510
So the entropy of a piece of information can be thought of as the number of bits it takes to write it down, or write down a number from zero to the total value that that information can possibly be.

49:28.510 --> 49:32.230
And so that would be the log base two of that number.

49:32.790 --> 49:43.610
So the number of bits of entropy, which is represented by the Greek letter eta, or eta in modern Greek, for a random variable with n outcomes is just log base two of n.

49:43.610 --> 49:46.550
So a fair coin flip has two possible outcomes.

49:46.550 --> 49:52.090
Log base two of two is, that should not say two bits, that is a typo, one bit.

49:52.230 --> 50:01.470
A random number from zero to 255 is log base two of 256, because zero is not counted here, so , or is counted here.

50:01.470 --> 50:05.470
So that's 256 possible options, which is eight bits.

50:05.530 --> 50:12.310
And a random number of one to 10 is log base two of 10, which is 3.322, what we looked at before.

50:12.710 --> 50:15.550
So a couple of examples of entropy within keys.

50:16.790 --> 50:22.130
That is the number of bits in the piece of information, so the key to the password, once we do have that information.

50:22.370 --> 50:30.030
So an eight character ASCII password, so that's eight bytes times eight bits per byte is 256 bits of entropy.

50:30.510 --> 50:38.290
This, many of you will be screaming at your monitor, is wrong, because some characters are more likely than others.

50:38.290 --> 50:42.050
Some characters are not used at all in most passwords.

50:42.050 --> 50:47.990
And of course, dictionary attacks exist, so certain passwords are more common than others.

50:48.030 --> 50:49.750
And so that does reduce the entropy.

50:49.750 --> 50:52.290
We'll look at why in a little bit.

50:52.350 --> 50:59.990
For a 10 digit passcode, three characters long, assuming all combinations are equally likely, we have 9.97 bits, which makes sense.

50:59.990 --> 51:04.930
A thousand combinations is a little bit shy of 1024, which would be exactly 10 bits.

51:05.210 --> 51:09.310
An EVA MCS, so that's the magnetic coding system key.

51:09.310 --> 51:13.230
It has four rotors and eight positions each for each rotor.

51:13.230 --> 51:18.450
So that's eight to the power of four, 4,096, or 12 bits exactly of entropy.

51:18.450 --> 51:26.770
And a Schlage five pin system has five to the power of 10 or 100,000 combinations, log two of 100,000 is 16.6 bits.

51:26.770 --> 51:32.550
So that's a couple of examples of how much entropy is in a system.

51:32.910 --> 51:39.850
In the software that we have here, it gives you that at the start and at the end of the rules that you've applied.

51:39.910 --> 51:52.330
So in this particular case, if we look at a Schlage system, whoopsies, five pins with 10 possible depths, so 100,000, and then we have 16.6 right there.

51:52.330 --> 51:58.350
And you can play around with that to see what happens as you change the number of depths and pins.

51:59.750 --> 52:07.490
So if there are N possibilities and all possibilities are equally likely, then the entropy is given by log two of N.

52:07.690 --> 52:12.050
But if some possibilities are more likely than others, entropy goes down.

52:12.050 --> 52:21.610
So in a dictionary based attack on passwords, because they follow these dictionaries, it is easier to guess that there's less entropy in those passwords.

52:22.090 --> 52:31.270
And so in the example of keys, we see many key systems avoiding very deep cuts because that makes the key more prone to breaking.

52:32.350 --> 52:36.690
And there's other ways that you can do keys to make it harder to pick.

52:36.690 --> 52:40.550
And so that does slightly reduce the amount of entropy present in your key.

52:40.550 --> 52:43.930
The fact that certain differs are less probable than others.

52:44.130 --> 52:55.450
So to look at a very simple example here, we have a master key that we've decoded as either a 14767 or a 94767.

52:55.450 --> 53:03.510
So looking at these two options naively, we have, or we could say there might be a 50-50 chance of each of these two options.

53:03.510 --> 53:08.010
And so since there's two, it's a zero or a one, this is one bit of entropy.

53:08.130 --> 53:14.570
We can expand this calculation a little bit by looking at the individual probabilities.

53:14.570 --> 53:21.570
So there's a probability of 0.5 of it being 14767 and 0.5 of nine.

53:21.590 --> 53:25.710
So we have minus 0.5 log two of 0.5.

53:25.710 --> 53:27.750
So that's the probability of the first one.

53:27.750 --> 53:31.650
Then the exact same thing, because the probability of the second is the same.

53:31.650 --> 53:35.430
And we do a little bit of arithmetic using our log rules.

53:35.430 --> 53:40.270
And we find that that simplifies to log base two of two or one bit.

53:40.650 --> 53:43.810
The question is though, are these equiprobable?

53:43.810 --> 53:52.650
And so if this were a non-master key, then it might be, but knowing that this is a master key, there's a couple of cues we can take.

53:52.750 --> 53:54.930
So here's our 14767.

53:55.010 --> 53:59.370
This is very typical of what master keys very frequently look like.

53:59.730 --> 54:02.970
When we take this down to a nine, there's a number of problems with it.

54:02.970 --> 54:05.790
One is it has a very deep cut in pin one.

54:05.790 --> 54:08.150
This is prone to breaking off in the lock.

54:08.210 --> 54:18.770
And I generally want to avoid keys breaking off in locks, but especially master keys, because if that gets stuck in there and a bad actor is able to get it out, that's a problem for you.

54:18.770 --> 54:22.650
The other thing that happens here is this is now a very low cut key.

54:22.690 --> 54:28.090
And for reasons we'll talk about shortly, having a low cut master key is something you want to avoid.

54:28.470 --> 54:37.390
So it's highly unlikely that this 94767 would be the code that the locksmith chose to be the master key.

54:37.630 --> 54:46.690
So we can assess perhaps a 95% chance that it's this one cut and a 5% chance that it's this nine cut.

54:46.690 --> 54:49.790
And crunching those numbers, we have 0.95.

54:49.790 --> 54:56.270
So our probability times log two of 0.95 plus 0.05 times log two of 0.05.

54:56.270 --> 55:02.070
And we find our entropy is now 0.2 bits, 0.3 rounding.

55:02.070 --> 55:10.310
So that is significantly lower owing to this high difference in probabilities between these two options.

55:10.310 --> 55:22.570
In the extreme case, so we can sort of intuitively understand this, if one option is certain and the other option is impossible, well, that's zero bits of entropy because there's nothing unknown in this case.

55:22.930 --> 55:40.990
So in general, the entropy where the probabilities are not equal is going to be the sum of each probability times the log two of each probability, and then minus that, because log of a number less than one is going to be a negative.

55:40.990 --> 55:51.450
And so this definition is a fairly beautiful derivation of it that I won't go into now for obvious reasons, but I encourage you to look it up.

55:51.450 --> 56:05.830
So we can now extend this concept and do a little bit more useful with it by looking at joint and conditional entropy and mutual information for different rules in terms of which ones are giving us more and less information.

56:05.890 --> 56:08.630
So let's just get rid of this block to start.

56:08.630 --> 56:16.770
So what we'll do here is consider a very simple system with only three pins and only two possible depths for each.

56:16.770 --> 56:21.030
And so we can see that this has three bits of entropy in it, and that makes sense.

56:21.030 --> 56:26.250
We have a zero or a one, zero, one, zero, one, three times over, so that's three bits.

56:26.250 --> 56:29.310
And we've enumerated all of the eight possible options here.

56:29.390 --> 56:34.370
And of course, log base two of eight is three, so that also makes a lot of sense.

56:35.050 --> 56:41.770
So let's say that we have, let's say a photograph of the key or something, but that photograph only shows us pin one.

56:41.770 --> 56:44.890
And that tells us that pin one is a zero.

56:46.090 --> 56:48.670
So that now tells us, well, pin one is a zero.

