Welcome to my talk. I'm going to be chatting about wafer locks today and why they're awesome.
It's going to be very theoretical, and it's going to be mainly coming at this from the
lock engineer's perspective, if I might be allowed to flatter myself.
I'll start by telling you a bit about who I am. And then I'll cover some definitions so that
we're all on the same page. And then I'll show you a small selection of wafer locks through my eyes.
So who is this loon who thinks wafer locks are pretty secure? Well, it all started about three
years ago, when I thought it would be a good idea to design a challenge lock for HuxleyPig69,
who is renowned in the lockpicking community for being the first person to publicly pick
the Abloy Classic, and who designs tools for cracking high security locks non-destructively.
In the last year or so of this now three-year journey, most of my focus has been taken up by
wafer locks. And that's not because I've finally broken down mentally and started rambling,
but rather because I genuinely think they offer a good solution to the problem of designing a
high-security lock. So what makes a lock high security? Well, a lock is a reusable seal,
which has two important properties. It's got to be tamper-evident, so that if the lock is defeated,
it's obvious. And the second important feature is that defeating that lock should take as long
as possible. Ideally, you're able to preclude covert and surreptitious attacks,
and ideally an overt entry will take forever.
An overt entry is one that is immediately obvious,
so that's typically destructive attacks like drilling or using explosives.
Covert entry is an attack on a lock that won't be immediately obvious to a casual observation,
but if you were to strip the lock down and analyze it forensically,
it will reveal what method was used to open it. So this normally covers lock picking and
impressioning, because they leave small scratches and marks on the inside of the lock.
And finally, there's surreptitious attacks, which don't leave any forensic trace whatsoever,
and this would be stuff like duplicating the key from a photograph.
And how high security a lock is is determined by the amount of time it takes to compromise a lock
with an attack in each of those categories. Ideally, you wouldn't be measuring that in
seconds. Ideally, you'd be measuring it in minutes or, you know, in a really,
really good world where security engineers are doing a fantastic job in hours.
So, since those locks are designed, or since high security locks are designed to make lock picking
and impressioning attacks as difficult as possible, if not impossible, a lot of them have been designed
with some very wacky mechanisms. So you can't always take the approach that you would normally
take if you were picking a pin tumbler lock and apply that directly to a high security lock.
So instead, I've kind of abstracted the lock picking process into these four requirements.
You need to be able to get feedback from the lock, because that's how you tell what state
the lock is in and how close you are to having it open. And it also tells you what your next
step might be to get the lock open. You need to be able to manipulate and tension the lock
simultaneously. So some locks like the Western Electric 30C or the Abloy Protech 2 have blocking
mechanisms that, while not preventing manipulation or tension, prevent you from doing them both at
the same time. And so they're phenomenally difficult locks to pick as a result. By tension,
I mean applying a force on the lock in the direction that drives it to open.
So how you do that depends on the particular kind of lock. But the key idea behind this is that
since it's impossible to manufacture the components in a lock perfectly,
and you have manufacturing tolerances,
these manufacturing tolerances result in every single component being very slightly differently
sized or shaped, which then causes them all to behave very slightly differently.
And that's the case regardless of how well you machine the parts,
and regardless of whether or not you have a very low quality lock or a very high quality lock.
And finally, manipulation. Manipulation is just the ability to
move the components inside the lock with a tool of some design.
Those are the things to keep in mind when I start taking you through these locks.
So what is a wafer lock? This should be pretty straightforward, but
apparently for some people that that's not quite so clear. Some people whom I happen to have a lot
of respect for, so that is not to criticize them in that sense, but I do disagree. And
the reason I disagree sometimes with whether or not a lock is a wafer lock or not is because this
is how I define it. And if you're working off a different definition, then obviously in some
cases you're going to get to a different answer. So we've got some typical sliders shown in the
top corner here. These two are from an Asidesmo, which is a reasonably high security lock,
but not one that I would probably deem high security for the purposes of this talk.
And these are from a cheap wafer lock, not wafer lock, slider lock.
