Thanks for joining us today at the Tool Lockpicking Village.
The talk I'm giving today is key duplication. It's not just for the movies.
My name is Tony Varelli, aka Byte Stealer, or some people just call me Byte. You can
find me mostly on Twitter if you want to talk. And that's twitter.com at Varelli.
I am a member of the Open Organization of Lockpickers, or Tool.
And I'm based out of Iowa, and I'm a member of the Des Moines chapter there.
So, I highly encourage you that after this talk today, stick around, keep checking out
the Lockpicking Village in DEF CON safe mode. We're going to have a lot of great talks going on.
A lot of really smart people when it comes to locks, bypassing them,
and physical security. So, I highly suggest you stick around for those talks as well.
Today, I'm going to cover two types of key duplication. The first one I'm going to cover
is how you can 3D print a key. And the second one will be molding and casting a key. This gives you
two different attack vectors, specifically because in option one of 3D printing a key,
you never need access to that key. And with option two, we can go a little bit further
with what we can do on complexity of keys. You're not limited to the key type, we'll say.
So, first we're going to cover 3D printing, and it's way easier than you think.
There's a few things you're going to need, obviously, which is a 3D printer,
the material you need, and I'm going to go through that entire list now of what you need.
So, first of all, you're going to need a 3D printer. The 3D printers I work with are an
Ultimaker 2 Plus, and I also have a Prusa i3 MK3S. These are just the printers I own,
that's why I use them. If you have your own printer, it should work well. Some lower end
printers, sub 200, sub 100 printers might have problems with this. But if you're experienced
with 3D printing, and you know how to really dial your settings in and get it configured
just properly, you might have success with even some lower end, cheaper printers.
A lot of questions I get about the 3D printers are, what size nozzle diameter do I use? It's a
0.4 millimeter nozzle, and I normally print at 0.1 millimeter layer heights. You could get away
with 0.2 millimeter layer heights, I just go for the 0.1, especially if you're doing higher security
keys. And I use PLA plastic all the time. You could use something stronger if you wanted to,
but PLA works perfectly for what we're doing here. The next thing you're going to need is
the key you want to duplicate. Now, you absolutely do not need to have access to this key. I can't
be the only person who has a friend on Facebook or other social media who is not security conscious,
and they're new homeowners or something along those lines. And you see this picture where
they're taking a big smiley picture and holding their keys up. If you get the right angle on that
key, you can take that photograph and use it to duplicate a key. If you are a real world pen
tester, and you can get a photograph of a key, for example, if you have the ability to walk up to a
security desk, and on the background of the wall, there's keys hanging there, and you can get a
photo of those. That's all you need. If you can get a photo and you can identify the type of key,
you can use those to duplicate the key from a photo, which is a really cool attack vector
compared to casting and molding a key, because that you do require access to the key for at
least a short period of time. For the examples I'm going to show today, I just did a basic
quick set KW1 key way. And then you're going to need a measuring tool. This isn't 100% necessary,
but it makes life a lot easier, which is a key gauge. If you have physical access to that key,
a key gauge lets you very quickly just move the key through the key gauge to get the
bidding depths, the cut depths of that key. So you can quickly just know, okay, that's a one,
that's a two, that's three, so on and so forth, depending on your key type.
When you're working with photos of a key, though, you're going to need a pair of calipers.
Calipers make your life super simple. You can get a cheap pair for like $20 or less on amazon.com.
And digital calipers are... I prefer digital calipers because they just read off very quickly.
And then if you're going to do photos, I highly suggest taking a look at Deviant Olaf's
GitHub repository. He has a repository called Decoding. And on here, he has photographs for
all these different key measurements. If you look on the screen, you can see just a couple like
American, MasterQuickSet, Schlage, Sargent, EL, a ton of them are up there. It's a very awesome
resource for decoding keys. Here's an example of a QuickSet one he has. It shows the entire key
from tip to bow. And on that, it shows the spacing you need for the cuts. And then on the bottom
right hand side, it shows the depths you need to make for each of the depths. So one depth
is 8.36 millimeters, so on and so forth, all the way across. So it's very cool that you can
use this for a reference. I'm not going to cover filing keys down, but this would be very good for
that kind of reference if you're measuring to have that information. He also has photos on his
repository that look like this. And where these come in use is when you have a photo of a key.
So for this example, for this presentation, I just went out and searched QuickSet key on Google
Images. And I got this key, I brought it into Photoshop. Now you can use any photo editing
software you want. I happen to have Photoshop, but you can use GIMP or anything else. And what
you do is you bring the picture in of the key and then you cut out the key profile for the most part
and you scale it down to fit on the photo here that you get from his repository.