56:48.670 --> 56:50.790
We don't know anything about pin two or pin three.

56:50.790 --> 56:52.710
That gives us one bit of information.

56:52.710 --> 56:53.670
It makes sense.

56:53.670 --> 56:56.130
And we're now down to two bits of conditional entropy.

56:56.130 --> 56:59.750
That's conditional on this rule being the case here.

57:00.030 --> 57:02.510
And then we get another photo and it's a bit better.

57:02.510 --> 57:06.070
It shows us that pin one is a zero and pin two is a zero.

57:06.430 --> 57:09.690
And so now we've limited pin one and pin two to zero, zero.

57:09.690 --> 57:14.610
And so we have one bit of entropy left because this rule has given us two.

57:16.170 --> 57:23.770
And if we have a third photograph, say that shows that pin three is limited to zero, but we can't see pin one or pin two.

57:23.990 --> 57:28.450
Now we have the final key because we know that they're all zero, zero, zero.

57:28.930 --> 57:37.490
So this is fairly simplistic and fairly obvious, I assume, but we can analyze it in terms of the information content provided in each of these three rules.

57:37.890 --> 57:51.410
So looking at it intuitively, rule one gave us one bit of information, rule two gives us two, and rule three gives us one, as well as rule two shares one bit with rule one.

57:51.410 --> 57:57.070
In terms of the conditional entropy given by rule one relative to rule two.

57:57.170 --> 58:01.290
So given everything that rule two gives us, rule one gives us nothing extra.

58:01.330 --> 58:12.590
Given everything that rule one gives us, rule two gives us one bit extra, and they share one bit, common to both of them, and rule three, of course, shares nothing with the other two.

58:12.590 --> 58:20.310
So we can analyze this automatically with the software here by clicking calculate conditional entropies down below.

58:20.390 --> 58:24.630
And let's compare rules one and two, just to start.

58:24.630 --> 58:27.210
And we see exactly what I mentioned there.

58:27.210 --> 58:36.070
So rule one, within this circle, we see it gives us one bit, and rule two, within its circle, gives us two bits.

58:36.270 --> 58:39.690
One bit is shared with rule one, and one bit is on its own.

58:39.690 --> 58:46.130
And so that one on its own is, of course, position two, where this is the only one that tells us anything about pin two.

58:47.230 --> 58:51.330
And then the total information given by both is the sum of what's in here.

58:51.330 --> 58:55.110
So that's the joint entropy reduction, which is two bits.

58:55.890 --> 59:02.790
Comparing rule one and rule three, we see that they both give us one bit, and there's nothing shared between them, which makes sense.

59:02.790 --> 59:05.150
We have pin one, pin three, nothing shared.

59:05.430 --> 59:07.450
And we can compare all of them.

59:07.670 --> 59:12.410
And so we see now that within these, we have a total of three bits given.

59:12.410 --> 59:16.990
And for the system that started out as three bits, that will reduce us to a final key.

59:17.410 --> 59:29.070
And those three bits, one of which is shared between rules one and two, one of which is just given by rule two, one of which is just given by rule three.

59:29.070 --> 59:35.090
And then there's nothing, say, that's shared by all three of them, or that's just given by rule one, et cetera.

59:35.970 --> 59:44.970
So this is a fairly useful way of analyzing the rules that we've determined that limit the system and determining which one is most useful to us.

59:44.970 --> 59:47.150
And are we sharing a lot of information?

59:47.150 --> 59:54.510
If we are, that indicates that we're not being particularly efficient with what work we're doing to find out this information put into this system.

59:54.510 --> 01:00:04.410
Ideally, the less shared information, the more total information we're actually going to get out of all of the rules in this particular system.

01:00:05.780 --> 01:00:09.290
So that is conditional entropy.

01:00:09.290 --> 01:00:24.390
Mutual information, by the way, is the term that we use to talk about the information that is, well, mutual between two different random variables, or in this case, two different rules that impose a constraint on the system.

01:00:27.730 --> 01:00:40.590
So in the case that we looked at before with this 0151X key, we have the conditional entropy given by the code book is a lot, almost nine bits, which makes sense.

01:00:40.590 --> 01:00:44.830
We're going from 390,000 to 1,700 possibilities.

01:00:44.910 --> 01:00:52.870
And given by the photo is a fair bit as well, because we were able to determine some severe limitations on many of the pins that exist.

01:00:52.870 --> 01:00:55.150
And there's not a lot of shared information.

01:00:55.150 --> 01:01:03.790
The result of that is between these two rules, they give us all of the entropy that existed in that particular key.

01:01:04.790 --> 01:01:07.430
There's a good reason that they don't share a lot of information.

01:01:07.430 --> 01:01:12.090
And that's because, well, what is the uncertainty that exists in a photo?

01:01:12.090 --> 01:01:15.470
Well, the uncertainty is, you know, is this a two or a three?

01:01:15.470 --> 01:01:17.810
You know, is one position off?

01:01:17.990 --> 01:01:21.850
In the case of a code book, what they do with code books is very different.

01:01:21.850 --> 01:01:29.570
They're not going to make a code that's off by just one cut and one pin from another item in the code book.

01:01:29.570 --> 01:01:37.430
They're all going to be wildly different if you're reducing 390,000 possible differs into 1,700 in the code book.

01:01:37.430 --> 01:01:45.690
So because they're wildly different, the information given to us by the code book is very, very different than the information given by the photo.

01:01:45.690 --> 01:01:47.430
There's not a lot of overlap.

01:01:47.430 --> 01:01:56.710
And as a result there, these two rules put together are very useful to give us a lot of information about this system.

01:01:56.710 --> 01:02:01.750
So we've talked about loads of techniques to determine the key for a lock when we don't have a key at all.

01:02:01.750 --> 01:02:10.170
How about if we have a key for some lock on some master system, and we want to turn it into a grand master key that's going to work for all of those locks?

01:02:10.170 --> 01:02:15.090
To understand how to do that, let's look a little bit at how mastering works in general.

01:02:15.090 --> 01:02:19.330
Any lock on a master system is going to accept multiple keys.

01:02:19.330 --> 01:02:23.490
And it does that by having more than one shear lines in at least some of the pins.

01:02:23.590 --> 01:02:26.750
So in this case, we have two shear lines in every pin stack.

01:02:26.750 --> 01:02:33.670
One of these shear lines in each pin stack is for the change key, and one is going to be for the master key.

01:02:33.670 --> 01:02:40.850
So there's two different shear lines, and a different one is always gonna be used, one for change and one for master.

01:02:41.310 --> 01:02:46.610
Master key actually is necessary in the context of multiple locks.

01:02:46.690 --> 01:02:53.350
So in here we have Alice's lock and her key A1, and it's going to work in her lock.

01:02:54.210 --> 01:03:01.830
And we're also going to have a sub master, MKA, that will work in her lock and a grand master.

01:03:01.850 --> 01:03:04.330
But Bob can't put his key in her lock.

01:03:04.330 --> 01:03:05.710
It's not going to work.

01:03:05.710 --> 01:03:09.450
It binds in pin three, and Charlie's is completely off.

01:03:09.450 --> 01:03:11.290
It's also not going to work.

01:03:11.290 --> 01:03:13.330
So that's what works in Alice's lock.

01:03:13.330 --> 01:03:21.010
In Bob's lock, Alice's key is not going to work because it's not the right key.

01:03:21.010 --> 01:03:22.270
It's just a change key.

01:03:22.350 --> 01:03:24.730
But Bob's key, of course, will.

01:03:25.530 --> 01:03:27.170
Charlie's key won't.

01:03:27.390 --> 01:03:31.150
And the master MKA will, because Bob is on the A system.

01:03:31.150 --> 01:03:32.390
He's A2.

01:03:32.650 --> 01:03:36.530
And the grand master is going to work as well.