And in both cases they slide laterally and they have to be slid the correct distance
to allow the lock to open. A wafer lock is a special kind of slider lock where the total
length of the wafer is the same as the width of the core that they actually sit in. So
here's an animation to kind of make that a little bit clearer. When the wafer is incorrectly
positioned, it sticks out either one side or the other and prevents rotation. And when it's
perfectly correctly positioned in the center there, it will allow rotation.
So to start things off, let's take a look at the kind of wafer lock that you're probably familiar
with and the kind of thing that probably sprang to mind when you first read the word wafer lock,
if you've had any prior experience. If you haven't got any clue what a wafer lock is
in a normal implementation, then that's exactly what I'm going to take you through.
So at the top here we can see six wafers sticking out the top of this core.
And this is the lock at rest.
If we insert an incorrect key, or if we insert the correct key but not all the way,
then what you'll see is that some wafers will stick out at the top and some wafers will stick
out at the bottom of the core. And this will prevent rotation. When the key is fully inserted,
or the correct key is fully inserted, then what happens is they all line up along the top and
bottom edges of the plug, or the core, and they allow rotation of the core. So, excellent.
But that's not a high security lock. There are three cuts per position and only six wafers,
so that's not a very large number of differs. The core design makes it very easy to tension,
you can just bend a piece of wire and insert that, apply rotational force, and voila, you have
tension. And interestingly about wafer locks, you can't just design anti-pick shapes into them
in the exact same way that you would a pin tumbler lock. It's possible to do,
but it's a little bit more tricky than for a normal pin tumbler lock.
So, now that I've shown you an example of a really bad wafer lock, let's revisit the actual
principle behind wafer locks, and maybe I can show you a wafer lock that wouldn't be so easy to pick.
The main idea here is to approach the design differently. So, rather than our cheap,
low-quality wafer lock, which has a key which applies tension to the core, and then the core
applies tension to the wafers, and ultimately opens the lock, we can achieve a much, much higher
level of security if instead, we have the key only act on the wafers, and never directly act
on the core. So, if we have a key that aligns the wafers correctly, and applies turning force
to the wafers, and then the wafers transfer their turning force to the core,
if they're correctly aligned, the lock will still work, but it's a lot, lot harder to tension.
So, to show you what I'm talking about, here's another animation. This one, much less well-made
than the other one. This grey bit in the middle is our key, the beige-yellow element is the wafer,
the part highlighted in blue is the core, and all around the outside in grey again is the housing.
So, the way this works, the key is longer on one side than it is on the other, and when we turn it
clockwise, it makes contact with the wafer on one side first. So, in this case, it makes contact
at the bottom, and that causes the wafer to slide to the left. And the wafer slides to the left until
it meets the other side of the key, at which point there's no longer a lateral motion for the wafer,
but instead it gets jammed in place like that, and the force on it becomes a rotational force.
In this case, the wafer is correctly aligned, so that rotational force is then
transferred to the core, and that results in the core turning. If it weren't correctly aligned,
then what would happen instead is that rotational force would be applied to the housing,
and the core wouldn't move at all. If you want to have a system that works that way,
then there are two key requirements that you need to meet. Firstly, as I just mentioned,
the wafer has to be aligned correctly, otherwise it's going to apply that rotational force to
the housing, and nothing will move. And secondly, the key must have at least two points of contact
on the wafer, on opposing sides of the wafer. That's the point at which that lateral force
is translated into a rotational force.
That's something to keep in mind for later when we take a look at some of the more interesting
locks. So the main implication of this is that the lock becomes ludicrously difficult to tension,
because traditionally what you would do is you'd apply tension as the first step in the lock
process. And when you do that, at least one of the elements is going to bind in some way.
And then you can reach through with some kind of tool and prod on those elements until you find
one that's binding, and that's the one that you know you need to move. And you can move until it
stops binding, at which point you know you've correctly positioned it. But that's not possible
with this, because in this case you're going to have to align one of the wafers correctly first
in order to apply tension. And since you can't apply tension before that point in order to know
where to place it, you have to guess. So in the example animation that we just looked at,
if I go back, there are six possible positions. So that means you would need a tool that has
six different ends on it to simulate the key at that point.
