start	end	text
620	3860	Thanks for joining us today at the Tool Lockpicking Village.
3860	7480	The talk I'm giving today is key duplication. It's not just for the movies.
8480	13120	My name is Tony Varelli, aka Byte Stealer, or some people just call me Byte. You can
13120	18380	find me mostly on Twitter if you want to talk. And that's twitter.com at Varelli.
20700	24540	I am a member of the Open Organization of Lockpickers, or Tool.
25000	28460	And I'm based out of Iowa, and I'm a member of the Des Moines chapter there.
29280	35000	So, I highly encourage you that after this talk today, stick around, keep checking out
35000	40160	the Lockpicking Village in DEF CON safe mode. We're going to have a lot of great talks going on.
40620	45460	A lot of really smart people when it comes to locks, bypassing them,
45460	49800	and physical security. So, I highly suggest you stick around for those talks as well.
50600	55160	Today, I'm going to cover two types of key duplication. The first one I'm going to cover
55160	60340	is how you can 3D print a key. And the second one will be molding and casting a key. This gives you
60340	65080	two different attack vectors, specifically because in option one of 3D printing a key,
65080	70500	you never need access to that key. And with option two, we can go a little bit further
70500	75940	with what we can do on complexity of keys. You're not limited to the key type, we'll say.
77520	81160	So, first we're going to cover 3D printing, and it's way easier than you think.
81580	84540	There's a few things you're going to need, obviously, which is a 3D printer,
85180	88720	the material you need, and I'm going to go through that entire list now of what you need.
89480	93480	So, first of all, you're going to need a 3D printer. The 3D printers I work with are an
93480	99900	Ultimaker 2 Plus, and I also have a Prusa i3 MK3S. These are just the printers I own,
99900	105120	that's why I use them. If you have your own printer, it should work well. Some lower end
105120	111140	printers, sub 200, sub 100 printers might have problems with this. But if you're experienced
111140	116160	with 3D printing, and you know how to really dial your settings in and get it configured
116160	121000	just properly, you might have success with even some lower end, cheaper printers.
122480	127340	A lot of questions I get about the 3D printers are, what size nozzle diameter do I use? It's a
127340	133800	0.4 millimeter nozzle, and I normally print at 0.1 millimeter layer heights. You could get away
133800	138000	with 0.2 millimeter layer heights, I just go for the 0.1, especially if you're doing higher security
138000	146180	keys. And I use PLA plastic all the time. You could use something stronger if you wanted to,
146180	151220	but PLA works perfectly for what we're doing here. The next thing you're going to need is
151220	157740	the key you want to duplicate. Now, you absolutely do not need to have access to this key. I can't
157740	162180	be the only person who has a friend on Facebook or other social media who is not security conscious,
162800	166880	and they're new homeowners or something along those lines. And you see this picture where
166880	172720	they're taking a big smiley picture and holding their keys up. If you get the right angle on that
172720	180120	key, you can take that photograph and use it to duplicate a key. If you are a real world pen
180120	186420	tester, and you can get a photograph of a key, for example, if you have the ability to walk up to a
186420	191480	security desk, and on the background of the wall, there's keys hanging there, and you can get a
191480	196480	photo of those. That's all you need. If you can get a photo and you can identify the type of key,
196880	202420	you can use those to duplicate the key from a photo, which is a really cool attack vector
202960	210180	compared to casting and molding a key, because that you do require access to the key for at
210180	215020	least a short period of time. For the examples I'm going to show today, I just did a basic
215020	224860	quick set KW1 key way. And then you're going to need a measuring tool. This isn't 100% necessary,
225660	231520	but it makes life a lot easier, which is a key gauge. If you have physical access to that key,
231640	235720	a key gauge lets you very quickly just move the key through the key gauge to get the
236400	240680	bidding depths, the cut depths of that key. So you can quickly just know, okay, that's a one,
240680	243640	that's a two, that's three, so on and so forth, depending on your key type.
244440	248440	When you're working with photos of a key, though, you're going to need a pair of calipers.
248580	253120	Calipers make your life super simple. You can get a cheap pair for like $20 or less on amazon.com.
253120	258060	And digital calipers are... I prefer digital calipers because they just read off very quickly.
260120	264940	And then if you're going to do photos, I highly suggest taking a look at Deviant Olaf's
264940	270740	GitHub repository. He has a repository called Decoding. And on here, he has photographs for
270740	274660	all these different key measurements. If you look on the screen, you can see just a couple like
274660	281520	American, MasterQuickSet, Schlage, Sargent, EL, a ton of them are up there. It's a very awesome
281520	288740	resource for decoding keys. Here's an example of a QuickSet one he has. It shows the entire key
289420	296860	from tip to bow. And on that, it shows the spacing you need for the cuts. And then on the bottom
296860	303680	right hand side, it shows the depths you need to make for each of the depths. So one depth
303680	309440	is 8.36 millimeters, so on and so forth, all the way across. So it's very cool that you can
309440	315660	use this for a reference. I'm not going to cover filing keys down, but this would be very good for
315660	321780	that kind of reference if you're measuring to have that information. He also has photos on his
321780	327280	repository that look like this. And where these come in use is when you have a photo of a key.
327540	333020	So for this example, for this presentation, I just went out and searched QuickSet key on Google
333020	337100	Images. And I got this key, I brought it into Photoshop. Now you can use any photo editing
337100	341780	software you want. I happen to have Photoshop, but you can use GIMP or anything else. And what
341780	347280	you do is you bring the picture in of the key and then you cut out the key profile for the most part
347940	354640	and you scale it down to fit on the photo here that you get from his repository.
354880	361740	So here's a picture that I brought in and scaled down off Google Images. Now it may not 100% line
361740	365800	up all the time, depending on how much you fiddle with it. But the good news is that it doesn't have
365800	370700	to be that precise to get a basic idea of your depths. So if you start at the bow of the key,
370700	374690	what someone might call the back or the handle, and we work our way to the tip of the key,
375960	381340	we can see here that the first depth cut is about a seven. Now I don't see the line for the seven,
381340	385500	but I can see it's shorter than the six. So it's easy for me to assume that's a seven cut.
