start	end	text
700	5580	Welcome to my talk. I'm going to be chatting about wafer locks today and why they're awesome.
6080	10160	It's going to be very theoretical, and it's going to be mainly coming at this from the
10160	14100	lock engineer's perspective, if I might be allowed to flatter myself.
14700	20960	I'll start by telling you a bit about who I am. And then I'll cover some definitions so that
20960	26440	we're all on the same page. And then I'll show you a small selection of wafer locks through my eyes.
28140	33860	So who is this loon who thinks wafer locks are pretty secure? Well, it all started about three
33860	40020	years ago, when I thought it would be a good idea to design a challenge lock for HuxleyPig69,
40020	44600	who is renowned in the lockpicking community for being the first person to publicly pick
44600	53340	the Abloy Classic, and who designs tools for cracking high security locks non-destructively.
56390	63370	In the last year or so of this now three-year journey, most of my focus has been taken up by
63370	71490	wafer locks. And that's not because I've finally broken down mentally and started rambling,
71490	79030	but rather because I genuinely think they offer a good solution to the problem of designing a
79030	86710	high-security lock. So what makes a lock high security? Well, a lock is a reusable seal,
86710	92650	which has two important properties. It's got to be tamper-evident, so that if the lock is defeated,
92650	100770	it's obvious. And the second important feature is that defeating that lock should take as long
100770	109600	as possible. Ideally, you're able to preclude covert and surreptitious attacks,
110760	115030	and ideally an overt entry will take forever.
116900	121160	An overt entry is one that is immediately obvious,
121160	124910	so that's typically destructive attacks like drilling or using explosives.
126740	135660	Covert entry is an attack on a lock that won't be immediately obvious to a casual observation,
135660	139280	but if you were to strip the lock down and analyze it forensically,
139280	145360	it will reveal what method was used to open it. So this normally covers lock picking and
145360	149120	impressioning, because they leave small scratches and marks on the inside of the lock.
150160	155680	And finally, there's surreptitious attacks, which don't leave any forensic trace whatsoever,
155680	159900	and this would be stuff like duplicating the key from a photograph.
162220	169880	And how high security a lock is is determined by the amount of time it takes to compromise a lock
169880	175840	with an attack in each of those categories. Ideally, you wouldn't be measuring that in
175840	180480	seconds. Ideally, you'd be measuring it in minutes or, you know, in a really,
180480	184500	really good world where security engineers are doing a fantastic job in hours.
186480	194300	So, since those locks are designed, or since high security locks are designed to make lock picking
194300	202420	and impressioning attacks as difficult as possible, if not impossible, a lot of them have been designed
202420	210560	with some very wacky mechanisms. So you can't always take the approach that you would normally
210560	216540	take if you were picking a pin tumbler lock and apply that directly to a high security lock.
217620	223360	So instead, I've kind of abstracted the lock picking process into these four requirements.
224040	228020	You need to be able to get feedback from the lock, because that's how you tell what state
228020	233620	the lock is in and how close you are to having it open. And it also tells you what your next
233620	240280	step might be to get the lock open. You need to be able to manipulate and tension the lock
240280	248640	simultaneously. So some locks like the Western Electric 30C or the Abloy Protech 2 have blocking
248640	254400	mechanisms that, while not preventing manipulation or tension, prevent you from doing them both at
254400	262300	the same time. And so they're phenomenally difficult locks to pick as a result. By tension,
262300	269200	I mean applying a force on the lock in the direction that drives it to open.
270280	277040	So how you do that depends on the particular kind of lock. But the key idea behind this is that
277040	281780	since it's impossible to manufacture the components in a lock perfectly,
282600	284880	and you have manufacturing tolerances,
286380	290900	these manufacturing tolerances result in every single component being very slightly differently
290900	298860	sized or shaped, which then causes them all to behave very slightly differently.
298860	302820	And that's the case regardless of how well you machine the parts,
302820	307400	and regardless of whether or not you have a very low quality lock or a very high quality lock.
308720	312980	And finally, manipulation. Manipulation is just the ability to
312980	318040	move the components inside the lock with a tool of some design.
320160	325880	Those are the things to keep in mind when I start taking you through these locks.
327200	333720	So what is a wafer lock? This should be pretty straightforward, but
335640	341320	apparently for some people that that's not quite so clear. Some people whom I happen to have a lot
341320	347980	of respect for, so that is not to criticize them in that sense, but I do disagree. And
349340	355200	the reason I disagree sometimes with whether or not a lock is a wafer lock or not is because this
355200	360640	is how I define it. And if you're working off a different definition, then obviously in some
360640	366620	cases you're going to get to a different answer. So we've got some typical sliders shown in the
366620	373860	top corner here. These two are from an Asidesmo, which is a reasonably high security lock,
373860	378460	but not one that I would probably deem high security for the purposes of this talk.