And what that means is that because only one of those tools will work, the whole lock picking
process, and how quickly you can open that lock covertly, is massively extended, because you're
going to have to test each of those tools until you find one that works. And on average, it would
take you three and a half tries. So the amount of time it would take is massively increased,
because that's the requirement before you can even begin the lock picking process,
compared to other kinds of lock, where you can just apply tension and get started straight away.
So the main wafer lock that I want to look at is the Chroma Protector.
But there are a number of problems looking at the Chroma Protector. At the time that I started
thinking about it, I didn't own one, so that made looking at how it worked tricky.
And generally, information on it is scarce. Here are the sources that I've found and I've
learned from. It's worth noting that Graham Pulford, in his book High Security Mechanical
Locks, refers to the Chroma Protector as a lever lock. Now he does this because he categorizes
locks based off the design of the keys. But I think it would be very misleading to describe
the Chroma Protector as anything other than a wafer lock. And if you really want to dig into
the detail of the Chroma Protector and exactly how it works, Jakob Fagerlund's talk is absolutely
fantastic and I highly, highly recommend it. So as I was saying, the Chroma Protector
is a lock that I didn't have access to, so there was a motivation to make one for myself
and so that I could test whether or not it worked in the way that I thought it did.
I'd been thinking about it theoretically for quite a long time, but things don't always
translate into practice in the same way. So I wanted a prototype that I could play around with
and that would prove whether or not it worked in the way I expected it to. The other reason is,
when you design a lock, you tend to gain a lot of insight into how that mechanism works and why
some of the design features have developed in the way that they have. And so my hope was that
since the Chroma Protector is a reasonably complicated lock in terms of some of the
particular security features that are found in it, that I might gain some extra insight.
So I've previously designed locks and the only one that I ever produced was made of
three millimeter plywood sections cut with a laser cutter. So that's exactly what I wanted
to do again with the Chroma Protector because I had access to a laser cutter and I had access
to 3D printers and so that was the logical step for me. And I couldn't see any reason why the
design couldn't work that way. I wanted to fit the same size as the Chroma Protector that I now have
because if you design with the same constraints as the actual engineers who designed the lock,
whose inspiration you're taking, you'll get a better understanding of why they've made those
decisions. If I didn't limit myself in that way, I might miss important details.
And finally, I wanted to include all of the different basic possible
way for designs that I had found in patents up until that time. So
if I take you back here, there are some examples, but we'll dig into that in just a little bit.
Some of the other requirements that I set for myself were that I wanted it to be springless.
And I wanted it to be springless because A, I couldn't see a good reason why
the mechanism needed springs at the time, and B, because most safe locks are designed so that
since springs fail generally first, most safe locks are designed so that they are not
dependent on those springs in order to function.
Because you don't want to have your secure lock inside your secure container fail on you.
And also adding them, point B, is a bit of a pain and makes designing them a lot harder,
designing the whole lock a little bit harder, especially if I were then to give this design
to other people for them to learn about. I wanted it to be as high security as you
can possibly get, considering I'm making it out of three millimeter plywood.
So I didn't, in terms of non-destructive entry, I didn't want it to be possible to just
look at the insides of the wafers through the keyway
and from their shapes discern what the bitting on the key needed to be,
or needs to be to get that lock open. I also didn't want it to be possible to just push
the wafers to their maximum range, left and right, and for that to be different.
Because if that's different and has any kind of relationship
to the actual length on the sides of the wafers, then you can rapidly gain an idea of
what the key has to look like.
And then I wanted the lock to also be self-scrambling.
So self-scrambling is this concept that all locks do, and lots of locks do this through
having springs, but that's not necessarily required. The idea behind a self-scrambling
lock is simply that when you insert the key to open the lock, and you turn that key,
it aligns all the components in their correct positions. And if you then close the lock,
one of the important things would be to scramble the positions of those components
so that the next person coming along who looks at the lock after you've locked it
doesn't just need to stick in a small bit of wire and apply a bit of tension, and the lock pops open.