01:03:37.070 --> 01:03:39.770
In Charlie's lock, he's on the B system.

01:03:39.770 --> 01:03:43.150
So MKA is not going to work.

01:03:45.010 --> 01:03:50.210
Alice's key, of course, and Bob's key are both also not going to work.

01:03:50.410 --> 01:03:52.210
Charlie's key will, of course.

01:03:52.510 --> 01:03:55.610
And the grand master will as well.

01:03:55.810 --> 01:04:11.530
So what we have is a two-level hierarchy system where we have a master key MKA that works for Alice's and Bob's lock, which are on the A system, but not for Charlie's, which is on the B system, and a grand master key that works for all of them.

01:04:11.550 --> 01:04:18.090
The way that this happens is the grand master key uses the grand master shear lines in all positions on all locks.

01:04:18.310 --> 01:04:24.930
The MKA uses the grand master shear lines in just these last three positions, but not the first two.

01:04:24.930 --> 01:04:28.150
So that way you can tell, is this on the A system?

01:04:28.350 --> 01:04:31.270
And all A system locks start with 3-1.

01:04:31.270 --> 01:04:35.110
So Alice's key does as does Bob's key.

01:04:35.110 --> 01:04:42.770
It starts with 3-1, and therefore MKA, which also starts with 3-1, is going to work on Bob's lock.

01:04:42.770 --> 01:04:52.710
If we try MKA in Charlie's lock, it's going to work on the last three pins because MKA is at the master level on these three pins.

01:04:52.710 --> 01:05:03.850
Notice that it shares the last three pins with the grand master key, but it is not going to work in Charlie's lock because MKA is not the master depth in these first two pins.

01:05:03.850 --> 01:05:06.710
We need the grand master key for that.

01:05:06.710 --> 01:05:21.990
So we have a multi-level mastering system that allows certain master keys to open only some locks, the individual keys only open their own, and a top-level master key that opens everything.

01:05:22.070 --> 01:05:25.650
So that is an example of a three-level system.

01:05:25.650 --> 01:05:29.370
This is two-level with just a master and change keys below it.

01:05:29.370 --> 01:05:30.910
This is what we just looked at.

01:05:30.910 --> 01:05:38.610
So a grand master key under which we have MKA, and there would be hypothetically an MKB as well, and then change keys under that.

01:05:38.610 --> 01:05:42.630
So here's Alice and Bob, and Charlie is somewhere over here.

01:05:42.830 --> 01:05:51.930
We can have higher levels, and this requires splitting up the pins more in the way that we showed you, or using secondary locking elements.

01:05:53.230 --> 01:06:02.190
So looking at our sergeant lock again, it had this visible shear line here, and above it is this red pin.

01:06:02.290 --> 01:06:06.970
A red driver pin is only used for key pin 456.

01:06:06.970 --> 01:06:10.990
We see that this is a zero, so we know that it's actually a master pin.

01:06:10.990 --> 01:06:16.710
So we can start to determine what the other shear line is in this particular sergeant lock.

01:06:16.710 --> 01:06:24.730
And once we know what both shear lines are, we can then start to determine which one is going to be the master and deducing the master key from that.

01:06:24.810 --> 01:06:44.490
When we lift up the first two pins and see that the master wafer on pin three is gold, we can do the same thing and determine that the second shear line is going to match one of three, four, or eight, plus the one that we know is in there already.

01:06:45.790 --> 01:06:54.350
If we have a lock on a master system and a key for that lock, we can use that key to actually disassemble the lock.

01:06:54.350 --> 01:07:00.410
And it's a whole lot easier because we can use the key to open the door and to then unscrew the lock from an open door.

01:07:00.410 --> 01:07:04.790
We can also put the key in and use it to remove the core from the lock.

01:07:04.790 --> 01:07:08.250
And then we can look at the pins and see what they actually say.

01:07:09.030 --> 01:07:14.450
So to look at a demo, in this case, we have our mastered system and our change key here.

01:07:14.710 --> 01:07:20.790
And the mastered pin depths that we find are two, eight, two, four, et cetera.

01:07:20.790 --> 01:07:23.390
And we get this for reading these pins here.

01:07:23.630 --> 01:07:36.390
If we put that into our analysis software, two, eight, two, four, three, five, et cetera, we find that now the master key can take on one of each of these two positions in the lock.

01:07:36.390 --> 01:07:38.990
And so there's five bits of entropy, which makes sense.

01:07:38.990 --> 01:07:41.910
There's two positions in five pins.

01:07:41.910 --> 01:07:49.210
And that gives us 32 possible keys that could work as the master key for this locking system.

01:07:49.450 --> 01:07:53.350
We can, of course, create all 32 and try them.

01:07:53.350 --> 01:08:00.150
We can create only some, 10, and then file them down until we've tried all 32 of these.

01:08:00.150 --> 01:08:09.690
But we can do better than that because we have the change key code and we know that it's a change key, two, four, five, three, one.

01:08:09.690 --> 01:08:17.890
And so we know that whichever shear lines that change key interacts with when it's using the lock is not going to be the master shear lines.

01:08:17.890 --> 01:08:21.330
Therefore, the other shear lines will be the master.

01:08:21.730 --> 01:08:48.250
So if we take eight, two, three, sorry, if we take a change key, two, four, five, three, one, and we put that into our analysis software, so known change key, two, four, five, three, one, it's going to remove two, four, five, three, and one from the possible depths that this master key could be.

01:08:48.250 --> 01:08:55.990
And it's going to leave us with the other remaining one in each pin stack, which will be a single master key left, eight, two, three, nine, nine.

01:08:55.990 --> 01:09:01.370
And in fact, that is what we find as the master key in this particular system.

01:09:01.490 --> 01:09:03.290
So that's pretty neat.

01:09:03.630 --> 01:09:13.790
Given just a key for a mastered lock and access to the lock itself, we can actually derive the master key entirely from that.

01:09:13.910 --> 01:09:27.890
The other thing we can do if we don't want to disassemble locks is we can combine information from a number of these low-level change keys and use that to determine what the master key could possibly be in a system.

01:09:28.110 --> 01:09:36.730
So let's say we have a Schlage system, so five pins and 10 depths each, and Schlage is zero base numbering.

01:09:37.530 --> 01:09:42.150
The master key in this system could be any one of a hundred thousand possibilities.

01:09:42.410 --> 01:09:47.630
If we know what one change key is, let's say it's two, six, three, five, zero.

01:09:49.170 --> 01:09:52.250
And we go ahead and add that as a rule.

01:09:53.950 --> 01:09:58.110
We now have, instead of 10 to the five, we have nine to the five.

01:09:58.110 --> 01:09:59.930
So a little better, but not great.

01:10:00.370 --> 01:10:13.430
What we do see though is that in a Schlage system, remember I talked about how if we have a pin that's one too low or a little bit too high, the lock might still accept it for a very worn out lock.

01:10:13.430 --> 01:10:20.710
And that would be a bad thing for a lock to accidentally accept a key that's not a master key as if it were.

01:10:20.870 --> 01:10:24.970
So what Schlage does to avoid that is uses what's called the two-step system.

01:10:25.410 --> 01:10:36.490
Every position that any key in this system will take in pin one is going to be even, pin two will be even, pin three will be odd, et cetera.

01:10:36.490 --> 01:10:47.490
So we're always skipping every other depth to make sure that we don't have anything that's too close and is going to create problems with keys operating locks they're not supposed to.

01:10:48.030 --> 01:10:54.030
So what that means when we turn on the two-step system here is it severely limits our key space.

01:10:54.330 --> 01:11:01.850
Now pin one must be even, so zero, two, four, six, eight, but it can't be a two because that's what our change key is.

01:11:01.850 --> 01:11:08.270
And we do that for the rest of the pins and we get 1024 possibilities, so four to the power of five.