379080	385200	And these are from a cheap wafer lock, not wafer lock, slider lock.
387320	392420	And in both cases they slide laterally and they have to be slid the correct distance
394740	402000	to allow the lock to open. A wafer lock is a special kind of slider lock where the total
402760	410120	length of the wafer is the same as the width of the core that they actually sit in. So
411240	418680	here's an animation to kind of make that a little bit clearer. When the wafer is incorrectly
418680	424980	positioned, it sticks out either one side or the other and prevents rotation. And when it's
424980	431280	perfectly correctly positioned in the center there, it will allow rotation.
435920	440020	So to start things off, let's take a look at the kind of wafer lock that you're probably familiar
440020	445620	with and the kind of thing that probably sprang to mind when you first read the word wafer lock,
445620	449940	if you've had any prior experience. If you haven't got any clue what a wafer lock is
449940	453880	in a normal implementation, then that's exactly what I'm going to take you through.
455160	460420	So at the top here we can see six wafers sticking out the top of this core.
462440	464400	And this is the lock at rest.
466460	476580	If we insert an incorrect key, or if we insert the correct key but not all the way,
476580	483220	then what you'll see is that some wafers will stick out at the top and some wafers will stick
483220	490480	out at the bottom of the core. And this will prevent rotation. When the key is fully inserted,
490480	497140	or the correct key is fully inserted, then what happens is they all line up along the top and
497140	506940	bottom edges of the plug, or the core, and they allow rotation of the core. So, excellent.
508140	514180	But that's not a high security lock. There are three cuts per position and only six wafers,
514180	519640	so that's not a very large number of differs. The core design makes it very easy to tension,
519640	525960	you can just bend a piece of wire and insert that, apply rotational force, and voila, you have
526600	535080	tension. And interestingly about wafer locks, you can't just design anti-pick shapes into them
535080	540380	in the exact same way that you would a pin tumbler lock. It's possible to do,
541040	547520	but it's a little bit more tricky than for a normal pin tumbler lock.
549700	557600	So, now that I've shown you an example of a really bad wafer lock, let's revisit the actual
557600	565060	principle behind wafer locks, and maybe I can show you a wafer lock that wouldn't be so easy to pick.
566360	574660	The main idea here is to approach the design differently. So, rather than our cheap,
574660	581740	low-quality wafer lock, which has a key which applies tension to the core, and then the core
581740	589980	applies tension to the wafers, and ultimately opens the lock, we can achieve a much, much higher
589980	595780	level of security if instead, we have the key only act on the wafers, and never directly act
595780	601380	on the core. So, if we have a key that aligns the wafers correctly, and applies turning force
601380	606100	to the wafers, and then the wafers transfer their turning force to the core,
606100	611420	if they're correctly aligned, the lock will still work, but it's a lot, lot harder to tension.
613080	619000	So, to show you what I'm talking about, here's another animation. This one, much less well-made
619000	627880	than the other one. This grey bit in the middle is our key, the beige-yellow element is the wafer,
628580	634540	the part highlighted in blue is the core, and all around the outside in grey again is the housing.
636280	641560	So, the way this works, the key is longer on one side than it is on the other, and when we turn it
641560	649340	clockwise, it makes contact with the wafer on one side first. So, in this case, it makes contact
649340	656880	at the bottom, and that causes the wafer to slide to the left. And the wafer slides to the left until
656880	664620	it meets the other side of the key, at which point there's no longer a lateral motion for the wafer,
664620	669960	but instead it gets jammed in place like that, and the force on it becomes a rotational force.
670560	675240	In this case, the wafer is correctly aligned, so that rotational force is then
676260	682820	transferred to the core, and that results in the core turning. If it weren't correctly aligned,
682820	687300	then what would happen instead is that rotational force would be applied to the housing,
687300	696120	and the core wouldn't move at all. If you want to have a system that works that way,
696120	703360	then there are two key requirements that you need to meet. Firstly, as I just mentioned,
703360	706480	the wafer has to be aligned correctly, otherwise it's going to apply that rotational force to
706480	712760	the housing, and nothing will move. And secondly, the key must have at least two points of contact
712760	718300	on the wafer, on opposing sides of the wafer. That's the point at which that lateral force
718300	721480	is translated into a rotational force.