I didn't want it to be a central wafer position. This was kind of just a minor I-want-to-be-annoying
feature. If a wafer were correctly positioned dead center, it would be substantially easier
to tension than any of the other designs, because any tool that has equally length bits
on either side would be sufficient to tension. Whereas that's not the case for any of the other
positions. So I thought if I could take that out of the equation, that would make the lock
just a little bit more secure. And the final problem that I ran into was reliability. So
this is kind of related to the spring, what I was saying about springs earlier,
but this is kind of just the idea that there shouldn't be a possible position that the
wafers could get themselves into where you couldn't insert the key into the lock.
Unfortunately, that's something I failed on. I couldn't balance making my lock without any
springs, having it be self-scrambling, and have there been no possible positions which
the wafers could get into where the key couldn't be inserted into the lock.
That was just beyond my ability as a self-taught engineer to resolve.
So, what I came up with. I used a 3D printed key. The lock itself contains seven wafers.
The key is tip-stopped, and the key has a very mild profile,
so you can't insert it the wrong way. And it will align both at the end
and at the neck, basically, or at the collar of the key. So that helps with alignment.
And it breaks itself open. So this was the most important thing that I learned when designing this,
when I finally had it in my hands. You need two points of contact on a wafer in order to
rotate it, or in order to tension with it. And that's all well and good in the opening direction,
but I found as soon as I reversed the key, there was no more than one point of contact on any of
the wafers, and so the key can't turn the core backwards. And so once you open it, it stays open.
Which is a little bit unfortunate. But nevertheless,
I'll do my best to make the files available for others to play with.
Here are the four basic wafer shapes that I ended up creating, and they all work,
in the open direction at least. On the bottom right, we have a full wafer. This is the bog
standard wafer, and most closely resembles what you'd see in other kinds of wafer lock.
On the bottom left, we have a half wafer. The idea being that
it's missing one half of the surface, so the key can't tension off this wafer in order to drive
the core around, but it still needs to align that wafer correctly in order for the lock to open. So
that makes it a little bit harder to attack, because this wafer would be much harder to
tension than a full wafer. Up here on the top right, we have a split wafer that doesn't have
a limit on it at either end. So this basically functions like two half wafers. So you need to
align both of them correctly, and they're actually different cuts for each of them.
And then lastly, in the top left, we have the limited split wafer, which
requires that the key be the correct length in order to drive both these halves together,
so that their total length is the same as the core is wide. But they also need to be aligned
correctly left to right. And the hope was that that would be particularly difficult
to manipulate, and I want to see how that bound up when it did.
So my analysis of it. You can't easily decode it, and it does work in the opening direction.
It does self-scramble,
and it might be non-trivial to destroy if it weren't made of three millimeter plywood sections.
But all in all, probably not something you're going to want to use
in a safe, especially not when you could use something like this.
So this is really the inspiration for my design, and I'm not going to claim any great originality
with what I created. I was hoping to just create a simplified version of this.
So I'll give you some basic details about it. It's 68 millimeters across, and it weighs 730 grams.
It is not a small lock. It contains 11 wafers, which from a brief reading of the key,
have at least seven possible cuts per position.
There may be more. In practice, there are probably fewer in lots of positions, because
although in theory any of the layers are completely interchangeable,
in practice, at least for the ones that I have seen and that Jaco analyzed in his talk,
there seem to be certain patterns of wafers where some of them don't actually vary very often in
position or cut. So two things to note about my Chroma lock. One, it's not made by Chroma.
I suspect heavily that it is made by Carl Wittkop or Carvey, which is a German safe manufacturer,
presumably under license. And the second detail is that I'm pretty sure that my
Chroma Protector is not the latest version of Chroma Protector. However,
this was the same Chroma Protector as Jaco was covering in his talk,
and so I feel pretty happy that there's still some benefit worth looking at this.
So we'll start by looking at the key, because the key is pretty complicated.
And there are a whole bunch of details to pick out. Here are the seven that I've decided to pick
out. So the Chroma Protector has a post. So it's basically got a large spike that runs the length
of the lock down the center, which helps align the key, but also removes space that you'd want
if you were going to design a tool to fit into the keyway and to manipulate the wafers.