01:11:08.630 --> 01:11:11.290
We can get another change key.

01:11:11.770 --> 01:11:14.590
And so this is going to be two-step as well, of course.

01:11:14.790 --> 01:11:19.790
So that's, let's say, six, four, one, three, two.

01:11:19.790 --> 01:11:24.030
If we have another person conspiring to get in on this plan to derive the master key.

01:11:24.030 --> 01:11:27.290
And now we have only three possibilities each.

01:11:27.290 --> 01:11:37.330
And if two more people sign on, so four, two, seven, nine, six, and we've eliminated even more of the possibilities.

01:11:37.650 --> 01:11:43.230
And finally, eight, six, three, one, eight.

01:11:43.690 --> 01:11:46.970
And we've now got it down to only four possible master keys.

01:11:46.970 --> 01:11:51.430
So we could absolutely just make these four and try them out and hope that one is going to work.

01:11:51.610 --> 01:11:55.130
Well, we know one's going to work, but we can do better than that.

01:11:55.330 --> 01:11:58.130
We know that pin one is a zero cut.

01:11:58.250 --> 01:12:02.550
Pin two is a zero or an eight, but an eight is a max violation.

01:12:02.550 --> 01:12:05.190
It's too far from pin one, which is zero.

01:12:05.190 --> 01:12:07.110
So we know it's zero as well.

01:12:07.450 --> 01:12:14.770
And now if you look at pin three, it could be a five or a nine, but a nine now is too far from a zero, which we know pin two is.

01:12:14.770 --> 01:12:19.890
So in fact, the master key is going to be 00574.

01:12:19.890 --> 01:12:24.710
And if we add this max rule of seven, we find that that's the case.

01:12:24.750 --> 01:12:34.950
So by combining these multiple change keys, we've been able to derive the master key without taking a lock apart, just by using the information on those change keys.

01:12:35.230 --> 01:12:42.810
From an information theory perspective, we can calculate these conditional entropies from the rules that we've been looking at.

01:12:42.810 --> 01:12:46.590
And we see that we have a lot of shared information between them.

01:12:46.590 --> 01:12:54.810
That's because each of these rules tells us that it's on a two-step system, which knocks out one out of every two position in every single pin.

01:12:54.810 --> 01:13:05.090
So that's a lot of information that gives us, four and a half bits, as well as we're knocking out an additional depth from each pin from each of these keys that we have.

01:13:05.090 --> 01:13:06.930
And so that's these two bits here.

01:13:06.930 --> 01:13:15.610
So between all that, it gives us a lot of information that we can then use to determine what that master code actually is.

01:13:15.610 --> 01:13:27.350
So we can actually derive the master key for a system using just one lock and one key for that lock without ever taking that lock apart, using a technique called Wright's amplification.

01:13:27.350 --> 01:13:29.430
So this has been known to locksmiths for decades.

01:13:29.630 --> 01:13:35.610
And it was first made known in the InfoSec community with the 2003 paper by Matt Blaze.

01:13:35.650 --> 01:13:38.190
The general technique looks like this.

01:13:38.190 --> 01:13:40.510
So Alice has a key for her lock.

01:13:40.510 --> 01:13:42.210
And of course it works on her lock.

01:13:42.210 --> 01:13:49.290
And she knows that the master key, whatever it is, is going to operate on different shear lines than her key does.

01:13:49.290 --> 01:13:52.970
So she needs to find what the other shear lines are in her lock.

01:13:52.970 --> 01:13:58.870
The way she can do that, is while looking at her key, it has a zero cut in pin three.

01:13:58.870 --> 01:14:05.930
So that's a good place to start because we can start varying what that depth is just in pin three.

01:14:06.310 --> 01:14:08.970
And if we leave everything else to say, it's going to work.

01:14:08.970 --> 01:14:12.630
So if the lock does not open, it's only because of the pin three.

01:14:12.630 --> 01:14:15.670
And if it does, we know we found a shear line in pin three.

01:14:16.130 --> 01:14:18.350
So cut zero is what her key is.

01:14:18.350 --> 01:14:20.250
So it's definitely going to work.

01:14:20.250 --> 01:14:21.950
She brings it down to a cut one.

01:14:21.950 --> 01:14:23.150
Can we try it?

01:14:23.290 --> 01:14:24.670
And it doesn't work.

01:14:24.670 --> 01:14:29.390
So she pulls it out and tries a cut two and tries it in her lock.

01:14:29.750 --> 01:14:31.230
And it does work.

01:14:31.290 --> 01:14:37.190
So now Alice knows that she's actually deduced the master shear line in pin three.

01:14:38.950 --> 01:14:42.970
And that's because it's the other shear line that works in her lock.

01:14:42.970 --> 01:14:45.070
So she can take her modified key.

01:14:45.070 --> 01:14:50.930
So Alice's key and file it down to a two and try it in Bob's lock.

01:14:50.930 --> 01:14:55.930
And it also works because Bob's lock is very close to hers on the same system.

01:14:55.930 --> 01:14:57.990
Bob is a two, she's a one.

01:14:59.150 --> 01:15:01.810
Alice can then go and take her modified key.

01:15:02.130 --> 01:15:09.450
So we take Alice's key and we modify it from a zero down to a two.

01:15:09.510 --> 01:15:11.610
And we can try it in Charlie's lock.

01:15:11.610 --> 01:15:13.610
And it doesn't work, which is no surprise.

01:15:13.610 --> 01:15:15.650
Charlie's lock is B34.

01:15:15.650 --> 01:15:17.650
It's very far from Alice's.

01:15:17.730 --> 01:15:20.710
And she's only found one of the master deaths.

01:15:20.710 --> 01:15:22.870
So she's going to need to repeat this.

01:15:23.130 --> 01:15:26.710
Her new sub master key is 31234.

01:15:27.350 --> 01:15:36.210
She can get a new key cut that's at 01234 and try the zero cut to see if it might be a shear line.

01:15:36.210 --> 01:15:38.030
And as it turns out, it is.

01:15:38.510 --> 01:15:44.050
So we now have a master death in pin one and pin three.

01:15:44.050 --> 01:15:48.990
So now we get a key cut 00234.

01:15:49.290 --> 01:15:50.750
And we try that.

01:15:51.790 --> 01:15:54.390
It does not work in her lock.

01:15:54.390 --> 01:15:58.870
So she pulls it out and files it down to a one to try the next position.

01:15:59.410 --> 01:16:04.450
And of course it does work, which we knew because that was what her key was originally.

01:16:04.450 --> 01:16:08.170
So we take it down to a two and we try it.

01:16:08.270 --> 01:16:09.890
It doesn't work.

01:16:10.550 --> 01:16:13.870
Take it down to a three, try that in her lock.

01:16:13.870 --> 01:16:15.030
And it does work.

01:16:15.030 --> 01:16:24.730
So now we found the master depths for pin one, two, and three in Alice's lock by finding the other shear lines.

01:16:24.730 --> 01:16:26.210
We can keep going.

01:16:26.790 --> 01:16:27.790
03234.

01:16:27.790 --> 01:16:32.050
We're going to get a new key cut with four as the highest.

01:16:32.050 --> 01:16:37.870
So 02304, and we'll put that in.

01:16:37.930 --> 01:16:40.130
And she tries it and it doesn't work.

01:16:40.130 --> 01:16:42.850
And so she files it down to a one, tries it.

01:16:42.850 --> 01:16:44.010
It doesn't work.

01:16:44.010 --> 01:16:46.150
Two tries, doesn't work.

01:16:46.170 --> 01:16:47.830
Three tries.

01:16:47.830 --> 01:16:53.630
It does work, but we sort of knew that that was what her key was originally.

01:16:53.630 --> 01:16:55.050
So we keep going.