385520	390200	And if I move to the next cut there, we can see that that's a five cut. The one next to it's a
390200	395500	five cut. We jump up to a four cut, and then we go back down to a five cut. So we have the code
395500	404120	for this, which is 75545. This is a horribly bitted key, except for that far back deep cut
404120	411360	on the seven. But now that I have this information, what can I do with this? This is a great way to
411360	418000	get a photo and get the depth cuts, but how do I take this and model a key? So a lot of people
418000	424900	don't have the skill or ability to sit there and get the warding cut into a key and the proper size,
424900	429300	height, and all this, the right angles. That would take a lot of work and using something like
429300	436360	Fusion 360, AutoCAD, SolidWorks, whatever you want to use. Well, that's where a great talk that I
436360	441620	believe happened at DEF CON 21 occurred. In the credits, I'll have a link to that talk. That's
441620	445840	on YouTube, I believe, and all the people who are part of that talk. But it was something along
445840	452440	the lines of key duplication and defeating high security Primus locks.
453960	460600	And the people who created that created a software called Keygen, and they launched a website called
460600	467180	keygen.co. This website is absolutely amazing. In your type, you select the type of key you're
467180	472600	working with. Your outline might be like, if it's a five pin, six pin, seven pin, whatever,
472600	477160	master lock, padlock, a four pin. And then your warding type, depending on which key you're using,
477160	481880	might have a different warding. And then using the previous slide, we figured out the cuts,
481880	486480	like a seven, five, five, four, five. You just simply enter that number combination into the
486480	492680	bidding and hit generate. And this generates an STL file. For those of you not familiar with 3D
492680	499880	printing, an STL file is the base file you use as your 3D model to generate your 3D prints.
500680	506520	So here's a quick video demo of me using the site. This is not the key I showed you previously.
506520	509840	It's just a demo real quick, but this is a Kwikset. On Kwikset, they only have the KW1
509840	515760	keyway and warding. And this is a bidding I entered for a test key I have for an actual lock I own.
517020	522440	It's 25363. I hit generate. It takes a couple seconds here, and then it generates this beautiful
522440	527060	3D render of the key. I mean, they even have the end of the key to match what it would actually
527060	532720	look like on the key. You hit download STL. It downloads the STL file to your computer.
534040	539720	And then I opened this up real quick in Windows 3D file viewer. They call it print 3D. And this
539720	546580	is just a basic idea of how it imports. It's an absolute perfect replication of a Kwikset key.
547320	552560	At the time, I was printing this on an Ultimaker 2 Plus, and the slicer software I used for that
552560	556540	is called Cura. If you don't know what a slicer software is, it's a software that
557660	566140	3D printers print on layers. This slices the STL file into layers so that the 3D printer can print.
566140	570100	Now, I don't print vertically like this because it makes it very unstable and weak,
570100	574660	and it wobbles as it prints. So the first thing I do is I rotate it flat down to the bed.
575360	578940	And in this preview, you're going to see this big ring around the outside.
578960	582980	That's called a brim. It just helps bed adhesion. When I actually go to print it,
582980	588300	I don't use that brim. I do print with supports depending on the warding,
588300	594820	but for the most point, you don't need to use even supports on that. So here's just a quick
594820	597600	time lapse. I'll probably skip ahead. I'm not going to watch the whole thing on this
598360	601640	of my Ultimaker printing that exact key we just showed and modeled.
604610	608510	So if you're not familiar with 3D printing, this is just a quick overview of what that looks like.
613810	617750	The gap you see on the bottom is part of the warding. I didn't do supports on this one
617750	625840	because I didn't need them. And you can see towards the top there, there's a little bit
625840	629540	of stringing between the cut. That's simple. When I'm done, I usually take an X-Acto knife
629540	634280	and just clean that up. It doesn't really affect a quick little cut with an X-Acto knife. It cleans
634280	643490	up any stringing or weird little print artifacts that you may receive on the print. So this gives
643490	647350	you the general idea. We don't need to watch the whole print. On average, this print takes between
647350	651610	10 to 15 minutes, depending on your printer, but it takes about 10 to 15 minutes to knock
651610	659350	out an entire key print. So this is the Kwikset lock I modeled, or that I modeled the key off of.
659710	664490	This is the key I printed. You can see I stopped it early. That's why it's cut off on top. I insert
664490	670290	it in and it turns the key, or it turns the lock, opens the lock. One thing to keep in mind here
670290	677310	is that this is a deadbolt and this deadbolt is not attached to the actual bolt, right?
677890	682650	So a 3D printed key will twist this open because there's nothing, there's no resistance from the
682650	687070	bolt having to be slid forward and backwards. One thing I could suggest if you're worried
687070	691750	about snapping the key off in a lock, is you can either use a tension wrench at the bottom,
691750	695310	trim a little bit off the bottom of the 3D printed key with an X-Acto knife, and slide
695550	702830	a thin tension wrench in, or a small screwdriver to assist the turn. Because when you actually
702830	706510	throw a bolt, you're going to have a lot more weight behind it and it's going to be a little
706510	711030	more difficult to turn, and you don't want to bend or snap a 3D plastic key off inside the
711030	718230	deadbolt lock. So that's just something to keep in mind. So I had this key, but what now? I have a
718230	725630	3D printed key. 3D printed keys are not durable. They will not last. So I was walking through my
725630	730850	local hardware store, Mine's Menards, and I saw the KeyMe machine. And I'm not going to get into
730850	737050	how much I hate this company and the ridiculous security options they offer.
737890	742650	And by ridiculous, I mean they don't have them. So I printed two keys on this machine. And what
742650	747090	this is, is if you have a key, it'll duplicate your key for you unmanned. And you can see I'm
747090	751430	entering... this is a Schlage. It's a totally different key. I was testing it another time.