So here's a picture that I brought in and scaled down off Google Images. Now it may not 100% line
up all the time, depending on how much you fiddle with it. But the good news is that it doesn't have
to be that precise to get a basic idea of your depths. So if you start at the bow of the key,
what someone might call the back or the handle, and we work our way to the tip of the key,
we can see here that the first depth cut is about a seven. Now I don't see the line for the seven,
but I can see it's shorter than the six. So it's easy for me to assume that's a seven cut.
And if I move to the next cut there, we can see that that's a five cut. The one next to it's a
five cut. We jump up to a four cut, and then we go back down to a five cut. So we have the code
for this, which is 75545. This is a horribly bitted key, except for that far back deep cut
on the seven. But now that I have this information, what can I do with this? This is a great way to
get a photo and get the depth cuts, but how do I take this and model a key? So a lot of people
don't have the skill or ability to sit there and get the warding cut into a key and the proper size,
height, and all this, the right angles. That would take a lot of work and using something like
Fusion 360, AutoCAD, SolidWorks, whatever you want to use. Well, that's where a great talk that I
believe happened at DEF CON 21 occurred. In the credits, I'll have a link to that talk. That's
on YouTube, I believe, and all the people who are part of that talk. But it was something along
the lines of key duplication and defeating high security Primus locks.
And the people who created that created a software called Keygen, and they launched a website called
keygen.co. This website is absolutely amazing. In your type, you select the type of key you're
working with. Your outline might be like, if it's a five pin, six pin, seven pin, whatever,
master lock, padlock, a four pin. And then your warding type, depending on which key you're using,
might have a different warding. And then using the previous slide, we figured out the cuts,
like a seven, five, five, four, five. You just simply enter that number combination into the
bidding and hit generate. And this generates an STL file. For those of you not familiar with 3D
printing, an STL file is the base file you use as your 3D model to generate your 3D prints.
So here's a quick video demo of me using the site. This is not the key I showed you previously.
It's just a demo real quick, but this is a Kwikset. On Kwikset, they only have the KW1
keyway and warding. And this is a bidding I entered for a test key I have for an actual lock I own.
It's 25363. I hit generate. It takes a couple seconds here, and then it generates this beautiful
3D render of the key. I mean, they even have the end of the key to match what it would actually
look like on the key. You hit download STL. It downloads the STL file to your computer.
And then I opened this up real quick in Windows 3D file viewer. They call it print 3D. And this
is just a basic idea of how it imports. It's an absolute perfect replication of a Kwikset key.
At the time, I was printing this on an Ultimaker 2 Plus, and the slicer software I used for that
is called Cura. If you don't know what a slicer software is, it's a software that
3D printers print on layers. This slices the STL file into layers so that the 3D printer can print.
Now, I don't print vertically like this because it makes it very unstable and weak,
and it wobbles as it prints. So the first thing I do is I rotate it flat down to the bed.
And in this preview, you're going to see this big ring around the outside.
That's called a brim. It just helps bed adhesion. When I actually go to print it,
I don't use that brim. I do print with supports depending on the warding,
but for the most point, you don't need to use even supports on that. So here's just a quick
time lapse. I'll probably skip ahead. I'm not going to watch the whole thing on this
of my Ultimaker printing that exact key we just showed and modeled.
So if you're not familiar with 3D printing, this is just a quick overview of what that looks like.
The gap you see on the bottom is part of the warding. I didn't do supports on this one
because I didn't need them. And you can see towards the top there, there's a little bit
of stringing between the cut. That's simple. When I'm done, I usually take an X-Acto knife
and just clean that up. It doesn't really affect a quick little cut with an X-Acto knife. It cleans
up any stringing or weird little print artifacts that you may receive on the print. So this gives
you the general idea. We don't need to watch the whole print. On average, this print takes between
10 to 15 minutes, depending on your printer, but it takes about 10 to 15 minutes to knock
out an entire key print. So this is the Kwikset lock I modeled, or that I modeled the key off of.
This is the key I printed. You can see I stopped it early. That's why it's cut off on top. I insert
it in and it turns the key, or it turns the lock, opens the lock. One thing to keep in mind here
is that this is a deadbolt and this deadbolt is not attached to the actual bolt, right?
So a 3D printed key will twist this open because there's nothing, there's no resistance from the
bolt having to be slid forward and backwards. One thing I could suggest if you're worried
about snapping the key off in a lock, is you can either use a tension wrench at the bottom,
trim a little bit off the bottom of the 3D printed key with an X-Acto knife, and slide
a thin tension wrench in, or a small screwdriver to assist the turn. Because when you actually
throw a bolt, you're going to have a lot more weight behind it and it's going to be a little
more difficult to turn, and you don't want to bend or snap a 3D plastic key off inside the
deadbolt lock. So that's just something to keep in mind. So I had this key, but what now? I have a
3D printed key. 3D printed keys are not durable. They will not last. So I was walking through my
local hardware store, Mine's Menards, and I saw the KeyMe machine. And I'm not going to get into
how much I hate this company and the ridiculous security options they offer.