01:16:55.050 --> 01:16:58.490
A four, we try it, doesn't work.

01:16:58.530 --> 01:17:01.270
File it down to a five, we try it and it does work.

01:17:01.270 --> 01:17:07.950
So now Alice has found the master depth in pins one through four using her lock.

01:17:08.370 --> 01:17:12.590
And so now we have 0325 is our master depths.

01:17:12.590 --> 01:17:17.050
And then we want to find out what the master is in pin five as well.

01:17:17.050 --> 01:17:20.110
So we put it to a zero, but that's a max violation.

01:17:20.110 --> 01:17:23.330
So we put it to a one and we try that.

01:17:23.330 --> 01:17:25.510
And it does not work.

01:17:25.770 --> 01:17:28.690
You put it down to a two and it does work.

01:17:28.690 --> 01:17:30.550
And Alice's key originally was a four.

01:17:30.550 --> 01:17:35.770
So we now have a two as our master depth in pin five.

01:17:35.770 --> 01:17:40.670
So our master code should be 03252.

01:17:41.030 --> 01:17:44.630
Alice can try this in Bob's lock as a sanity check.

01:17:49.270 --> 01:17:53.310
So 03252, and she tries it and it does work.

01:17:53.330 --> 01:17:54.970
So that's a very good sign.

01:17:54.970 --> 01:17:57.290
And then Charlie's lock is the real test.

01:18:02.510 --> 01:18:03.630
03252.

01:18:04.630 --> 01:18:08.310
And she tries that and it works in Charlie's lock as well.

01:18:08.390 --> 01:18:33.030
So by sweeping all possible depths in each pin within Alice's lock and seeing if it still works on each depth, Alice is able to discover what the other shear lines are in her lock by modifying her currently working key and in doing so deduce the grand master key that is going to work in every lock on this system.

01:18:33.150 --> 01:18:38.850
So one additional interesting lock configuration that gives us a little bit of information is a construction keyed system.

01:18:38.850 --> 01:18:41.810
So let's take a look at what that actually is.

01:18:41.970 --> 01:18:47.930
In a construction lock system, we have instead of one master wafer, a smaller ball bearing.

01:18:47.930 --> 01:18:54.450
And that acts as a master wafer while the building is under construction, being used by the construction master key.

01:18:54.450 --> 01:18:58.450
So it goes in and it works and that ball bearing is below the shear line.

01:18:58.450 --> 01:19:01.870
And so it operates as a master wafer.

01:19:01.890 --> 01:19:14.130
What happens though, when construction is done and the user comes along with the grand master key is it is a little bit higher by that ball bearing than the construction master.

01:19:14.190 --> 01:19:18.090
And it goes in and it lifts that ball bearing above the shear line.

01:19:18.090 --> 01:19:24.010
Well, what happens then, the construction core is a little bit special as well.

01:19:24.390 --> 01:19:35.550
It contains a number of holes in it that are going to line up with the top of the pin stack when that core starts to get turned.

01:19:35.550 --> 01:19:46.770
That ball bearing that's now in the upper pin stack is actually going to get dropped into one of these holes, at which point it stays trapped there forever.

01:19:49.310 --> 01:20:05.510
So in the lock, when the new user of the building turns this key, this ball bearing is going to drop out and it stays gone forever, or it stays trapped in that hole, at which point it's like that ball bearing or that shear line no longer exists.

01:20:05.510 --> 01:20:17.290
So the grand master key continues to work, but if the construction worker ever comes back and tries to get the construction master to work, it's not going to, it's going to bind in this shear line because that ball bearing is gone.

01:20:18.090 --> 01:20:20.130
So there's two things we can do with this.

01:20:20.170 --> 01:20:30.750
One is, if a construction worker still has the construction master and wants to make it work again, all he has to do is know that there was a ball bearing in pin one and its depth was four.

01:20:30.970 --> 01:20:39.070
And so from six, four, nine, four, three, we can get a key cut to two, four, nine, four, three.

01:20:39.070 --> 01:20:40.930
So that's four higher in pin one.

01:20:41.330 --> 01:20:47.810
And that is now going to match the new GMK shear line and it is going to work.

01:20:47.810 --> 01:21:04.050
The second thing that we can notice is that for our new grand master key, it can't be deeper than a cut six, because if it is deeper than a cut six, then the construction key that must have gone with it is four less than that.

01:21:04.050 --> 01:21:11.090
Well, four less than six is a 10 cut, and that's not possible in this particular system, which goes from one to 10.

01:21:11.750 --> 01:21:15.330
So we can add that to our rule set.

01:21:15.330 --> 01:21:19.270
And we have 10,000 possibilities reduced to 80,000 after max.

01:21:19.390 --> 01:21:29.850
And we add a construction key and rule that in pin one, there was a ball bearing with thickness four and the master construction key also has to have a max of seven.

01:21:30.150 --> 01:21:32.730
And it'll take the computer a few seconds to crunch that.

01:21:32.730 --> 01:21:41.250
And we see that these bottom four positions cannot be that master key because there would have been no possible construction key to make from it.

01:21:41.390 --> 01:21:54.690
The max requirement for the construction key and the grand master key with a difference of four in pin one further limits what lock or what key differs are available to be our master key.

01:21:55.510 --> 01:21:58.510
So that's one interesting type of system.

01:21:58.510 --> 01:22:01.950
Another is what's called interchangeable core systems.

01:22:02.070 --> 01:22:06.810
So if you have ever seen locks that look like this, they have a figure eight shape around them.

01:22:06.810 --> 01:22:09.910
That's because that figure eight shape is actually removable.

01:22:09.910 --> 01:22:16.630
And there's a little locking log that keeps it in place, but with a special key called a control key, we can remove it.

01:22:16.830 --> 01:22:25.610
So the way that this works is we have our IC core that looks something like this.

01:22:25.870 --> 01:22:34.430
And when we normally operate it, it's going to turn just the plug and the core stays in place.

01:22:34.430 --> 01:22:42.530
But when we use a special control key, it's going to turn slightly and retract this IC locking log.

01:22:43.410 --> 01:22:47.390
The way that that works is if we look at

01:22:50.610 --> 01:22:55.310
just the core and the IC collar, we have two shear lines.

01:22:55.310 --> 01:23:04.430
One is matching where the plug is, and one is a little bit higher, and it's going to be just for the IC collar.

01:23:04.430 --> 01:23:13.630
So if our pins have a shear line all matching the plug, then the plug is going to turn, but the collar will not.

01:23:13.630 --> 01:23:16.730
And so this is a standard unlocking of this lock.

01:23:16.730 --> 01:23:35.730
If however, the pins extend up and we have a shear line across these two pins, and then the upper shear line on the IC collar, and then these two as well, then what happens is our interchangeable collar gets retracted and it allows us to remove this particular lock.

01:23:36.570 --> 01:23:44.230
This is very interesting when we look at systems that do not have an IC collar that extends across all the pins.

01:23:44.230 --> 01:23:51.170
In this case, it only uses pins three and four, and that creates a number of interesting properties.

01:23:51.790 --> 01:23:57.710
So one of those properties is, let's make this into a Medeco system.

01:24:01.100 --> 01:24:03.860
We can see this collar here.

01:24:03.960 --> 01:24:10.180
And so we have this lower shear line with the plug and this upper shear line for the IC collar.

01:24:10.180 --> 01:24:15.920
And that's what we're going to look at when we examine how these locks work in terms of the bidding.

01:24:18.180 --> 01:24:27.260
So what's powerful about how they work in terms of the bidding, in terms of getting us information, is the way many locksmiths do it up.

01:24:27.260 --> 01:24:37.240
And so we'll use Medeco as an example, because as we'll see, it creates a very restricted set of possible master keys for IC core systems in many, many cases.

01:24:37.240 --> 01:24:47.440
So we have our change key and we put it into the lock and it unlocks to the regular shear line.