752390	759410	It was a white filament. And we assume they use optics to scan this key for depths.
759410	763550	And it misread the key. You'll see here in a second that it misread the first key,
763550	769790	thinking it was something that it's not. And it failed. I had also printed this in a black or a
769790	774850	dark, dark gray PLA as well. And I'll show you that here in a second and how that works. So you
774850	778970	can see it says here, this is a less common key. It thinks it's some weird Schlage, which it
778970	784950	absolutely is not. So at this point, I was confused why it wasn't working. So I canceled out of this
784950	794880	and I decided I'm going to try again. And at this point, I went ahead and pulled the white key out
794880	798940	and I put the darker key in. And it definitely helps. So I would suggest if you're going to take
798940	803900	this attack vector to the point where you want to try to get a real key made from it,
803900	808100	that you use a darker PLA. Don't use white. Something that's going to be super reflective.
808100	814080	So here's the darker, dark gray key. I'm being very gentle shoving it in because it's got spring
814080	820720	loaded shutters on it and I didn't want to snap it off inside there. And yes, you did see that
820720	825640	correct. That is an NFC reader, RFID reader on one side and it's got a fingerprint scanner on the
825640	833580	other side. The fingerprint scanner's purpose, as horrible as this is, is that you can save all your
833580	838960	key profiles in the cloud. So if you don't have your key with you, you can always come back and
838960	845980	later. I don't want to get into the security implications of that. So you see that it's $1.99
846880	852440	to get a key duplicated here. Standard brass. If you'd like, you can get your Mickey Mouse or Darth
852440	858520	Vader key, but this is for testing purposes. So after tax, it was $2.12. This is the part
858520	862920	where I turn the camera away as I insert my credit card to pay for this transaction.
868090	871110	Sorry, this video is a bit of a lengthy video because it took me a minute.
871730	875830	Before they had this KeyMe, they used to have a machine called MinuteKey. And I liked the MinuteKey.
875830	879930	It worked well. It was very simple. There wasn't all this extra save your data, all this different
879930	884990	crap. They're trying to do an upsell here. I get a secondary key here for a few bucks cheaper.
885410	888270	I'm like, no, I'm good. I just need to test to make sure this works. And then they want your
888270	894650	email address so they can email your receipt, aka mark it to you. So of course, you know me,
894650	909530	I enter my real email address and they want to know if you want to save your key for later.
909530	916770	That's where the fingerprint comes in. Hell no. Moving on. So it starts going down this path
916770	920690	where it starts updating you. So here's the concept. You have a 3D printed key that is not
920690	928330	durable. However, I can take a 3D printed key, go to an unmanned key duplication system in the very
928330	934930	back of a hardware store that is in my local town. And I can duplicate this key. Now you saw it does
934930	940990	have the ability to do higher security keys than your standard Schlage or Kwikset or less common
940990	945890	keys, we'll call it. To do that though, they do ask for a mailing address because they cut it and
945890	949910	then they mail it to you. So that's something to keep in mind as well. But if you have a standard
949910	956150	Schlage, a standard Kwikset or other master lock standard keys that are what this company considers
956150	962730	common, it's going to cut this key in front of you and then dispense it out from the machine.
962730	970790	And again, I have to definitely apologize for the time of this video.
972230	976170	The other thing is it says that it does have an Android and iOS app that it can scan your
976170	980650	keys in home. I have not tested this, but I'm planning on it where I'm wondering if I'm able
980650	987050	to just set my key down on a desk and the app will scan it. So I'm going to be testing that in the
987050	992130	because if you could do that, if you had access to a physical key, it'd be set.
992130	997070	Okay, so the key's done cutting. You can see it does an absolutely horrid job. You can see little
997070	1004670	pieces of flashing sticking off where it cut it. But nonetheless, you now have a real physical
1004670	1010810	metal duplicated brass key of something you just 3D printed, which is awesome.
1010810	1018250	So that concludes the 3D printing and cutting a key. Like I said, it's very simple. The hardest
1018250	1023590	part is... well, let me rephrase that. If you have access to the key, this is dead simple.
1023610	1028830	You get the measurements with the key gauge, you type it into keygen.co, you spit out an STL file
1028830	1032550	and you print it and you're done. You have a 3D printed key. You can take that to an unmanned
1032550	1037990	key duplication because if you go to a hardware store and ask a real person to cut this key,
1037990	1041630	you might get a weird look. I'm considering trying that just to see what happens if they'll
1041630	1048730	even do it. But you'll have a physical key if you can go to an unmanned key duplication center.
1049410	1052410	So now we're going to go into molding and casting a key. And this is where you start
1052410	1057810	to feel a little more like James Bond or a spy in this case, because you're starting to do a
1057810	1062210	little more covert, see it in the movies kind of stuff. And the cool part is you get to play
1062210	1067470	with fire. So where did I get the idea to try this? So I've been wanting to try key duplication
1067470	1074370	for a while now. But I'd always seen every video, you need a clamshell, you need something to put
1074370	1080310	the clay in to mold this key in. And they're always milled or CNC'd out of like an aluminum
1080310	1085530	or some kind of metal. And I didn't have access to that. I live in a very small city, like population
1085530	1091950	10,000 people. And I didn't know anyone. And if you were to send this off to be done, it would
1091950	1096870	be kind of a high cost. And then Devian Olof put out a video on his YouTube channel, which if you're
1096870	1102730	not subscribing, I don't know why you absolutely should be subscribing to his videos. He put
1102730	1109790	out a video and he talked about how you could absolutely 3D print this. So I went out and
1109790	1115430	searched Thingiverse for a 3D printable clamshell. And lo and behold, I found one. And I'll get into
1115430	1121950	who that's by here in a second. So once I saw that, Deviant talks about every little thing you need
1121950	1127550	to cast a key. He goes step-by-step process on how to do this. So I watched his video,
1127550	1131530	took inspiration from it and tested it myself. And here's the link at the bottom.