And by ridiculous, I mean they don't have them. So I printed two keys on this machine. And what
this is, is if you have a key, it'll duplicate your key for you unmanned. And you can see I'm
entering... this is a Schlage. It's a totally different key. I was testing it another time.
It was a white filament. And we assume they use optics to scan this key for depths.
And it misread the key. You'll see here in a second that it misread the first key,
thinking it was something that it's not. And it failed. I had also printed this in a black or a
dark, dark gray PLA as well. And I'll show you that here in a second and how that works. So you
can see it says here, this is a less common key. It thinks it's some weird Schlage, which it
absolutely is not. So at this point, I was confused why it wasn't working. So I canceled out of this
and I decided I'm going to try again. And at this point, I went ahead and pulled the white key out
and I put the darker key in. And it definitely helps. So I would suggest if you're going to take
this attack vector to the point where you want to try to get a real key made from it,
that you use a darker PLA. Don't use white. Something that's going to be super reflective.
So here's the darker, dark gray key. I'm being very gentle shoving it in because it's got spring
loaded shutters on it and I didn't want to snap it off inside there. And yes, you did see that
correct. That is an NFC reader, RFID reader on one side and it's got a fingerprint scanner on the
other side. The fingerprint scanner's purpose, as horrible as this is, is that you can save all your
key profiles in the cloud. So if you don't have your key with you, you can always come back and
later. I don't want to get into the security implications of that. So you see that it's $1.99
to get a key duplicated here. Standard brass. If you'd like, you can get your Mickey Mouse or Darth
Vader key, but this is for testing purposes. So after tax, it was $2.12. This is the part
where I turn the camera away as I insert my credit card to pay for this transaction.
Sorry, this video is a bit of a lengthy video because it took me a minute.
Before they had this KeyMe, they used to have a machine called MinuteKey. And I liked the MinuteKey.
It worked well. It was very simple. There wasn't all this extra save your data, all this different
crap. They're trying to do an upsell here. I get a secondary key here for a few bucks cheaper.
I'm like, no, I'm good. I just need to test to make sure this works. And then they want your
email address so they can email your receipt, aka mark it to you. So of course, you know me,
I enter my real email address and they want to know if you want to save your key for later.
That's where the fingerprint comes in. Hell no. Moving on. So it starts going down this path
where it starts updating you. So here's the concept. You have a 3D printed key that is not
durable. However, I can take a 3D printed key, go to an unmanned key duplication system in the very
back of a hardware store that is in my local town. And I can duplicate this key. Now you saw it does
have the ability to do higher security keys than your standard Schlage or Kwikset or less common
keys, we'll call it. To do that though, they do ask for a mailing address because they cut it and
then they mail it to you. So that's something to keep in mind as well. But if you have a standard
Schlage, a standard Kwikset or other master lock standard keys that are what this company considers
common, it's going to cut this key in front of you and then dispense it out from the machine.
And again, I have to definitely apologize for the time of this video.
The other thing is it says that it does have an Android and iOS app that it can scan your
keys in home. I have not tested this, but I'm planning on it where I'm wondering if I'm able
to just set my key down on a desk and the app will scan it. So I'm going to be testing that in the
because if you could do that, if you had access to a physical key, it'd be set.
Okay, so the key's done cutting. You can see it does an absolutely horrid job. You can see little
pieces of flashing sticking off where it cut it. But nonetheless, you now have a real physical
metal duplicated brass key of something you just 3D printed, which is awesome.
So that concludes the 3D printing and cutting a key. Like I said, it's very simple. The hardest
part is... well, let me rephrase that. If you have access to the key, this is dead simple.
You get the measurements with the key gauge, you type it into keygen.co, you spit out an STL file
and you print it and you're done. You have a 3D printed key. You can take that to an unmanned
key duplication because if you go to a hardware store and ask a real person to cut this key,
you might get a weird look. I'm considering trying that just to see what happens if they'll
even do it. But you'll have a physical key if you can go to an unmanned key duplication center.
So now we're going to go into molding and casting a key. And this is where you start
to feel a little more like James Bond or a spy in this case, because you're starting to do a
little more covert, see it in the movies kind of stuff. And the cool part is you get to play
with fire. So where did I get the idea to try this? So I've been wanting to try key duplication
for a while now. But I'd always seen every video, you need a clamshell, you need something to put
the clay in to mold this key in. And they're always milled or CNC'd out of like an aluminum
or some kind of metal. And I didn't have access to that. I live in a very small city, like population
10,000 people. And I didn't know anyone. And if you were to send this off to be done, it would
be kind of a high cost. And then Devian Olof put out a video on his YouTube channel, which if you're
not subscribing, I don't know why you absolutely should be subscribing to his videos. He put
out a video and he talked about how you could absolutely 3D print this. So I went out and
searched Thingiverse for a 3D printable clamshell. And lo and behold, I found one. And I'll get into
who that's by here in a second. So once I saw that, Deviant talks about every little thing you need
to cast a key. He goes step-by-step process on how to do this. So I watched his video,
took inspiration from it and tested it myself. And here's the link at the bottom.