It's also got this ramp. And if you design a tool to fit inside the lock that doesn't have this ramp,
what you'll find is that one of the wafers has a portion of it that sticks into the keyway,
and so you won't be able to insert your tool all the way into the lock
unless you simulate this ramp. And interestingly, at least in principle,
if you were designing a tool, you'd need to have that ramp on both sides so that you can
push the tool in and pull it back out, back past that little ledge on that wafer when that
wafer springs back into position. But the problem you're going to run into
is that this ramp is the same width as one cut. So if you're designing a tool,
what you really want is you want a tool that allows you to manipulate wafers individually.
You don't want to have a tool that's so thick that it's going to manipulate
two wafers at a time. That would make it phenomenally difficult to position
each one of them individually correctly. So you'd be in a bit of a bind in terms of
how to handle this ramp. The last option would be to create a half-height ramp
and make your tool a little bit smaller than the total space that you've got.
But again, that's not really ideal.
Then we've got these angled cuts which, to the best of my knowledge, are just there to make
key duplication harder because, as I mentioned way back near the beginning of the talk,
key duplication is one of the possible methods of surreptitious entry.
So for a high security lock, you want to make key duplication as difficult as possible.
So those angled cuts look like they're about 45 degrees. I haven't measured,
but they look like they're about 45 degrees and they make key duplication much harder.
There's also this weird angled cut. If you look closely, you can see that each of these
other cuts on the key are horizontal except this one. And this one actually cuts across
more than one wafer and engages a flexible portion on the corresponding wafer,
which I believe is wafer 9 in this particular case. Again, I believe this is for key duplication
because, from what Jaakko said about chroma protectors that he's looked at,
it's not been necessary to have that cut on a tool. And that's also definitely the case for my lock.
But still, it's another interesting feature that would make duplicating this key very,
very tricky. I've got these partial radial cuts which cut into the bitting of the key,
but not all the way through. And again, there's a potential there to make key
duplication much harder if they truly need to be cut out in order to allow correct alignment
of the wafer. You could probably, in most cases, get away with this and not worry about it if you
were designing a tool to manipulate the wafers, but this is yet another thing to worry about if
you were going to try and copy one of these keys. Then we've got what is probably the most
interesting feature, I would say, on the lock, or sorry, on the key for me, which is this undercut.
And this undercut is a cut that's made so deeply that it cuts into the actual shank of the key.
And so when you insert the key, the particular portion of the wafer that engages with this
undercut first has to meet this ramp, and so you need this sort of slot on the key.
And if it's able to, it'll travel all the way up, and it'll stop when the key is fully seated
in line with the undercut, and then as you turn the key, the undercut will pass through the
interposition. Now, that doesn't actually mean that you couldn't design a tool that uses the
whole shank space, but you could design the undercut to cut so deeply that it even cuts
all the way through to the post. And if you did that, the key would have a hole in it,
which wouldn't be a big deal for the key because it's solid, and that would only be one tiny weak
point that would be relatively well supported. But if you're going to design a tool and that
undercut could be in any position, well, that's a tricky problem to design around,
and it would multiply the number of tools that you would reasonably need in order to
open this lock. Now remember, you'd need to line one of those wafers up correctly in order to
tension the lock anyway. So you'd need seven different tips on your tool, and you might need
several different shafts, and it might not be possible to create those separately and viably,
so assuming you had seven different ends and 11 wafers where that undercut could exist,
well, that's 77 different tools that you'd need to bring on a job of which only one of them will
work. So this is a huge exaggeration of the problem, which would hugely increase the amount
of time it would take in order to reliably manipulate open one of these locks, even if
you did have a tool that could do it. And finally, we have this dimpled cut. Now, Jaakko didn't
actually have an answer... Jaakko didn't actually have an answer to this in his talk as to what it's
there for. And I should point out, I am not an expert on this lock. That title almost certainly
belongs to some German safe mechanic. But I can offer a theory. And that theory is that
the fourth wafer in the Chromium Protector handles counter-rotation. So the Chromium
Protector handles counter-rotation by allowing essentially the full movement of the key to about
45 degrees within the lock. And so at any point that you are opening the lock, you can turn the
key back basically the whole way, or back basically 45 degrees. If you do that, then
what you'll find is that the fourth wafer in this particular case, it's cut so that it
makes contact with both sides of the key simultaneously. And that wafer handles the
counter-rotation of the core, which is the missing element in the lock that I created.