1131530	1135070	If you're seeing that to his original key molding and casting video.
1136730	1141310	If you don't know who Devian Olof is, there's this beautiful mug right there.
1141310	1147150	His website is deviating.net, Devian Olof at Twitter. Check him out on Twitter for sure.
1148290	1153330	So we're going to go over everything you need. There's a much higher bill of materials on this.
1153530	1156890	So let's go through them one by one. I try to give you an idea of where you can get them off Amazon
1156890	1164530	pretty cheap and or the prices you can expect to pay. So in this case, you are going to need
1166310	1171810	physical access to the key you're wanting to duplicate. If you prepare ahead of time,
1171810	1177290	I'll talk about in a second, you don't need much time. You maybe need like
1177970	1183010	anywhere between 15 to 30 seconds hands on with that key.
1184830	1191550	Depending on what you're allowed to do on a job or your story for your job,
1191550	1197370	you could get access to this key for like requesting access to a server room or wherever
1197370	1203270	you're trying to access specifically. Had you need that key, you may have just enough time to
1203270	1210610	get the mold of that key. And again, I did this all with a Kwikset KW1 key. Then you're going to
1210610	1218230	need a low melting point metal. So I do this demonstration at a lot of cons, and some of
1218230	1223710	these cons have kids. One metal that Deviant talks about, and if you talk to other people,
1223710	1227990	they suggest is called woods metal. The problem with woods metal is that it has
1227990	1232850	lead in it and other toxic chemicals that when burnt, the fumes rise up and you're breathing
1232850	1239570	these in. Woods metal is relatively cheap. You can get a lot of it for a very low cost.
1239750	1243510	However, because I was going to have kids, A, touching the metal after they're done,
1243510	1247150	melting it themselves, all this different stuff, I didn't feel comfortable using a woods metal
1247150	1253030	because of the toxins. And talking to some people in the tool slack, they suggested fields metal.
1253730	1260690	Fields metal is much more expensive by weight. I was able to get a small little brick of it,
1260690	1267730	probably about two and a half to three inches by three inches by quarter of an inch thick for about
1267730	1273910	35 bucks off eBay. That's the exact link to the one I buy. This is a reputable buyer. He's got
1273970	1279190	a hundred percent positive feedback as of this presentation, and he's always sent me the products
1279190	1288790	I've needed. I did a con in Omaha, Nebraska, and at that con, I ordered five different bricks,
1288790	1291810	and he got them to me, and he was willing to work with me on price, which I thought was awesome.
1292010	1296050	So this is where I get my metal. It's fields metal. It's very low point metal. Like the
1296050	1302470	picture shows, it melts at about 144 degrees Fahrenheit, and it doesn't have the toxins in
1302470	1307510	it. And then you're going to need something to melt that brick you get down so you can make
1307510	1313770	ingots. Deviant has some really cool big melting pot that he bought. I looked it up on Amazon. I
1313770	1317350	think it was like 35 or 40 bucks. He might've gotten it cheaper somewhere else. But I was
1317350	1321790	walking through Walmart one day in the camping section, and I saw this cast iron skillet,
1321790	1326090	and it was like five bucks. So I was willing to drop five bucks on a cast iron skillet,
1326090	1329330	which I bought. Obviously, I'll only use it for this purpose moving forward.
1330370	1340370	And then Deviant had these perfectly square, small ingots of his metal. And it just so happened that this
1340370	1347650	ingot was exactly the right amount of metal to mold and cast one single key. So I reached out to him
1347650	1352850	on, I can't remember if it was Twitter or Slack, and talked to him. And he's like, oh dude, it's
1352850	1358350	awesome. And there are these ice cube trays. So these are these silicone rubber ice cube trays
1358350	1361770	that are meant to make tiny ice cubes. You can drop them in like in the mouth of a bottle of
1361770	1367990	water or soda. And they're super tiny. You can get them off Amazon and you get two trays, which
1367990	1373070	make a ton of ice cubes or ingots in this case. And they're 10 bucks for both of them. Again,
1373070	1377470	these prices might be different now, especially with COVID going on. They could have completely
1377470	1382190	changed because all prices and availability on Amazon are off the charts compared to what they
1382190	1387010	used to be. But I got two of them for 10 bucks. So you can either use them both or use one for
1387010	1392110	key casting and one for your ice cubes. Then you're going to need the clay. And the clay is
1392110	1400910	what you actually mold the shape and the indent of the key into. And Sculpey is something that
1400910	1408330	Deviant recommended. One tip, when you search Sculpey clay on Amazon, select all the colors
1408330	1414750	available. The reason I say this is that the price varies based on the color you select.
1414750	1419590	I don't know. I don't get it. I've gotten yellow and green so far because they're usually between
1419590	1426830	two to $3. But if you select black or white or orange, it might be $7 to $10 for the same size,
1426830	1431690	the two ounce size I buy here. This two ounce size, you can see from the picture,
1431690	1437930	there's indents along each of the thing. And pretty much it's got four logs of clay.
1437930	1446970	One log of clay is exactly what you need to cast a key. So you get a minimum of four castings.
1446970	1453510	I found that you can reuse this clay over and over again. It does dry out over time.
1453610	1458810	It is heat set. It's oven baked clay. So heat sets it and makes it hardened. So you're not
1458810	1462990	going to get 100% reusability over and over again. And your results might vary. But I've
1462990	1468150	gotten four or five keys out of a single piece of clay. But again, it all depends on how hot
1468150	1473990	you heat your metal to before you pour it in. And then you're gonna need some kind of talcum
1473990	1479510	powder. I bought mine at Walmart. I bought the little baby powder. It's a little size about this
1479510	1483510	big. It's a travel size baby powder. And it's perfect. And this just stops the clay from
1483510	1487990	sticking to itself. So when you cast the two key or take the two pieces of the clamshell and stick
1487990	1491650	them together, when you pull them apart, they separate without the clay sticking together and
1491650	1498870	ruining your whole mold. Then you're gonna need the clamshell. I 3D printed mine from Thingiverse.