If you're seeing that to his original key molding and casting video.
If you don't know who Devian Olof is, there's this beautiful mug right there.
His website is deviating.net, Devian Olof at Twitter. Check him out on Twitter for sure.
So we're going to go over everything you need. There's a much higher bill of materials on this.
So let's go through them one by one. I try to give you an idea of where you can get them off Amazon
pretty cheap and or the prices you can expect to pay. So in this case, you are going to need
physical access to the key you're wanting to duplicate. If you prepare ahead of time,
I'll talk about in a second, you don't need much time. You maybe need like
anywhere between 15 to 30 seconds hands on with that key.
Depending on what you're allowed to do on a job or your story for your job,
you could get access to this key for like requesting access to a server room or wherever
you're trying to access specifically. Had you need that key, you may have just enough time to
get the mold of that key. And again, I did this all with a Kwikset KW1 key. Then you're going to
need a low melting point metal. So I do this demonstration at a lot of cons, and some of
these cons have kids. One metal that Deviant talks about, and if you talk to other people,
they suggest is called woods metal. The problem with woods metal is that it has
lead in it and other toxic chemicals that when burnt, the fumes rise up and you're breathing
these in. Woods metal is relatively cheap. You can get a lot of it for a very low cost.
However, because I was going to have kids, A, touching the metal after they're done,
melting it themselves, all this different stuff, I didn't feel comfortable using a woods metal
because of the toxins. And talking to some people in the tool slack, they suggested fields metal.
Fields metal is much more expensive by weight. I was able to get a small little brick of it,
probably about two and a half to three inches by three inches by quarter of an inch thick for about
35 bucks off eBay. That's the exact link to the one I buy. This is a reputable buyer. He's got
a hundred percent positive feedback as of this presentation, and he's always sent me the products
I've needed. I did a con in Omaha, Nebraska, and at that con, I ordered five different bricks,
and he got them to me, and he was willing to work with me on price, which I thought was awesome.
So this is where I get my metal. It's fields metal. It's very low point metal. Like the
picture shows, it melts at about 144 degrees Fahrenheit, and it doesn't have the toxins in
it. And then you're going to need something to melt that brick you get down so you can make
ingots. Deviant has some really cool big melting pot that he bought. I looked it up on Amazon. I
think it was like 35 or 40 bucks. He might've gotten it cheaper somewhere else. But I was
walking through Walmart one day in the camping section, and I saw this cast iron skillet,
and it was like five bucks. So I was willing to drop five bucks on a cast iron skillet,
which I bought. Obviously, I'll only use it for this purpose moving forward.
And then Deviant had these perfectly square, small ingots of his metal. And it just so happened that this
ingot was exactly the right amount of metal to mold and cast one single key. So I reached out to him
on, I can't remember if it was Twitter or Slack, and talked to him. And he's like, oh dude, it's
awesome. And there are these ice cube trays. So these are these silicone rubber ice cube trays
that are meant to make tiny ice cubes. You can drop them in like in the mouth of a bottle of
water or soda. And they're super tiny. You can get them off Amazon and you get two trays, which
make a ton of ice cubes or ingots in this case. And they're 10 bucks for both of them. Again,
these prices might be different now, especially with COVID going on. They could have completely
changed because all prices and availability on Amazon are off the charts compared to what they
used to be. But I got two of them for 10 bucks. So you can either use them both or use one for
key casting and one for your ice cubes. Then you're going to need the clay. And the clay is
what you actually mold the shape and the indent of the key into. And Sculpey is something that
Deviant recommended. One tip, when you search Sculpey clay on Amazon, select all the colors
available. The reason I say this is that the price varies based on the color you select.
I don't know. I don't get it. I've gotten yellow and green so far because they're usually between
two to $3. But if you select black or white or orange, it might be $7 to $10 for the same size,
the two ounce size I buy here. This two ounce size, you can see from the picture,
there's indents along each of the thing. And pretty much it's got four logs of clay.
One log of clay is exactly what you need to cast a key. So you get a minimum of four castings.
I found that you can reuse this clay over and over again. It does dry out over time.