725320	730480	That's something to keep in mind for later when we take a look at some of the more interesting
730480	738520	locks. So the main implication of this is that the lock becomes ludicrously difficult to tension,
738520	745760	because traditionally what you would do is you'd apply tension as the first step in the lock
745760	752040	process. And when you do that, at least one of the elements is going to bind in some way.
752220	758440	And then you can reach through with some kind of tool and prod on those elements until you find
758440	763240	one that's binding, and that's the one that you know you need to move. And you can move until it
763240	767720	stops binding, at which point you know you've correctly positioned it. But that's not possible
767720	772660	with this, because in this case you're going to have to align one of the wafers correctly first
772660	779160	in order to apply tension. And since you can't apply tension before that point in order to know
779160	786600	where to place it, you have to guess. So in the example animation that we just looked at,
786600	793700	if I go back, there are six possible positions. So that means you would need a tool that has
793700	797940	six different ends on it to simulate the key at that point.
799100	804460	And what that means is that because only one of those tools will work, the whole lock picking
804460	811880	process, and how quickly you can open that lock covertly, is massively extended, because you're
812380	818100	going to have to test each of those tools until you find one that works. And on average, it would
818100	827080	take you three and a half tries. So the amount of time it would take is massively increased,
827080	831680	because that's the requirement before you can even begin the lock picking process,
831680	836180	compared to other kinds of lock, where you can just apply tension and get started straight away.
841520	846600	So the main wafer lock that I want to look at is the Chroma Protector.
849240	856140	But there are a number of problems looking at the Chroma Protector. At the time that I started
856140	862680	thinking about it, I didn't own one, so that made looking at how it worked tricky.
864860	870280	And generally, information on it is scarce. Here are the sources that I've found and I've
870280	876980	learned from. It's worth noting that Graham Pulford, in his book High Security Mechanical
876980	883860	Locks, refers to the Chroma Protector as a lever lock. Now he does this because he categorizes
883860	891100	locks based off the design of the keys. But I think it would be very misleading to describe
891100	897680	the Chroma Protector as anything other than a wafer lock. And if you really want to dig into
897680	904180	the detail of the Chroma Protector and exactly how it works, Jakob Fagerlund's talk is absolutely
904180	918160	fantastic and I highly, highly recommend it. So as I was saying, the Chroma Protector
919140	924240	is a lock that I didn't have access to, so there was a motivation to make one for myself
926420	931340	and so that I could test whether or not it worked in the way that I thought it did.
931340	936400	I'd been thinking about it theoretically for quite a long time, but things don't always
936400	940720	translate into practice in the same way. So I wanted a prototype that I could play around with
940720	949080	and that would prove whether or not it worked in the way I expected it to. The other reason is,
949080	956440	when you design a lock, you tend to gain a lot of insight into how that mechanism works and why
956440	963480	some of the design features have developed in the way that they have. And so my hope was that
963480	967600	since the Chroma Protector is a reasonably complicated lock in terms of some of the
967600	976520	particular security features that are found in it, that I might gain some extra insight.
980520	989740	So I've previously designed locks and the only one that I ever produced was made of
990220	995860	three millimeter plywood sections cut with a laser cutter. So that's exactly what I wanted
995860	999500	to do again with the Chroma Protector because I had access to a laser cutter and I had access
999500	1007860	to 3D printers and so that was the logical step for me. And I couldn't see any reason why the
1007860	1013820	design couldn't work that way. I wanted to fit the same size as the Chroma Protector that I now have
1013820	1024730	because if you design with the same constraints as the actual engineers who designed the lock,
1024730	1031750	whose inspiration you're taking, you'll get a better understanding of why they've made those
1031750	1036310	decisions. If I didn't limit myself in that way, I might miss important details.
1038030	1042010	And finally, I wanted to include all of the different basic possible
1042010	1046370	way for designs that I had found in patents up until that time. So
1046930	1056010	if I take you back here, there are some examples, but we'll dig into that in just a little bit.
1056250	1061130	Some of the other requirements that I set for myself were that I wanted it to be springless.
1062090	1065990	And I wanted it to be springless because A, I couldn't see a good reason why
1065990	1074730	the mechanism needed springs at the time, and B, because most safe locks are designed so that
1074730	1081330	since springs fail generally first, most safe locks are designed so that they are not
1082450	1084990	dependent on those springs in order to function.
1086650	1092710	Because you don't want to have your secure lock inside your secure container fail on you.