However, if you don't have this dimpled cut on this surface of the key,
then what happens when you attempt to turn the lock, to turn the key backwards in the lock, is
that you actually make contact with a protrusion on wafer number nine before the key makes contact
on two points with wafer number four. And so exactly the same, at least in theory, as with my
lock, you'd be trapped in a position where you only have one point of contact with any wafer in
the lock, and so you can't easily counter-rotate the lock, because the harder you turn backwards,
the harder you force the wafer against the side of the housing, and the greater the frictional forces.
So my theory is that this is another trap when it comes to key duplication,
where if you failed to replicate that sufficiently well,
what would happen is that even though you may have a key that opens the lock,
you then wouldn't be able to remove the key from the lock, and so the key would
remain inside the lock, and the lock would still be tamper-evident,
even though it had been successfully defeated, which was one of the requirements for a high
security lock. To move away from the key and back to the lock, let's take a look at the keyway.
There is no core that you can tension up. This is a solid plate that's held in with three screws.
There is no way to tension the lock directly around the keyway, and in the center you can
see the poster, which matches the hole in the key, and you can start to see some of the different
shapes of the wafers through the keyway. Here it is with that top layer taken off,
and so we can see the top layer, layer 11, which is one of those split wafers, and it's the only
wafer, or set of wafers in this lock, the only layer that isn't actually sprung.
And we can kind of see looking down that we have, here's the little portion that sticks out that
engages with the ramp, and this little slightly curved portion is the portion that engages with
the weird angled cut. And you can sort of see that every single wafer all the way down is very
differently shaped. And so as a result, it's very, very difficult to look at them and try and discern
any kind of meaningful pattern in order to decode which position that wafer might need to be placed
in order to open the lock. Having now covered the basic idea behind the wafers, and without
digging too much into how each of them works, there are two wafers that I'm going to draw
particular focus to. The first wafer is number 7 in my lock, which has a square cut out in one
corner of the wafer end. This effectively acts a bit like a false gate does on a traditional
on traditional slide locks, albeit less effectively. And this is one of the reasons why I think false
gates spooling and serrations aren't so simple when it comes to wafer locks. For this cut out
to have an effect, all the other wafers would first have to be set correctly, and then the
core will turn partially and stop getting caught in this cut out. Sounds like it'd hamper an attacker
pretty effectively, right? Except there's no way for the other wafers to counter-rotate the core.
The wafer itself supplies no counter-rotation either, because it can't with the notch squared
off. And what this means is that an attacker needs only to keep pushing on the wafers until they
finally fall into place. They can't lose progress towards getting the lock open, they can only really
gain progress. So that was the boring detail of the two. The other one reveals what I think
personally is the Achilles heel of all wafer locks design's tension of the wafers. And yes, I think
they're high security, but I still think they do have a fundamental problem, and it's a very difficult
one to grapple with. And I think that problem is essentially getting the lock to counter-rotate
open again when you're using those wafers to tension the lock to open it. I mean, of course
I think that, right? Because that's the design feature that I overlooked in my own design, right?
But I then did a lot of thinking about how to solve that problem.
So the animation on the left here is the most obvious and basic approach to solving that
problem. You've kind of got this like bow tie or hourglass style cutout, and essentially
any bit on the key when turned, in this case 45 degrees, will begin to tension the lock.
And as long as nothing blocks the key when it's counter-rotating,
you can counter-rotate or make contact on
two surfaces again, and it'll counter-rotate really smoothly. The only problem with this is
this wafer doesn't have the freedom to move at all, and so it'll trivially...
it'll allow the lock to be tensioned trivially, which undoes the whole point in designing the
lock to tension off the wafers in the first place. So the way they've tried to do this
in the chroma is a little bit more complicated than that. If you take a look at the animation
on the right hand side, this is the exact same animation as the one on the left, just with a
little bit more material cut away. It still functions in exactly the same way, but hopefully
you can see the similarities between the animation on the right hand side and wafer number four in
my chroma lock. The only difference between the animation on the right and the actual wafer in
my lock is that in the top right hand corner they haven't given the same surface to tension off as
in the animation. They've got a surface which the key needs to touch and move laterally into the
position. But when you design the wafer this way, what you'll find is that the
the prong that sticks out here on the bottom right hand side
obstructs the keyway. And in fact you might even be able to see this kind of darker portion on it
where that surface has kind of been rubbed away a little bit or has become worn. And the reason
for that is this is the portion of the wafer that makes contact with the ramp on the key.