It is heat set. It's oven baked clay. So heat sets it and makes it hardened. So you're not
going to get 100% reusability over and over again. And your results might vary. But I've
gotten four or five keys out of a single piece of clay. But again, it all depends on how hot
you heat your metal to before you pour it in. And then you're gonna need some kind of talcum
powder. I bought mine at Walmart. I bought the little baby powder. It's a little size about this
big. It's a travel size baby powder. And it's perfect. And this just stops the clay from
sticking to itself. So when you cast the two key or take the two pieces of the clamshell and stick
them together, when you pull them apart, they separate without the clay sticking together and
ruining your whole mold. Then you're gonna need the clamshell. I 3D printed mine from Thingiverse.
ZBZZN Boris is the person who created this. There's a bitly link I created to link straight
to the Thingiverse link for that. It works absolutely perfect. It's three pieces. You're
gonna have a left and a right to your clamshell. And then a base. And this base is awesome. In
Deviant's video, he had an aluminum one, I believe. And then he used like a C-clamp
to clamp it to hold it together and like kind of stabilize it on the table.
This base you print for it works absolutely perfect. I love this clamshell. I've used it over
a hundred times. And there's no deformation. It absolutely does not deform. It holds up to the
heat. You have to realize that when you print PLA, you print at a minimum usually of 190 degrees
Celsius to 220 degrees Celsius. And we're only hitting around 140 to 160 degrees Fahrenheit.
Now, unfortunately, I use American units. I wish we'd switched to metric and Celsius,
but I don't understand it off the top of my head. So you could do the conversion. But the point is
you never get close to that melting temperature or the glass temperature of the filament. So
you're gonna be absolutely fine. Then you're gonna need a melting ladle. This thing was like
10 bucks off Amazon. It's for melting lead, you know, casting ammunition, things along those lines.
It was 10 bucks on Amazon. It fits a perfect ingot inside of it. And you can hold a lighter
underneath it to melt that down. Then you're gonna need a lighter. Deviant suggested a torch lighter.
I do as well. I think it puts out a little more heat than just a standard lighter. But I've tested
with fields metal. You can use like a tea candle or a standard Bic lighter or a Zippo lighter. It
will get it hot enough over time. It's just not as fast. If you're like me and you like a cigar
renown again, I already own a cigar lighter. I bought this one off Amazon for 15 bucks like
years ago for the purpose of actually having cigars. It just so happened to work perfectly
for this situation as well. So this is a video of me trying not to upset my wife.
This is the five dollar cast iron skillet I bought from Walmart with the brick of metal of
fields metal I bought off of eBay. I'm slowly just melting it down inside this pan.
I make a very noob mistake here. Do not make my mistake. I took a like a kebab skewer
and I was making sure it was fully melted and kind of stirring it around to make sure there
was no more chunks of metal that it was 100% completely melted on my stove. And then to make
sure I, like an idiot, swirl it around in the pan like you would with butter if you're about to fry
steak. And what I do is I just coat my entire pan with fields metal. So I lost a bit of metal
because of that. But like I said, I'm not using this pan for anything but melting fields metal
in the future. So it works perfectly. I put the wax paper underneath the ice cube tray in case I
spilt. That's the only person I have that there. If I did an overspill, it would land on the wax
paper and not my stove and my wife would still love me. So I quickly just pour this in here.
And you can see that I got a whole bunch of full cube pours and then a whole bunch of random ones.
And then you can see the cubes it makes. I think I got about 16 cubes out of that one piece of
metal. So that's enough for 16 keys. One note, when I poured into this ice cube tray, it doesn't
fully fill all the cubes. So what I did is I popped them all out. Anything that was a full cube,
I set aside. Anything that was a partial cube, I took into my melting ladle. I melted it down,
all the little fragments, little pieces, and I slowly poured them in cube by cube
until I got a full ingot for each one. So that's just a little pointer there.
So now we're going to switch to demo time, aka time to play with fire. Don't try this at home
or if you do, just don't blame me if you get hurt. I highly suggest you try this at home.
Full disclosure, I've had this demo pre-recorded for a time because it's one of those things that
with COVID going on, I've done a lot of virtual conferences. And with a virtual conference,
it's just difficult to plan ahead. So I pre-recorded the actual demonstration of this video.
So you're going to see here, the background is going to change. My hat won't, you won't see my
face. It's going to be all on table kind of thing, but you're going to see the whole demonstration.
So we're going to do that demonstration and then I'll come back right after that. Enjoy.
Okay, so I'm going to get started with my demo here. I'm going to go over what I have here on
the table. So some of the things you're going to need. The first thing is a clamshell. This is
what we're going to use to actually mold the key. This is actually 3D printed. It's fully available
for free download off thingiverse.com. And I'll try to make sure the links are available. They're
on the base. The base is pretty much so you don't have to hold this as you're pouring molten metal
into it. It just lets you freehand it. Speaking of pouring molten metal, the next thing we have
here is a ladle. And this is a lead ladle. You could use this for pouring lead, but it works
perfectly for what we're doing. So we'll be pouring the metal in to the clamshell like that.