1499670	1506030	ZBZZN Boris is the person who created this. There's a bitly link I created to link straight
1506030	1513410	to the Thingiverse link for that. It works absolutely perfect. It's three pieces. You're
1513410	1518250	gonna have a left and a right to your clamshell. And then a base. And this base is awesome. In
1518250	1521750	Deviant's video, he had an aluminum one, I believe. And then he used like a C-clamp
1522650	1527330	to clamp it to hold it together and like kind of stabilize it on the table.
1527330	1532050	This base you print for it works absolutely perfect. I love this clamshell. I've used it over
1532250	1538570	a hundred times. And there's no deformation. It absolutely does not deform. It holds up to the
1538570	1546230	heat. You have to realize that when you print PLA, you print at a minimum usually of 190 degrees
1546230	1555010	Celsius to 220 degrees Celsius. And we're only hitting around 140 to 160 degrees Fahrenheit.
1555170	1559790	Now, unfortunately, I use American units. I wish we'd switched to metric and Celsius,
1559790	1563910	but I don't understand it off the top of my head. So you could do the conversion. But the point is
1563910	1568550	you never get close to that melting temperature or the glass temperature of the filament. So
1568550	1572870	you're gonna be absolutely fine. Then you're gonna need a melting ladle. This thing was like
1572870	1578350	10 bucks off Amazon. It's for melting lead, you know, casting ammunition, things along those lines.
1578450	1583150	It was 10 bucks on Amazon. It fits a perfect ingot inside of it. And you can hold a lighter
1583150	1592550	underneath it to melt that down. Then you're gonna need a lighter. Deviant suggested a torch lighter.
1592550	1597030	I do as well. I think it puts out a little more heat than just a standard lighter. But I've tested
1597030	1601450	with fields metal. You can use like a tea candle or a standard Bic lighter or a Zippo lighter. It
1601450	1607070	will get it hot enough over time. It's just not as fast. If you're like me and you like a cigar
1607070	1611790	renown again, I already own a cigar lighter. I bought this one off Amazon for 15 bucks like
1612230	1617130	years ago for the purpose of actually having cigars. It just so happened to work perfectly
1617130	1622850	for this situation as well. So this is a video of me trying not to upset my wife.
1623610	1629410	This is the five dollar cast iron skillet I bought from Walmart with the brick of metal of
1629410	1635050	fields metal I bought off of eBay. I'm slowly just melting it down inside this pan.
1635810	1642310	I make a very noob mistake here. Do not make my mistake. I took a like a kebab skewer
1642310	1647050	and I was making sure it was fully melted and kind of stirring it around to make sure there
1647050	1651810	was no more chunks of metal that it was 100% completely melted on my stove. And then to make
1651810	1657390	sure I, like an idiot, swirl it around in the pan like you would with butter if you're about to fry
1657390	1663910	steak. And what I do is I just coat my entire pan with fields metal. So I lost a bit of metal
1663910	1670670	because of that. But like I said, I'm not using this pan for anything but melting fields metal
1670670	1675930	in the future. So it works perfectly. I put the wax paper underneath the ice cube tray in case I
1675930	1680310	spilt. That's the only person I have that there. If I did an overspill, it would land on the wax
1680310	1685210	paper and not my stove and my wife would still love me. So I quickly just pour this in here.
1685750	1690690	And you can see that I got a whole bunch of full cube pours and then a whole bunch of random ones.
1691530	1695150	And then you can see the cubes it makes. I think I got about 16 cubes out of that one piece of
1695150	1701070	metal. So that's enough for 16 keys. One note, when I poured into this ice cube tray, it doesn't
1701070	1706030	fully fill all the cubes. So what I did is I popped them all out. Anything that was a full cube,
1706030	1711790	I set aside. Anything that was a partial cube, I took into my melting ladle. I melted it down,
1711790	1716270	all the little fragments, little pieces, and I slowly poured them in cube by cube
1716270	1720570	until I got a full ingot for each one. So that's just a little pointer there.
1721950	1729010	So now we're going to switch to demo time, aka time to play with fire. Don't try this at home
1729550	1735430	or if you do, just don't blame me if you get hurt. I highly suggest you try this at home.
1736310	1742390	Full disclosure, I've had this demo pre-recorded for a time because it's one of those things that
1742390	1750130	with COVID going on, I've done a lot of virtual conferences. And with a virtual conference,
1750130	1754530	it's just difficult to plan ahead. So I pre-recorded the actual demonstration of this video.
1754990	1759370	So you're going to see here, the background is going to change. My hat won't, you won't see my
1759370	1763330	face. It's going to be all on table kind of thing, but you're going to see the whole demonstration.
1763330	1767710	So we're going to do that demonstration and then I'll come back right after that. Enjoy.
1768390	1771650	Okay, so I'm going to get started with my demo here. I'm going to go over what I have here on
1771650	1778170	the table. So some of the things you're going to need. The first thing is a clamshell. This is
1778170	1783290	what we're going to use to actually mold the key. This is actually 3D printed. It's fully available
1783290	1793310	for free download off thingiverse.com. And I'll try to make sure the links are available. They're
1793310	1798210	on the base. The base is pretty much so you don't have to hold this as you're pouring molten metal
1798210	1804650	into it. It just lets you freehand it. Speaking of pouring molten metal, the next thing we have
1804650	1809890	here is a ladle. And this is a lead ladle. You could use this for pouring lead, but it works
1809890	1815830	perfectly for what we're doing. So we'll be pouring the metal in to the clamshell like that.
1816550	1821950	The next thing we're going to need is some sculpting clay. This is Sculpty. It's like
1822230	1828650	a few bucks on Amazon for this package. This package is pre-split into four different bars.