And so the real reason to have the ramp is to correctly, well to allow the key to enter the
lock while not having to have this counter rotation wafer already set in the correct position.
Attacking wise though, these two surfaces on the key need to engage at the same time.
So if you have any tool which is equally lengthed and you counter rotate in the wrong direction
deliberately, you will align this wafer correctly. And if you had some kind of method of then
identifying how far away the surface is that the key would have to make contact with in order to
tension it clockwise, then you'd know the correct position of at least one wafer and you could
decode that. And that would allow you to tension the lock. So ultimately is this lock impossible
to breach or manipulate or pick? No, there have been reports of people managing it, at least
against some versions of the lock, even if there aren't any recordings on YouTube. But this is also
a phenomenally high security lock. It is hugely drill resistant, it uses a special plate right at
the bottom of the keyway to add extra drill resistance on top of the already significant
resistance of the plates that sit on top of the lock and effectively function as the faceplate.
The kind of totally patternless way that most of the inside surfaces of all the wafers have
been cut away means that it's incredibly difficult to decode. And in a best case scenario, if you had
huge number of samples, thousands of these locks, then you'd be able to maybe carry out some kind
of decoding. In a worst case scenario, for the attacker at least, what will be happening at the
factory is they will truly do something to randomize all of those shapes and so there will
never be a pattern no matter how many samples you collect. There's no way for us to easily
work out which one is the case, but it does seem like it would take a phenomenal amount
of resources to work out how to decode one of these locks. I didn't really discuss the blow
ring at all, but that's something to discuss. So around the back of the lock is a... if we can go
back... oh boy, okay, that's a bit further than I want to go back. Right, so there we go.
The brass ring that sits around the outer edge of this lock is the blow ring. And from my
understanding, the way that it's designed is so that if you pack the middle of the lock through
the keyway with explosive, which is one of the big downsides of keyed safe locks, is that you
can pack them full of explosive. When you detonate that explosive to create high pressure to tear
the lock apart, rather than the entire lock completely tearing itself to pieces, what happens
instead is the blow ring gives way under the high pressure before the lock actually does dismantle
itself, since the blow ring is much softer metal than the rest of the body.
And so what will happen is you'll end up fusing together all the various wafers in the middle
into one horrible blob, and the lock won't be opened. And so at that point the only option
would be to completely obliterate the lock. And considering this is normally used in
high security containers or vaults, this sort of thing, that means you have to go through the
entire surface of that vault or container, which will be no easy feat. And that brings me
on to the the final point, which is the super super tight tolerances. So I've attempted to
manipulate my lock with the face cover removed and applying direct tension to the core, which
obviously is cheating, right? You wouldn't be able to do that if the lock were actually
installed in a container. But even doing that, even basically ignoring the main security feature
that the lock has, and attempting to manipulate it like that, the tolerances are so incredibly tight
that with even more than two or three wafers, I can't manipulate the lock and have the wafers
hold in place even when they bind. They do bind, and it's possible to detect that with enough
force, and it's possible to move them into position, but they drop really really easily,
which makes it phenomenally hard to manipulate. And all in all, I would say this is a phenomenally
secure lock. And it largely achieves the goals that high security locks have.
And it's a wafer lock. So clearly, there is some potential for wafer locks to provide security
that we're looking for in high security locks in a way that isn't perhaps as inherent to,
for example, pin tumble locks. I can't think of a pin tumble lock that has a comparable
challenge with tensioning or manipulation.
So there we go. Hopefully I've convinced you that while lots of wafer locks are low security,
the wafer lock principle itself, especially when you have
the key tension, the wafers, which then tensions the core,
is actually really really quite high security, and it's got great potential to deliver
a much higher security solution than other types of lock design.
So hopefully you learned something. Hopefully I convinced you.
And I presume now we will lead into the question and answer section. Thank you very much.