The next thing we're going to need is some sculpting clay. This is Sculpty. It's like
a few bucks on Amazon for this package. This package is pre-split into four different bars.
And just one bar is exactly perfect to fill this mold. You rip that one bar in half and you fill
each half of the mold. It works perfect. You're going to need some baby powder, some talcum
powder. I buy this nice little jar or nice little bottle from Walmart. It's like a buck something,
just because it's small and convenient. And I travel with all this stuff in this like pencil
bag I found one time at Walmart during school shopping time. It's like a dollar or two dollars
for this zipper bag and it holds everything I need. You're going to need a lighter. I suggest
a torture cigar lighter. This is a cigar lighter. You can't really see the flame on camera I'm
guessing, but that's what that is. And then I also have the metal. So there's different kinds of
metals you can use for this. A very common popular one is called woods metal. The problem with woods
metal is that it contains lead, so it's toxic. The fumes it puts off are toxic. So I would highly
suggest against it if you're going to be doing this around kids or in the public. For your own
use, that's up to you. You decide if that's okay with you. This is Fields metal. Fields metal is
non-toxic. I get mine off Amazon and it's like $35 for a brick. And one brick makes pretty much
enough to fill this little sleeve here. So about 16 little cubes, which you saw in the previous video
that I made melting it into a pan and then pouring it in this mini ice cube tray. So let's get into
molding an actual key. So I have this lock. It's a Kwikset lock and here's the key for that lock.
It works perfect. So this is the key we're going to mold.
So to get started, I'm going to move some stuff out of the way here.
First thing I'm going to do is get my clamshell opened up and laid flat in front of me and I'm
going to open my clay. Now I try to open this nicely so that I can kind of wrap it back in
the clay later. That's only because I'm doing it for demo purposes. This doesn't really matter.
I've actually 3D printed a holder for this clay just because I like to be organized with my stuff,
especially in 3D printing. So if you look at this again, you can see that there's,
it's hard, maybe hard to see, but you can see there are these lines that pre-cuts into these
bars. And this one bar is exactly the right shape. So if I take this bar and break it in half
or relatively in half, like so, this is exactly perfect for each side. So just take one and
mash it up, just like play-doh, soften it up just a little bit. And then what you're going to do,
and it's up to you, some people like to take talcum powder and put this in so the clay comes
out easier. For demo, I don't really care. If you needed to do multiple back-to-back,
maybe that would make sense. Otherwise it doesn't matter. Anyways, I get into about a shape like
that and then I just push it down into the clamshell and try to get as flat as possible.
So I'm pushing it down in, back-filling this big gap at the top, the big void at the top.
And you want it to be as level with the top of this as possible. You don't want a big
bulge of clay sticking up because it won't give you a good mold. It'll wrap around the key, which
you do not want. So get this as flat as flat as you can. Again, it doesn't have to be absolutely
perfect. When you squish these two together, you're probably going to get some leak out. That's fine.
Just get it as best as you can. So you can see I have it. It's pretty level. It's hard to see on
camera, but it's pretty level. Now this part, you're going to want to depress this down in,
like so, to create a well because you need some place to pour the molten metal into. So I'm
creating like this lip that I can bend backwards. And it's just this well because the top of the
doesn't need to be molded. That's not important. So pretty much you do this again and just repeat
it on the other side. So I'm going to take the clay and again soften it up by squishing it.
And you want to make sure that you go above the border here. You want that lump and then you want
to press it down to flatten it out. Otherwise, if you try to skim it in, you might get an air
pocket below. And when you squish the key in, all the clay moves down and you won't get a good
impression. Okay, so I've pushed it all down in and I still have a bulge. So now I'm going to work
on getting that bulge down so it's not above the plane of the top of the clamshell. And again,
I'm going to fill this void in on the top. People have asked me if the color of clay matters. It
doesn't. Literally, if you go on Amazon, one day one color is cheaper than the other color.
So sometimes you'll see this in yellow. Sometimes you'll see it in green, black, red, blue. It
doesn't matter. It is literally just whatever's the cheapest I buy. Because why pay $8 or $5 for
red when green is $1.99. So okay, so I have that pretty well in there. I'm going to check
to make sure I don't have it too too low. I think I'm good. Now I'm just gonna again create that
well on the top of my thumb, squishing it back. So I create a lip and when I put these two together,
it'll create a pore spout kind of like this that the metal can go down in.
So now the next important part is to cover these two pieces or these two sides in talcum powder,
so that when you push the two clays together, and you separate them that they separate and
they don't just stick into one big glob of clay. So you just take a little talcum powder and
sprinkle it on the sides here. And then just take your finger and rub that talcum powder across the
top of all the clay. Just like that. Check this, it seems a little bulgy. Now that I've pressed
it down, I'm going to put a little more powder on. Okay, so we have these both sides coated.