1829290	1834550	And just one bar is exactly perfect to fill this mold. You rip that one bar in half and you fill
1834550	1839810	each half of the mold. It works perfect. You're going to need some baby powder, some talcum
1839810	1845290	powder. I buy this nice little jar or nice little bottle from Walmart. It's like a buck something,
1845290	1853090	just because it's small and convenient. And I travel with all this stuff in this like pencil
1853090	1858670	bag I found one time at Walmart during school shopping time. It's like a dollar or two dollars
1858670	1865590	for this zipper bag and it holds everything I need. You're going to need a lighter. I suggest
1865930	1870470	a torture cigar lighter. This is a cigar lighter. You can't really see the flame on camera I'm
1870470	1877190	guessing, but that's what that is. And then I also have the metal. So there's different kinds of
1877190	1883670	metals you can use for this. A very common popular one is called woods metal. The problem with woods
1883670	1889490	metal is that it contains lead, so it's toxic. The fumes it puts off are toxic. So I would highly
1889490	1892930	suggest against it if you're going to be doing this around kids or in the public. For your own
1892930	1898070	use, that's up to you. You decide if that's okay with you. This is Fields metal. Fields metal is
1898070	1904830	non-toxic. I get mine off Amazon and it's like $35 for a brick. And one brick makes pretty much
1904830	1910590	enough to fill this little sleeve here. So about 16 little cubes, which you saw in the previous video
1910590	1917670	that I made melting it into a pan and then pouring it in this mini ice cube tray. So let's get into
1917670	1924310	molding an actual key. So I have this lock. It's a Kwikset lock and here's the key for that lock.
1925430	1929130	It works perfect. So this is the key we're going to mold.
1930470	1933070	So to get started, I'm going to move some stuff out of the way here.
1934390	1938990	First thing I'm going to do is get my clamshell opened up and laid flat in front of me and I'm
1938990	1946820	going to open my clay. Now I try to open this nicely so that I can kind of wrap it back in
1946820	1951280	the clay later. That's only because I'm doing it for demo purposes. This doesn't really matter.
1951280	1956720	I've actually 3D printed a holder for this clay just because I like to be organized with my stuff,
1956720	1961260	especially in 3D printing. So if you look at this again, you can see that there's,
1961260	1964640	it's hard, maybe hard to see, but you can see there are these lines that pre-cuts into these
1964640	1969840	bars. And this one bar is exactly the right shape. So if I take this bar and break it in half
1971140	1977920	or relatively in half, like so, this is exactly perfect for each side. So just take one and
1978460	1985400	mash it up, just like play-doh, soften it up just a little bit. And then what you're going to do,
1985400	1988520	and it's up to you, some people like to take talcum powder and put this in so the clay comes
1988520	1993640	out easier. For demo, I don't really care. If you needed to do multiple back-to-back,
1993640	1998120	maybe that would make sense. Otherwise it doesn't matter. Anyways, I get into about a shape like
1998120	2005060	that and then I just push it down into the clamshell and try to get as flat as possible.
2006080	2012140	So I'm pushing it down in, back-filling this big gap at the top, the big void at the top.
2016830	2023110	And you want it to be as level with the top of this as possible. You don't want a big
2023110	2028150	bulge of clay sticking up because it won't give you a good mold. It'll wrap around the key, which
2028150	2039370	you do not want. So get this as flat as flat as you can. Again, it doesn't have to be absolutely
2039370	2043930	perfect. When you squish these two together, you're probably going to get some leak out. That's fine.
2043930	2051710	Just get it as best as you can. So you can see I have it. It's pretty level. It's hard to see on
2051710	2057090	camera, but it's pretty level. Now this part, you're going to want to depress this down in,
2057090	2062610	like so, to create a well because you need some place to pour the molten metal into. So I'm
2062610	2069070	creating like this lip that I can bend backwards. And it's just this well because the top of the
2069070	2074010	doesn't need to be molded. That's not important. So pretty much you do this again and just repeat
2074010	2081490	it on the other side. So I'm going to take the clay and again soften it up by squishing it.
2094100	2099400	And you want to make sure that you go above the border here. You want that lump and then you want
2099400	2104380	to press it down to flatten it out. Otherwise, if you try to skim it in, you might get an air
2104380	2108040	pocket below. And when you squish the key in, all the clay moves down and you won't get a good
2108040	2115560	impression. Okay, so I've pushed it all down in and I still have a bulge. So now I'm going to work
2115560	2122980	on getting that bulge down so it's not above the plane of the top of the clamshell. And again,
2122980	2134340	I'm going to fill this void in on the top. People have asked me if the color of clay matters. It
2134340	2139020	doesn't. Literally, if you go on Amazon, one day one color is cheaper than the other color.
2139820	2143740	So sometimes you'll see this in yellow. Sometimes you'll see it in green, black, red, blue. It
2143740	2151380	doesn't matter. It is literally just whatever's the cheapest I buy. Because why pay $8 or $5 for
2151380	2160280	red when green is $1.99. So okay, so I have that pretty well in there. I'm going to check
2160280	2166780	to make sure I don't have it too too low. I think I'm good. Now I'm just gonna again create that
2166780	2171940	well on the top of my thumb, squishing it back. So I create a lip and when I put these two together,
2171940	2175840	it'll create a pore spout kind of like this that the metal can go down in.
2177160	2182120	So now the next important part is to cover these two pieces or these two sides in talcum powder,
2182120	2186340	so that when you push the two clays together, and you separate them that they separate and
2186340	2190720	they don't just stick into one big glob of clay. So you just take a little talcum powder and
2190720	2198400	sprinkle it on the sides here. And then just take your finger and rub that talcum powder across the
2198400	2217430	top of all the clay. Just like that. Check this, it seems a little bulgy. Now that I've pressed
2217430	2223590	it down, I'm going to put a little more powder on. Okay, so we have these both sides coated.