01:24:47.440 --> 01:24:50.760
And so we turn the key, it unlocks regularly.

01:24:50.840 --> 01:25:02.740
And our master key is completely different bits, of course, completely different heights, but it also unlocks to our regular shear line and the interchangeable shear line binds.

01:25:02.740 --> 01:25:04.980
So that does not actually open.

01:25:04.980 --> 01:25:15.560
However, when we put in our core remove key, it now binds between the core and the IC collar, but has a shear line at the top of the IC collar.

01:25:15.800 --> 01:25:22.440
So when we turn that, it's going to turn the IC collar and release it and allow us to remove that IC core.

01:25:22.440 --> 01:25:30.260
And we see now that it works on this upper shear line, as well as, of course, the lower ones have to work for the plug to turn as well.

01:25:31.360 --> 01:25:52.980
What many locksmiths do in order to avoid having to have multiple shear lines in a pin stack, and also avoid limitations on the mastering system, is they will have the change key, or sorry, the core remove key, simply be three positions higher than the master key in those two IC collar control pins.

01:25:52.980 --> 01:25:55.380
It doesn't have to be done this way.

01:25:55.600 --> 01:25:58.260
We could do something a little bit different.

01:25:58.260 --> 01:26:11.660
We could have our core remove key, say be something a bit lower, and then have our core control position be at an eight cut.

01:26:11.660 --> 01:26:16.140
So that wouldn't be ever possible to create a key that deep, but it will remove the core.

01:26:16.700 --> 01:26:25.800
But many locksmiths don't do that because it requires more pins, as well as it restricts the size of your mastering system.

01:26:25.800 --> 01:26:28.480
And this is true, particularly for Medeco.

01:26:29.040 --> 01:26:41.760
We see empirically about two thirds of the time this being done with the grandmaster key and the core remove key just being three positions different in those two middle positions.

01:26:42.180 --> 01:26:51.700
In Medeco, that becomes incredibly powerful actually for deducing what the master key is going to be.

01:26:52.300 --> 01:27:03.260
So in a 12 cut Medeco key, so Medeco can have two cuts, double cuts in some positions or all of them to create a high level master key.

01:27:03.260 --> 01:27:07.120
And we'll talk a little bit more later about what that specifically means.

01:27:07.120 --> 01:27:11.440
But because these double cuts are so wide, the max is very small.

01:27:11.440 --> 01:27:15.680
It's a two between a double cut and a double cut.

01:27:15.680 --> 01:27:22.180
And so that already, that max of two severely limits what a Medeco system can take on.

01:27:22.180 --> 01:27:30.700
So Medeco system would have six depths, usually six pins and it has a max of only two.

01:27:32.040 --> 01:27:40.060
And so that reduces us from 46,000 down to only 7,300 possible combinations.

01:27:40.060 --> 01:27:59.060
But what the IC core does is significantly more restrictive because if we want to make the IC control key three higher than the master key, that means that the master key can't be a one, two or three in pins three and four.

01:27:59.480 --> 01:28:02.400
And so we'll add that rule there as well.

01:28:02.420 --> 01:28:07.160
And the master control key has to adhere to max in addition.

01:28:07.160 --> 01:28:12.300
So we'll see the effect that that has when we add this rule and it'll take a second to compute.

01:28:12.840 --> 01:28:19.080
And so what we see is, these three positions cannot be held by pins three or four in the master system.

01:28:19.080 --> 01:28:22.060
So the master is forced down to four, five and six.

01:28:22.160 --> 01:28:26.860
In addition, pin two can't be a one because that's a max violation.

01:28:26.860 --> 01:28:28.580
Master must be four or lower.

01:28:28.580 --> 01:28:31.740
So it can't go up three, the max is two.

01:28:32.180 --> 01:28:41.340
Pins six or pin two and pin five can't be a six depth because that would be a max violation for the interchangeable core control key.

01:28:41.340 --> 01:28:45.400
If our grand master key is the deepest, it's a six cut.

01:28:45.400 --> 01:28:48.700
That means our IC core is three higher or a three cut.

01:28:48.700 --> 01:28:54.080
And we can't have a six beside a three in our interchangeable core master key.

01:28:54.080 --> 01:29:00.120
So that significantly reduces the key space available in these types of medical systems.

01:29:00.260 --> 01:29:03.520
Right now, it's down to 784.

01:29:03.640 --> 01:29:07.600
It gets even more restricted than that for the following reason.

01:29:08.080 --> 01:29:14.580
It's generally a good idea to have our master key use at least one pin in the highest position.

01:29:14.580 --> 01:29:20.800
And that way we can make sure that none of our change keys will be able to be filed down into a master key.

01:29:20.800 --> 01:29:27.640
We could have one a bit lower, but that's then gonna restrict how large our master system can grow while adhering to that rule.

01:29:27.740 --> 01:29:39.320
If we look at the limitations imposed by this particular system, we'll see that there's only two places that that one cut can go, pin one or pin six.

01:29:39.340 --> 01:29:53.160
So if we add a requirement that one pin must be high cut, and it'll take a minute to compute that as well, we're gonna see that we're now down to 159 possible master keys.

01:29:53.160 --> 01:30:01.540
That is a significant limitation, and that's given very little information about our Medeco system.

01:30:01.540 --> 01:30:14.160
It's given that we have a large facility, so we can assume that they were planning for potentially needing to expand to a master key that's double cut in all positions.

01:30:14.300 --> 01:30:19.260
And we see at least one interchangeable cord somewhere on that system.

01:30:19.420 --> 01:30:20.720
And that's it.

01:30:21.220 --> 01:30:30.660
Knowing those two things, we can infer that with about a two thirds probability, our master key is going to be limited to one of these 159.

01:30:30.660 --> 01:30:42.400
It gets even less than that, because it usually makes sense to put your one depth in pin one, and that way the key is nice and sturdy, it's not gonna break.

01:30:42.400 --> 01:30:48.260
We don't wanna put a very deep cut in pin one, or that grand master key is liable to break off.

01:30:48.520 --> 01:31:01.560
And so when we add that particular requirement, it then is only 84 differs that follow through in pin one, and we can see max restricts this incredibly tightly.

01:31:01.580 --> 01:31:12.660
So there's the 84 possible situations that could exist if locksmiths do what a lot of them do when designing medical systems, which is follow these constraints.

01:31:12.660 --> 01:31:15.320
It limits the key space significantly.

01:31:15.320 --> 01:31:16.620
Now they don't need to.

01:31:16.620 --> 01:31:20.040
They don't need to use a pin at the highest one.

01:31:20.040 --> 01:31:22.160
They could put it in pin six instead.

01:31:22.160 --> 01:31:28.980
And of course they could do up their IC system so that it doesn't require their master key to be low in pins three and four.

01:31:29.240 --> 01:31:39.180
But most locksmiths don't really think about the key space reduction that they are creating in terms of brute forcing this master key when they're designing that system.

01:31:39.180 --> 01:31:42.900
And so that's why this is something that's so common to see.

01:31:43.840 --> 01:32:03.320
A couple other things that we can note about this particular system is that if we have a master key or even a change key, so just this change key, now all we need to do is vary and do right simplification on these two middle pins to determine what the core remove key is.

01:32:04.180 --> 01:32:06.660
Pin three is a five.

01:32:06.660 --> 01:32:11.140
And so if we add three to it, it goes to four, three, two.

01:32:11.140 --> 01:32:15.100
And now we've hit the IC control line.

01:32:15.100 --> 01:32:23.300
And then pin four, we can vary in either direction to try to hit the IC control line for it as well.

01:32:23.300 --> 01:32:30.420
So we only actually have to vary one pin to go from our change key to an operable control key.

01:32:30.420 --> 01:32:32.340
It's just going to be for this lock.