They're good to go. So I'm done with the talcum powder. I'm done with the clay. So the next thing
we're going to need here is we're going to need the key. Now it's important that when you press
this down that you think about this key as having two halves. Have one, have two over here. You don't
want to shove the whole key down 100% into one side. You want to push it down about halfway on
one side so that when you put the other clamshell on top, half the keys on one clamshell and half
the keys on the other side of the clamshell. So to start with, I'm just going to place this in here
so that the bow of the key, which is right here,
is make sure that that's in thick clay, not in the well. So I want it down far enough that we're
good there. Okay, and then I'm going to press down and rock it back and forth, just trying to get it
down about halfway in. And just lean in and check on it. Make sure you're about halfway in all the
around. So now you can see the key stuck in halfway there. Now the next thing to do is take
this clamshell, place it on top, and then squeeze these two pieces together. Now it's suggested that
you stand on this, which I'm not going to do because you're not going to see it anyways.
So I'm just going to place my hands on the table and press. You want to get a nice firm pressure
on this and just stand on it. Put some weight on it. Give it a second for the clay to move out of
the way for the key to come in. Because remember, you have the warding and all the parts of the key
that you need to get up in. Okay, that should be good. Now you want to carefully open this,
separate it apart. Don't rock it back and forth because you're gonna mess up the clay. Just try
to get it apart as cleanly as possible, like so. And we have a pretty decent impression over here.
It looks like the key sunk in a lot on this side, so I'm hoping this all turns out well.
But you saw how the clay came apart without sticking. That's because we used the talcum powder.
So I'm going to bend this lip back. I'm going to use the true method of flicking the key out.
The reason we do this is we want to get it out as fast as possible because if you lift it up,
it can cause the tip of the key to dig into it. So we want to get it out as fast as possible.
So there, it's out. It shot across the room, but that's fine. So where do we go from here?
So the next step to do is we're going to go ahead and take these two pieces of clamshell. We're
going to put them back together. And now we have a void. Now I'm going to open up these lips on the
top to make sure that I can see down into where we're about to pour, which I can see fine. So I'm
going to place that into this holder. And this does two things. One, it keeps these two pieces
tight together. And two, it makes it so I don't have to hold this in my hands as I pour molten
metal over it. And if I bump it or miss, I'm not going to end up with melted metal all over my
hands. So the next step I'm going to do is I'm going to take out one cube of my Fields metal.
And again, this metal is meant to melt at very low melting points. So a candle or a lighter works
fine. And one cube is almost absolutely perfect for your average key. So like a standard Schlage
key or Kwikset key. So I'm going to drop this in the end of the ladle, like so. And I'm going to
try to do my best here to let you see this melt and how fast it goes. But it's going to
be kind of hard to do. So we'll do our best here. So I can already see it moving. So it's already
starting to melt. And as soon as the metal below it starts melting, you get a little bit of liquid
metal. That metal heats up the rest of the cube and it melts really quickly. So there it goes.
So now I've got to kind of look at it here to verify. So it just hit completely liquid. I'm
going to go a little bit longer to make sure it doesn't start solidifying on me quite yet.
There we go. We're good to go. And now we just pour this metal
down in. And I'm kind of doing this because I want it to get down in and I want any air
bubbles to get out. But that should be good. And now we just let it sit. Now,
depending on how long you heat this for... let me bring this in. This is silicone,
so I can put something hot on it and it won't melt. Depending on how long you heat the metal
for, it's going to take longer to cool. Now this takes quite a bit longer to cool because it's
such a low melting point. If you use woods metal, the toxic stuff, it doesn't take as long to
do. If you watch any of Deviant's videos, you'll see that he uses... his clamshell is actually...
I think it's milled out of aluminum, which if you think about what aluminum is, it's a heat sink.