2223750	2229590	They're good to go. So I'm done with the talcum powder. I'm done with the clay. So the next thing
2229590	2233250	we're going to need here is we're going to need the key. Now it's important that when you press
2233250	2239770	this down that you think about this key as having two halves. Have one, have two over here. You don't
2239770	2245690	want to shove the whole key down 100% into one side. You want to push it down about halfway on
2245690	2250770	one side so that when you put the other clamshell on top, half the keys on one clamshell and half
2250770	2256250	the keys on the other side of the clamshell. So to start with, I'm just going to place this in here
2256250	2262210	so that the bow of the key, which is right here,
2262210	2268950	is make sure that that's in thick clay, not in the well. So I want it down far enough that we're
2268950	2273990	good there. Okay, and then I'm going to press down and rock it back and forth, just trying to get it
2273990	2281070	down about halfway in. And just lean in and check on it. Make sure you're about halfway in all the
2281070	2287350	around. So now you can see the key stuck in halfway there. Now the next thing to do is take
2287350	2294550	this clamshell, place it on top, and then squeeze these two pieces together. Now it's suggested that
2294550	2298130	you stand on this, which I'm not going to do because you're not going to see it anyways.
2298250	2305050	So I'm just going to place my hands on the table and press. You want to get a nice firm pressure
2305050	2309830	on this and just stand on it. Put some weight on it. Give it a second for the clay to move out of
2309830	2315090	the way for the key to come in. Because remember, you have the warding and all the parts of the key
2315090	2322110	that you need to get up in. Okay, that should be good. Now you want to carefully open this,
2322110	2325490	separate it apart. Don't rock it back and forth because you're gonna mess up the clay. Just try
2325490	2331430	to get it apart as cleanly as possible, like so. And we have a pretty decent impression over here.
2331430	2336070	It looks like the key sunk in a lot on this side, so I'm hoping this all turns out well.
2336870	2341230	But you saw how the clay came apart without sticking. That's because we used the talcum powder.
2341310	2347410	So I'm going to bend this lip back. I'm going to use the true method of flicking the key out.
2347830	2351570	The reason we do this is we want to get it out as fast as possible because if you lift it up,
2351570	2355990	it can cause the tip of the key to dig into it. So we want to get it out as fast as possible.
2357550	2364430	So there, it's out. It shot across the room, but that's fine. So where do we go from here?
2364430	2368290	So the next step to do is we're going to go ahead and take these two pieces of clamshell. We're
2368290	2373590	going to put them back together. And now we have a void. Now I'm going to open up these lips on the
2373590	2378790	top to make sure that I can see down into where we're about to pour, which I can see fine. So I'm
2378790	2384090	going to place that into this holder. And this does two things. One, it keeps these two pieces
2384090	2389110	tight together. And two, it makes it so I don't have to hold this in my hands as I pour molten
2389110	2393590	metal over it. And if I bump it or miss, I'm not going to end up with melted metal all over my
2393590	2401790	hands. So the next step I'm going to do is I'm going to take out one cube of my Fields metal.
2401790	2408050	And again, this metal is meant to melt at very low melting points. So a candle or a lighter works
2408050	2414750	fine. And one cube is almost absolutely perfect for your average key. So like a standard Schlage
2414750	2422690	key or Kwikset key. So I'm going to drop this in the end of the ladle, like so. And I'm going to
2422690	2427410	try to do my best here to let you see this melt and how fast it goes. But it's going to
2427410	2435770	be kind of hard to do. So we'll do our best here. So I can already see it moving. So it's already
2435770	2441450	starting to melt. And as soon as the metal below it starts melting, you get a little bit of liquid
2441450	2446270	metal. That metal heats up the rest of the cube and it melts really quickly. So there it goes.
2447050	2452070	So now I've got to kind of look at it here to verify. So it just hit completely liquid. I'm
2452070	2455070	going to go a little bit longer to make sure it doesn't start solidifying on me quite yet.
2456110	2459710	There we go. We're good to go. And now we just pour this metal
2464790	2468450	down in. And I'm kind of doing this because I want it to get down in and I want any air
2468450	2475910	bubbles to get out. But that should be good. And now we just let it sit. Now,
2475910	2481410	depending on how long you heat this for... let me bring this in. This is silicone,
2481410	2487270	so I can put something hot on it and it won't melt. Depending on how long you heat the metal
2487270	2492450	for, it's going to take longer to cool. Now this takes quite a bit longer to cool because it's
2492450	2497890	such a low melting point. If you use woods metal, the toxic stuff, it doesn't take as long to
2498870	2505050	do. If you watch any of Deviant's videos, you'll see that he uses... his clamshell is actually...
2505050	2509830	I think it's milled out of aluminum, which if you think about what aluminum is, it's a heat sink.
2510310	2514990	So that would help awesome to cool the key faster. Where this is plastic, this isn't going
2514990	2520650	as a heat sink. So if you can get a metal clamshell, great. Again, it's not needed. This is
2520650	2525830	super simple to make. It's probably like a few dollars worth of plastic in this. So it works
2525830	2529430	really well. You don't have to have metal if you've ever seen it. When I first started, that's
2529430	2532690	why, again, that's what I thought. I thought, oh, I didn't have a metal clamshell. How am I supposed
2532690	2539870	to try this? And when I saw the 3D printed one, it was fantastic. So I'm watching the top. I'm kind
2539870	2545110	of shaking it, and I can see that the center is starting to solidify. But the sides are still
2545110	2550290	jiggly. And I wish I could tip this to show you, but if I do, that metal might run out. So it doesn't
2550290	2555870	have to be cooled down to take it out, but it does need to be solidified. So we're going to finish
2555870	2560490	letting this go here. I'm just tapping it. And pretty much what I'm looking for is if the metal
2560490	2565410	is still kind of jello-y on top, or you can see liquid still. And as soon as I don't see that
2565410	2569830	anymore, then I'm pretty sure we're good to go. So there's just a few little spots that are still
2569830	2579830	like that down in here. We're very close now. Some very, very small spots still jiggling, which means
2579830	2584410	they're cooling off. And if you open this too early, and it's not solidified down, you're going
2584410	2607520	to have molten metal just running out. So better to be safe than sorry. Okay, it looks pretty
2607520	2613460	solidified. I'm going to give it a couple, like one more minute here, just to cool off a little bit
2613460	2620480	to guarantee it's good all the way down. And when we pull this out, you may or may not see some gaps,
2620480	2625380	some air gaps, that's fine. The key can still work. The important part, obviously, is the
2625380	2630340	bidding of the key and the warding. But if there's holes in the warding, we're fine. If there's holes
2630340	2634320	in the bidding, then we have problems because there might make a dip where it won't lift the
2634320	2639540	pins to the proper height. Okay, I think we're good. So I'm gonna go ahead and take the base off this.