01:32:32.340 --> 01:32:42.460
But what it lets us do is remove the IC core and then we can take it apart and disassembly of the lock then will let us derive the master key from that.

01:32:43.140 --> 01:32:46.420
Other types of locks have a similar situation.

01:32:47.160 --> 01:32:54.120
So Schlage and Yale control keys use a slightly different technology.

01:32:54.120 --> 01:33:02.380
They have a special seventh pin in the back where if the key is a bit longer, in the case of Schlage, it has this special nose on it sticking out.

01:33:02.380 --> 01:33:07.680
It's going to actuate that seventh pin, which will pull in this little retaining lug.

01:33:07.680 --> 01:33:10.400
And when it does that, you can then remove the core.

01:33:10.520 --> 01:33:21.360
So if you have an operable key for this particular lock, all you need to do is copy that key onto a slightly longer blank that contains this little nose on it.

01:33:21.360 --> 01:33:27.980
And you can use that key to remove the core, at which point you can then disassemble it and deduce the master key.

01:33:27.980 --> 01:33:33.340
Let's look at some right-samplification attacks in some special secondary locking systems.

01:33:33.360 --> 01:33:41.520
So we'll start with Multilock, which has got a nice pin-in-pin system that we can attack using all the other techniques that we've talked about in this talk.

01:33:41.560 --> 01:33:45.580
But it also has side pins that are used for mastering.

01:33:45.780 --> 01:33:50.620
And effectively, these side pins are going to fit into these side dimples drilled into the key.

01:33:50.900 --> 01:33:53.200
And in this case, we have a correct key.

01:33:53.200 --> 01:33:57.480
The side dimples are all there, so the side pins are able to fit into it.

01:33:57.480 --> 01:34:00.780
And they don't impede rotation of the plug.

01:34:00.780 --> 01:34:06.720
When an incorrect key is inserted, there are no dimples, and so the side pins are forced out into the plug.

01:34:06.720 --> 01:34:09.860
And that's actually going to stop us from rotating that key.

01:34:10.000 --> 01:34:11.820
This is used for mastering.

01:34:11.900 --> 01:34:16.280
So we have, in this case, a key that's got four of the five holes drilled.

01:34:16.280 --> 01:34:18.120
This is its correct lock.

01:34:18.120 --> 01:34:22.200
So these four pins are present, and the key is able to turn.

01:34:22.200 --> 01:34:27.160
For a lock that is not supposed to be able to open, there'll be a pin populated here as well.

01:34:27.160 --> 01:34:35.480
And this lack of a hole prevents that pin from moving out of the housing, and it will stop the key from turning.

01:34:35.960 --> 01:34:39.160
This is, of course, a trivial thing to amplify.

01:34:39.160 --> 01:34:46.460
We just drill an additional hole, and now all of the mastering that's done with these side pins has been defeated.

01:34:46.460 --> 01:34:49.320
This key will work in anything regardless of the side pins.

01:34:49.320 --> 01:34:55.360
And then we just have to use the other techniques to right-samplify the top cuts as well.

01:34:55.360 --> 01:34:59.300
So that's a very simple right-samplification attack.

01:34:59.300 --> 01:35:03.700
You can do something very, very similar by filing metal off of sectional keyways.

01:35:03.700 --> 01:35:12.520
So sometimes mastering is done by having a keyway that will not enter the keyway of some other lock that's not supposed to open, or a key that won't.

01:35:12.520 --> 01:35:19.180
But then we have a master blank that's going to enter both of these locks because it's got metal missing from it.

01:35:19.400 --> 01:35:37.300
And so all we need to do to right-samplify there is take our key that works on one of the low-level keyways and just copy that bidding code onto our all section blank at which point it's going to then enter all of these locks and we'll be able to open them as well.

01:35:37.560 --> 01:35:41.860
With Medeco Biaxial, we see something quite similar.

01:35:42.500 --> 01:35:46.880
So Medeco Biaxial has potential for double cuts.

01:35:47.360 --> 01:35:56.440
And what we can have is in a particular pin position, the pin has got this beveled edge to it, so it goes to one side or another.

01:35:56.440 --> 01:36:03.080
It can bevel towards the shoulder of the key and be a forecut or towards the tip of the key and be an aft cut.

01:36:03.300 --> 01:36:15.780
In a master key that's got double cuts, regardless of whether the lock that we're in has a forepin or an aft pin, it's going to interact with that key properly and open it up.

01:36:16.060 --> 01:36:18.540
And Medeco uses this for mastering as well.

01:36:18.540 --> 01:36:24.140
So a lower level key or a lower level master might be missing one of these cuts.

01:36:24.480 --> 01:36:29.740
We can very easily right-samplify that if we have some mid-level master.

01:36:29.740 --> 01:36:31.120
So here's MKA.

01:36:31.120 --> 01:36:35.400
It's got five single cuts and a double cut in pin six.

01:36:35.400 --> 01:36:39.040
And then we have any old key on the B system.

01:36:39.360 --> 01:36:45.540
And so what we see, for instance, is this pin six, that is a double cut.

01:36:45.540 --> 01:36:49.520
Pin five, we have an aft and it's a right cut.

01:36:49.960 --> 01:36:56.500
In this key on the B system, in pin five, we have a fore and it's a left cut.

01:36:56.600 --> 01:37:04.740
So what we can do is take a left cut and add it to the fore position on our MKA at these same master depths.

01:37:04.740 --> 01:37:14.560
And that's actually going to amplify this key into a full GMK that's going to work on all locks, even if it has an aft pin in that position.

01:37:14.560 --> 01:37:16.560
Sorry, a fore pin in that position.

01:37:16.640 --> 01:37:24.140
And so we do that for all other positions where the fore-aft of our B key differs from our MKA.

01:37:24.140 --> 01:37:36.860
And we've effectively now amplified the power of our MKA key to be a full GMK using the information of these angles that we see on this key here.

01:37:37.000 --> 01:37:45.980
So now that we understand how the basics of Medico Biaxial works, we can add a few tools to our arsenal to decode non-mastered Medico systems.

01:37:46.300 --> 01:37:52.740
So if we start with a six-pin Medico system, if it's non-mastered, it's going to follow Medico's code books.

01:37:53.000 --> 01:37:55.260
And so the depths are going to follow those code books.

01:37:55.260 --> 01:37:57.260
Give the computer a second to compute.

01:37:57.580 --> 01:38:14.800
And what we see immediately is that pin one, two, five, and six will never be a one in a non-mastered system, at least for this older version of code books that we're going to be looking at today, which is true for just about every Medico system created before 2008.

01:38:15.320 --> 01:38:24.460
So immediately we see that if we wanted to impression this lock, and you can impression Medico locks, we'd start with two, two, one, one, two, two.

01:38:24.460 --> 01:38:32.840
And as we went through impressioning this, we would end up skipping a whole bunch, increasingly so as we get closer and closer to the final key.

01:38:33.320 --> 01:38:35.360
So the code books helps with that.

01:38:35.360 --> 01:38:47.200
And of course, if we have a photo that's close but isn't quite enough to get the exact fitting, combining that with code books is usually enough to determine what the depths are.

01:38:47.660 --> 01:38:53.260
Medico also has angles though, and the angles also have code books.

01:38:53.600 --> 01:39:02.720
So if we add that the code books must follow Medico's non-mastered angle books, we see that right away, some of them are given already.

01:39:02.720 --> 01:39:08.640
So if we happen to have a pin three in the aft position, it's going to be a right cut.

01:39:09.740 --> 01:39:19.000
This can be useful now that we have this, if we know whether a particular lock is a four or an aft in each position.

01:39:19.160 --> 01:39:20.740
How do we tell that?

01:39:20.740 --> 01:39:25.020
Well, here's a little device that we designed that does exactly that.