So that would help awesome to cool the key faster. Where this is plastic, this isn't going
as a heat sink. So if you can get a metal clamshell, great. Again, it's not needed. This is
super simple to make. It's probably like a few dollars worth of plastic in this. So it works
really well. You don't have to have metal if you've ever seen it. When I first started, that's
why, again, that's what I thought. I thought, oh, I didn't have a metal clamshell. How am I supposed
to try this? And when I saw the 3D printed one, it was fantastic. So I'm watching the top. I'm kind
of shaking it, and I can see that the center is starting to solidify. But the sides are still
jiggly. And I wish I could tip this to show you, but if I do, that metal might run out. So it doesn't
have to be cooled down to take it out, but it does need to be solidified. So we're going to finish
letting this go here. I'm just tapping it. And pretty much what I'm looking for is if the metal
is still kind of jello-y on top, or you can see liquid still. And as soon as I don't see that
anymore, then I'm pretty sure we're good to go. So there's just a few little spots that are still
like that down in here. We're very close now. Some very, very small spots still jiggling, which means
they're cooling off. And if you open this too early, and it's not solidified down, you're going
to have molten metal just running out. So better to be safe than sorry. Okay, it looks pretty
solidified. I'm going to give it a couple, like one more minute here, just to cool off a little bit
to guarantee it's good all the way down. And when we pull this out, you may or may not see some gaps,
some air gaps, that's fine. The key can still work. The important part, obviously, is the
bidding of the key and the warding. But if there's holes in the warding, we're fine. If there's holes
in the bidding, then we have problems because there might make a dip where it won't lift the
pins to the proper height. Okay, I think we're good. So I'm gonna go ahead and take the base off this.
Okay, and then we're going to split this open.
And it looks like we have a good casting. So let's see, well, I've got to keep it in the light so you can
see it here. So there's the key. And you can see, we just, we don't have the entire top of the head.
We have just enough, though, that we can grab onto it and turn it. And we can see all the key in here,
we can see the warding. So let's go ahead and peel this out. So we've got a little clay on the tip,
that's not a big deal. Just pull it off. So you can see there's a lot of flashing around here and
stuff like that. But again, none of this matters. And if that bothers you, it's so thin and soft.
Just bend it back. Okay, now we have a little bit of flashing, it looks like, around this bidding area.
But again, I'm not overly concerned with that because of the way the cut is. I can just kind
of bend that flashing out of the way. So I think we're completely good to go here.
So now it's the moment of truth. Because, you know, demos fail.
What's new? So let's place it into the lock. It goes into the lock. That's good news. Now we'll
open the lock. There it goes. So there was that little bit of flashing. So when I first started
turning it, it caught. But as soon as I turned that flashing bent out of the way, we're good to go.
So now we have a fully working duplicate of that key. So like when we talked about with 3D printing
of this key, this key is very bendable. It's very soft. But I can take a pair of calipers or again,
I can take the key depth measurement guide here. Let's see, quick set. Where'd you go?
There. And I can take this now. I can get the measurements from this on my own time because
I have a duplicate of this key now. Take my own time to get my measurements. I can 3D print this
key and take this to a key me or a key duplication, unmanned key duplication machine and have a
permanent copy of this key forever. If you only need to get them once or twice, this will work.
Again, this will last for a while. So I'm making a mess, but like that, it worked perfectly.
However, I want to show that this key is soft. So I'm going to bend it here just to show you.
That doesn't take a lot of power to bend that. You can see it's completely bent key now.
But if I lay it on a table, I flatten it back out. We're still, we should be good to go. Let
me just test it. Yep, we still get an open. So that is duplicating key with casting a key and
melting metal and casting it in clay. So let me flip back to my other screen here and we'll
continue on. Okay. So time to get some credit here. So first of all, we have the keygen.co.
There's the GitHub repository for that. And below that is the talk I specifically mentioned earlier
where keygen.co came from. It was from DEF CON 21, key decoding and duplication attacks for the
YouTube video of that talk. And that was done by David Lawrence, Eric Van Albert, and Robert
Johnson. Big shout out to them. I believe the tool is also available as just a Python script you can
download and run locally. So you don't need to rely on their website. The website is just super
quick and easy. Obviously, I have to give a massive shout out to Devin Olaf. I didn't think I
could do key duplication before I saw his video. After watching that video, he gave an in-depth,
very, very detailed way of how to do key duplication. And the fact that he mentioned
you could use 3D printed clamshells is what even sent me down this path. So check out his website
and check out his Twitter. And then the link below that is the original key molding and casting video.
And again, a big shout out to Boris for the 3D printed clamshell that he makes freely available
to the world on Thingiverse. If you go back in the slides, you will definitely see the link to that.
So I want to thank you guys for letting me talk to you today about key duplication.
If you have a 3D printer, please give this a try. It's super simple. Just enter a random
bidding code, if you will, just to test it out and print a 3D key just so you can see how easy
it is. If you have your own key, go ahead and duplicate your own key just to test it out and
see how well it works. It's super simple using thekeygen.co. If you have any questions, any
comments, or anything else you want to talk about, again, hit me up at Twitter,
at Vareli. It's the easiest way to find me. And then questions. If you have questions,
obviously I'll be sticking around. You can find me in the Discord channel.
I'll be available to answer any questions you might have, details about printing,
molding and casting, anything like that. So again, I want to thank you for taking the time to watch
this presentation. I hope you have a great DEF CON safe mode and stick around at the
Lockpicking Village with Tool for all the other amazing talks that are coming up. Thanks a lot.