2640980	2643120	Okay, and then we're going to split this open.
2645120	2650140	And it looks like we have a good casting. So let's see, well, I've got to keep it in the light so you can
2650140	2656180	see it here. So there's the key. And you can see, we just, we don't have the entire top of the head.
2656220	2660500	We have just enough, though, that we can grab onto it and turn it. And we can see all the key in here,
2660500	2666940	we can see the warding. So let's go ahead and peel this out. So we've got a little clay on the tip,
2666940	2671620	that's not a big deal. Just pull it off. So you can see there's a lot of flashing around here and
2671620	2675760	stuff like that. But again, none of this matters. And if that bothers you, it's so thin and soft.
2675760	2683060	Just bend it back. Okay, now we have a little bit of flashing, it looks like, around this bidding area.
2684340	2689960	But again, I'm not overly concerned with that because of the way the cut is. I can just kind
2689960	2694820	of bend that flashing out of the way. So I think we're completely good to go here.
2695220	2699100	So now it's the moment of truth. Because, you know, demos fail.
2700180	2706100	What's new? So let's place it into the lock. It goes into the lock. That's good news. Now we'll
2706100	2711700	open the lock. There it goes. So there was that little bit of flashing. So when I first started
2711700	2715940	turning it, it caught. But as soon as I turned that flashing bent out of the way, we're good to go.
2715940	2722440	So now we have a fully working duplicate of that key. So like when we talked about with 3D printing
2722440	2728100	of this key, this key is very bendable. It's very soft. But I can take a pair of calipers or again,
2728100	2734700	I can take the key depth measurement guide here. Let's see, quick set. Where'd you go?
2735320	2740960	There. And I can take this now. I can get the measurements from this on my own time because
2740960	2746640	I have a duplicate of this key now. Take my own time to get my measurements. I can 3D print this
2746640	2752720	key and take this to a key me or a key duplication, unmanned key duplication machine and have a
2752720	2756960	permanent copy of this key forever. If you only need to get them once or twice, this will work.
2756960	2765240	Again, this will last for a while. So I'm making a mess, but like that, it worked perfectly.
2765240	2770540	However, I want to show that this key is soft. So I'm going to bend it here just to show you.
2771960	2777200	That doesn't take a lot of power to bend that. You can see it's completely bent key now.
2779040	2785620	But if I lay it on a table, I flatten it back out. We're still, we should be good to go. Let
2785620	2795580	me just test it. Yep, we still get an open. So that is duplicating key with casting a key and
2795580	2804080	melting metal and casting it in clay. So let me flip back to my other screen here and we'll
2804080	2811660	continue on. Okay. So time to get some credit here. So first of all, we have the keygen.co.
2811660	2817580	There's the GitHub repository for that. And below that is the talk I specifically mentioned earlier
2818280	2825560	where keygen.co came from. It was from DEF CON 21, key decoding and duplication attacks for the
2825560	2831160	YouTube video of that talk. And that was done by David Lawrence, Eric Van Albert, and Robert
2831160	2836860	Johnson. Big shout out to them. I believe the tool is also available as just a Python script you can
2836860	2840660	download and run locally. So you don't need to rely on their website. The website is just super
2840660	2847320	quick and easy. Obviously, I have to give a massive shout out to Devin Olaf. I didn't think I
2847320	2852200	could do key duplication before I saw his video. After watching that video, he gave an in-depth,
2852200	2856720	very, very detailed way of how to do key duplication. And the fact that he mentioned
2856720	2861260	you could use 3D printed clamshells is what even sent me down this path. So check out his website
2861260	2868220	and check out his Twitter. And then the link below that is the original key molding and casting video.
2868220	2873880	And again, a big shout out to Boris for the 3D printed clamshell that he makes freely available
2873880	2879580	to the world on Thingiverse. If you go back in the slides, you will definitely see the link to that.
2879580	2884760	So I want to thank you guys for letting me talk to you today about key duplication.
2885080	2889820	If you have a 3D printer, please give this a try. It's super simple. Just enter a random
2889820	2893860	bidding code, if you will, just to test it out and print a 3D key just so you can see how easy
2893860	2897500	it is. If you have your own key, go ahead and duplicate your own key just to test it out and
2897500	2902320	see how well it works. It's super simple using thekeygen.co. If you have any questions, any
2902320	2905860	comments, or anything else you want to talk about, again, hit me up at Twitter,
2905860	2911560	at Vareli. It's the easiest way to find me. And then questions. If you have questions,
2911560	2914540	obviously I'll be sticking around. You can find me in the Discord channel.
2914540	2918900	I'll be available to answer any questions you might have, details about printing,
2918900	2923480	molding and casting, anything like that. So again, I want to thank you for taking the time to watch
2923480	2928360	this presentation. I hope you have a great DEF CON safe mode and stick around at the
2928360	2933480	Lockpicking Village with Tool for all the other amazing talks that are coming up. Thanks a lot.