01:39:25.020 --> 01:39:38.400
So here's one version where you take a blank, you cut a little notch into the six aft position, and then you stick it into the lock and it will clunk, clunk, clunk all the way along as each pin fits into it.

01:39:38.560 --> 01:39:45.400
Based on how far it clunks, if it aligns with these lines for the fours or not, you can tell which is for an aft.

01:39:45.400 --> 01:39:48.920
Here's another design that can be cut down from any key, not just a blank.

01:39:48.920 --> 01:39:53.920
We have a little tip at the end with a notch in it, again, in the six aft position.

01:39:53.920 --> 01:40:06.770
And we can clunk, clunk, clunk it along and make some marker marks on the key, and then decode it afterwards and determine whether this means for an aft in each of these positions.

01:40:08.080 --> 01:40:33.940
So for instance, if we know that we have a lock in front of us, and we've decoded the for and aft, and if we find it to be, let's say, aft, for, aft, for, for, aft, in that particular case, what actually happens is we completely get the angle sidebar code figured out for us.

01:40:33.960 --> 01:40:37.640
I'm just going to remove the depths because they kill the compute time for now.

01:40:39.140 --> 01:40:43.100
If we aren't so lucky, this is the only case of fors and afts where that happens.

01:40:43.100 --> 01:40:46.120
Let's say we get a for here and an aft there.

01:40:46.120 --> 01:40:48.120
So now we have a number of possibilities.

01:40:48.360 --> 01:41:02.740
We can help to decode what those angles are based on an innovation that Mark Webber Tobias and Tobias Bluzmanis came out with a number of years ago, which is Medeco bump keys, which takes advantage of flaws in their angle codebooks.

01:41:03.960 --> 01:41:06.360
But these bump keys, there's a set of four of them.

01:41:06.360 --> 01:41:19.260
And if we can get one of them to work once on this lock, then we can use that to create a key that will work very easily forevermore by identifying, well, one of these bump keys worked.

01:41:20.620 --> 01:41:30.520
And that's going to go ahead and figure out what those remaining unknown angles are based on the fact that that particular version of the bump key happened to work.

01:41:31.080 --> 01:41:34.080
If, say, even that isn't enough for us.

01:41:34.080 --> 01:41:40.840
So in this case, pin six, it could be a Q, which is a right cut or a B, which is a center cut.

01:41:41.180 --> 01:41:44.560
Right is 20 degree angle and center is zero.

01:41:44.560 --> 01:41:55.260
And another thing that Tobias has found out is that, like I mentioned before, with some blocks being able to accept half height cuts in the heights, it'll accept half angle cuts.

01:41:55.260 --> 01:41:59.800
So I can make a key at 10 degrees, halfway between center and right.

01:41:59.800 --> 01:42:02.980
And that will actually operate this lock.

01:42:03.140 --> 01:42:08.900
So a number of techniques that we can use to decode Medeco systems.

01:42:09.080 --> 01:42:16.020
So we've covered a lot of techniques for how to use various sources of information to come down to a bidding code.

01:42:16.020 --> 01:42:20.760
So a number that represents what the key should be cut to, what depth that should be.

01:42:20.760 --> 01:42:24.460
But how do we take that and turn that into an actual usable key?

01:42:24.520 --> 01:42:27.940
Well, we could start with the key blank and file it down ourselves manually.

01:42:27.940 --> 01:42:29.780
That's a perfectly valid way of doing it.

01:42:29.800 --> 01:42:35.560
We can also use a machine if we happen to own a key machine, but many of us don't.

01:42:35.820 --> 01:42:38.320
And we could also try using a locksmith.

01:42:38.320 --> 01:42:42.000
So the general procedure for that is to identify the blank.

01:42:42.000 --> 01:42:43.540
It's often printed right on it.

01:42:43.540 --> 01:42:47.220
So WR5 for this Weiser or Y1 for this Yale.

01:42:47.840 --> 01:42:56.980
Determine the bidding code that you want using the techniques we talked about and go to a locksmith, so not a hardware store or a 7-Eleven, and ask if they can cut a key by code.

01:42:56.980 --> 01:43:08.420
If they say yes, give them the blank name and the code, such as a Schlage SC1 with bidding code 04285, and they will usually cut it for you for the duplicating rate.

01:43:08.500 --> 01:43:12.320
If they happen to say that key is restricted, I can't cut you that.

01:43:12.320 --> 01:43:20.080
Check out the talk that myself and my brother Bobby gave last year entitled Duplicating Restricted Mechanical Keys at DEF CON 27.

01:43:21.100 --> 01:43:26.580
We'll talk a little bit about defenses, which is a huge field and could be a talk on its own.

01:43:26.580 --> 01:43:32.340
But the most salient points there is avoid very large mastering systems.

01:43:32.340 --> 01:43:43.840
If the only reason you have building A and building B mastered together is so that the superintendent can carry one GMK instead of two, that's really not worth the added risk for that added convenience.

01:43:44.060 --> 01:43:48.700
You also don't want to master high security and low security facilities on one system.

01:43:48.700 --> 01:43:55.300
So I've seen cases where a nuclear facility was mastered together with public washrooms.

01:43:55.300 --> 01:44:03.440
The access control of those public washrooms is significantly less, and information from those locks can be used to infiltrate the nuclear facility.

01:44:03.440 --> 01:44:07.480
That's absolutely something that you want to be separating in your mastering system.

01:44:07.820 --> 01:44:11.240
A missing lock is as bad as a missing GMK.

01:44:11.240 --> 01:44:19.520
So if a lock goes missing and it can't be accounted for, you need to consider the possibility that someone has disassembled and decoded it and made the key.

01:44:19.700 --> 01:44:25.860
You can consider alternatives to the two-step system and other various systems that we've talked about that can be exploited.

01:44:26.440 --> 01:44:31.700
Specific to those attacks, this is somewhat dependent on whether it's actually in your threat model.

01:44:31.700 --> 01:44:35.780
This is not in the threat model for the majority of applications.

01:44:35.780 --> 01:44:49.960
You can use a restricted keying system that won't stop a determined attacker, but it can slow them down and it can drive the cost up and potentially deter them from carrying out the attack in certain cases.

01:44:49.960 --> 01:44:54.540
Your facility ultimately should be secure even if an attacker has the GMK.

01:44:54.540 --> 01:45:02.660
So you want to use secondary security systems, such as guards and alarms and a proper detection and response mechanism.

01:45:03.000 --> 01:45:15.980
All that a mechanical lock does is keep honest people honest, and there's loads of ways past it, both keying and forcible entry and all sorts of other methods that DEFCON is all about.

01:45:16.540 --> 01:45:25.100
And use interchangeable core or electronic components or something to make re-keying easier if that becomes necessary.

01:45:25.100 --> 01:45:35.820
You want to have a response plan in place for if the unthinkable happens and your GMK or a key to a particular important area gets compromised.

01:45:36.820 --> 01:45:44.040
If you see something like this, so a lock goes missing and you're not sure how that happened, you want to take that seriously.

01:45:44.040 --> 01:45:47.620
And for heaven's sakes, don't do this.

01:45:47.940 --> 01:45:50.300
So thank you very much.

01:45:50.400 --> 01:45:52.520
I encourage you to go try it.

01:45:52.520 --> 01:45:55.160
Here are all the links to the applications that I'm releasing.

01:45:55.160 --> 01:45:58.260
Try them out for yourself and see what you can discover with them.

01:45:58.260 --> 01:46:04.740
I'd like to extend an enormous thank you to Josh, Karen, Jenny and Bobby for their help in getting this talk prepared.

01:46:04.740 --> 01:46:10.360
In particular to Jenny, she absolutely saved the day with editing this video at the last minute.

01:46:10.420 --> 01:46:12.560
And I'd be happy to take your questions.

01:46:12.560 --> 01:46:13.740
Thank you very much.