1094190	1100610	And also adding them, point B, is a bit of a pain and makes designing them a lot harder,
1100610	1105370	designing the whole lock a little bit harder, especially if I were then to give this design
1105370	1113370	to other people for them to learn about. I wanted it to be as high security as you
1113370	1118970	can possibly get, considering I'm making it out of three millimeter plywood.
1120630	1124590	So I didn't, in terms of non-destructive entry, I didn't want it to be possible to just
1124590	1128170	look at the insides of the wafers through the keyway
1128650	1135670	and from their shapes discern what the bitting on the key needed to be,
1135670	1140710	or needs to be to get that lock open. I also didn't want it to be possible to just push
1140710	1146670	the wafers to their maximum range, left and right, and for that to be different.
1147930	1150770	Because if that's different and has any kind of relationship
1151270	1158970	to the actual length on the sides of the wafers, then you can rapidly gain an idea of
1159930	1162170	what the key has to look like.
1164530	1167570	And then I wanted the lock to also be self-scrambling.
1168450	1173370	So self-scrambling is this concept that all locks do, and lots of locks do this through
1173370	1180430	having springs, but that's not necessarily required. The idea behind a self-scrambling
1180430	1187170	lock is simply that when you insert the key to open the lock, and you turn that key,
1187170	1192510	it aligns all the components in their correct positions. And if you then close the lock,
1192510	1196390	one of the important things would be to scramble the positions of those components
1196390	1200510	so that the next person coming along who looks at the lock after you've locked it
1201270	1206370	doesn't just need to stick in a small bit of wire and apply a bit of tension, and the lock pops open.
1208390	1214590	I didn't want it to be a central wafer position. This was kind of just a minor I-want-to-be-annoying
1214590	1223030	feature. If a wafer were correctly positioned dead center, it would be substantially easier
1223030	1229770	to tension than any of the other designs, because any tool that has equally length bits
1230790	1236350	on either side would be sufficient to tension. Whereas that's not the case for any of the other
1236350	1240850	positions. So I thought if I could take that out of the equation, that would make the lock
1240850	1247250	just a little bit more secure. And the final problem that I ran into was reliability. So
1247950	1254110	this is kind of related to the spring, what I was saying about springs earlier,
1254110	1259170	but this is kind of just the idea that there shouldn't be a possible position that the
1259170	1262810	wafers could get themselves into where you couldn't insert the key into the lock.
1264230	1271290	Unfortunately, that's something I failed on. I couldn't balance making my lock without any
1271290	1277470	springs, having it be self-scrambling, and have there been no possible positions which
1277470	1282790	the wafers could get into where the key couldn't be inserted into the lock.
1283190	1289970	That was just beyond my ability as a self-taught engineer to resolve.
1291370	1299890	So, what I came up with. I used a 3D printed key. The lock itself contains seven wafers.
1300550	1305450	The key is tip-stopped, and the key has a very mild profile,
1305450	1310550	so you can't insert it the wrong way. And it will align both at the end
1313070	1319790	and at the neck, basically, or at the collar of the key. So that helps with alignment.
1319970	1330490	And it breaks itself open. So this was the most important thing that I learned when designing this,
1330490	1336650	when I finally had it in my hands. You need two points of contact on a wafer in order to
1337330	1344330	rotate it, or in order to tension with it. And that's all well and good in the opening direction,
1344330	1350650	but I found as soon as I reversed the key, there was no more than one point of contact on any of
1350650	1360810	the wafers, and so the key can't turn the core backwards. And so once you open it, it stays open.
1362910	1368890	Which is a little bit unfortunate. But nevertheless,
1371230	1375330	I'll do my best to make the files available for others to play with.
1376350	1382730	Here are the four basic wafer shapes that I ended up creating, and they all work,
1382730	1389110	in the open direction at least. On the bottom right, we have a full wafer. This is the bog
1389110	1394190	standard wafer, and most closely resembles what you'd see in other kinds of wafer lock.
1394830	1398510	On the bottom left, we have a half wafer. The idea being that
1400430	1406450	it's missing one half of the surface, so the key can't tension off this wafer in order to drive
1406450	1413870	the core around, but it still needs to align that wafer correctly in order for the lock to open. So
1415270	1419050	that makes it a little bit harder to attack, because this wafer would be much harder to
1419050	1426050	tension than a full wafer. Up here on the top right, we have a split wafer that doesn't have
1426190	1433710	a limit on it at either end. So this basically functions like two half wafers. So you need to
1433710	1439430	align both of them correctly, and they're actually different cuts for each of them.
1441470	1448570	And then lastly, in the top left, we have the limited split wafer, which
1450550	1458210	requires that the key be the correct length in order to drive both these halves together,
1458210	1466810	so that their total length is the same as the core is wide. But they also need to be aligned
1466810	1472330	correctly left to right. And the hope was that that would be particularly difficult
1472330	1476910	to manipulate, and I want to see how that bound up when it did.
1480750	1489490	So my analysis of it. You can't easily decode it, and it does work in the opening direction.
1489490	1491070	It does self-scramble,
1496210	1502110	and it might be non-trivial to destroy if it weren't made of three millimeter plywood sections.
1503330	1507610	But all in all, probably not something you're going to want to use
1507610	1512470	in a safe, especially not when you could use something like this.
1513630	1520630	So this is really the inspiration for my design, and I'm not going to claim any great originality
1520630	1526510	with what I created. I was hoping to just create a simplified version of this.
1527410	1534050	So I'll give you some basic details about it. It's 68 millimeters across, and it weighs 730 grams.
1534050	1541890	It is not a small lock. It contains 11 wafers, which from a brief reading of the key,
1541890	1545230	have at least seven possible cuts per position.
1546370	1552250	There may be more. In practice, there are probably fewer in lots of positions, because
1552250	1556850	although in theory any of the layers are completely interchangeable,
1556850	1566430	in practice, at least for the ones that I have seen and that Jaco analyzed in his talk,
1566430	1573290	there seem to be certain patterns of wafers where some of them don't actually vary very often in
1573290	1582850	position or cut. So two things to note about my Chroma lock. One, it's not made by Chroma.
1583150	1588990	I suspect heavily that it is made by Carl Wittkop or Carvey, which is a German safe manufacturer,
1590270	1596190	presumably under license. And the second detail is that I'm pretty sure that my
1596190	1601510	Chroma Protector is not the latest version of Chroma Protector. However,
1603290	1606790	this was the same Chroma Protector as Jaco was covering in his talk,
1606790	1612230	and so I feel pretty happy that there's still some benefit worth looking at this.
1614270	1618250	So we'll start by looking at the key, because the key is pretty complicated.
1619610	1626070	And there are a whole bunch of details to pick out. Here are the seven that I've decided to pick
1626070	1633930	out. So the Chroma Protector has a post. So it's basically got a large spike that runs the length
1633930	1639090	of the lock down the center, which helps align the key, but also removes space that you'd want
1639090	1642790	if you were going to design a tool to fit into the keyway and to manipulate the wafers.
1645230	1652530	It's also got this ramp. And if you design a tool to fit inside the lock that doesn't have this ramp,
1652530	1658390	what you'll find is that one of the wafers has a portion of it that sticks into the keyway,
1658390	1661710	and so you won't be able to insert your tool all the way into the lock
1663990	1670790	unless you simulate this ramp. And interestingly, at least in principle,
1670790	1675910	if you were designing a tool, you'd need to have that ramp on both sides so that you can
1675910	1682170	push the tool in and pull it back out, back past that little ledge on that wafer when that
1682170	1687290	wafer springs back into position. But the problem you're going to run into
1689570	1696410	is that this ramp is the same width as one cut. So if you're designing a tool,
1696410	1699650	what you really want is you want a tool that allows you to manipulate wafers individually.
1699650	1702230	You don't want to have a tool that's so thick that it's going to manipulate
1702790	1706670	two wafers at a time. That would make it phenomenally difficult to position
1706670	1718090	each one of them individually correctly. So you'd be in a bit of a bind in terms of
1718090	1722470	how to handle this ramp. The last option would be to create a half-height ramp
1724030	1727690	and make your tool a little bit smaller than the total space that you've got.
1729130	1731670	But again, that's not really ideal.
1733910	1737990	Then we've got these angled cuts which, to the best of my knowledge, are just there to make
1737990	1746210	key duplication harder because, as I mentioned way back near the beginning of the talk,
1746210	1749650	key duplication is one of the possible methods of surreptitious entry.
1749810	1754330	So for a high security lock, you want to make key duplication as difficult as possible.
1754890	1758990	So those angled cuts look like they're about 45 degrees. I haven't measured,
1758990	1763950	but they look like they're about 45 degrees and they make key duplication much harder.
1764490	1770210	There's also this weird angled cut. If you look closely, you can see that each of these
1770210	1777510	other cuts on the key are horizontal except this one. And this one actually cuts across
1777510	1785730	more than one wafer and engages a flexible portion on the corresponding wafer,
1785730	1791610	which I believe is wafer 9 in this particular case. Again, I believe this is for key duplication
1792150	1798110	because, from what Jaakko said about chroma protectors that he's looked at,
1798110	1807030	it's not been necessary to have that cut on a tool. And that's also definitely the case for my lock.
1807890	1812490	But still, it's another interesting feature that would make duplicating this key very,
1812490	1820550	very tricky. I've got these partial radial cuts which cut into the bitting of the key,
1820550	1827570	but not all the way through. And again, there's a potential there to make key
1827570	1834890	duplication much harder if they truly need to be cut out in order to allow correct alignment
1834890	1839310	of the wafer. You could probably, in most cases, get away with this and not worry about it if you
1839310	1845890	were designing a tool to manipulate the wafers, but this is yet another thing to worry about if
1845890	1854350	you were going to try and copy one of these keys. Then we've got what is probably the most
1854350	1862070	interesting feature, I would say, on the lock, or sorry, on the key for me, which is this undercut.
1862810	1870490	And this undercut is a cut that's made so deeply that it cuts into the actual shank of the key.
1871690	1877530	And so when you insert the key, the particular portion of the wafer that engages with this
1877530	1883890	undercut first has to meet this ramp, and so you need this sort of slot on the key.
1885350	1891390	And if it's able to, it'll travel all the way up, and it'll stop when the key is fully seated
1891390	1896630	in line with the undercut, and then as you turn the key, the undercut will pass through the
1897130	1904490	interposition. Now, that doesn't actually mean that you couldn't design a tool that uses the
1904490	1912990	whole shank space, but you could design the undercut to cut so deeply that it even cuts
1912990	1917810	all the way through to the post. And if you did that, the key would have a hole in it,
1917810	1923730	which wouldn't be a big deal for the key because it's solid, and that would only be one tiny weak
1923730	1927890	point that would be relatively well supported. But if you're going to design a tool and that
1927890	1933790	undercut could be in any position, well, that's a tricky problem to design around,
1933790	1937630	and it would multiply the number of tools that you would reasonably need in order to
1937630	1943170	open this lock. Now remember, you'd need to line one of those wafers up correctly in order to
1943170	1949570	tension the lock anyway. So you'd need seven different tips on your tool, and you might need
1949570	1955390	several different shafts, and it might not be possible to create those separately and viably,
1955390	1963750	so assuming you had seven different ends and 11 wafers where that undercut could exist,
1963750	1969070	well, that's 77 different tools that you'd need to bring on a job of which only one of them will
1969070	1977430	work. So this is a huge exaggeration of the problem, which would hugely increase the amount
1977430	1983450	of time it would take in order to reliably manipulate open one of these locks, even if
1983450	1991970	you did have a tool that could do it. And finally, we have this dimpled cut. Now, Jaakko didn't
1991970	1998870	actually have an answer... Jaakko didn't actually have an answer to this in his talk as to what it's
1998870	2005070	there for. And I should point out, I am not an expert on this lock. That title almost certainly
2005070	2014310	belongs to some German safe mechanic. But I can offer a theory. And that theory is that
2014930	2021490	the fourth wafer in the Chromium Protector handles counter-rotation. So the Chromium
2021490	2026870	Protector handles counter-rotation by allowing essentially the full movement of the key to about
2026870	2033270	45 degrees within the lock. And so at any point that you are opening the lock, you can turn the
2033270	2043010	key back basically the whole way, or back basically 45 degrees. If you do that, then
2043990	2049350	what you'll find is that the fourth wafer in this particular case, it's cut so that it
2049350	2054210	makes contact with both sides of the key simultaneously. And that wafer handles the
2054210	2061070	counter-rotation of the core, which is the missing element in the lock that I created.
2062910	2068050	However, if you don't have this dimpled cut on this surface of the key,
2069150	2073450	then what happens when you attempt to turn the lock, to turn the key backwards in the lock, is
2073450	2079530	that you actually make contact with a protrusion on wafer number nine before the key makes contact
2079530	2085870	on two points with wafer number four. And so exactly the same, at least in theory, as with my
2085870	2091670	lock, you'd be trapped in a position where you only have one point of contact with any wafer in
2091670	2097050	the lock, and so you can't easily counter-rotate the lock, because the harder you turn backwards,
2097050	2103110	the harder you force the wafer against the side of the housing, and the greater the frictional forces.
2104610	2108930	So my theory is that this is another trap when it comes to key duplication,
2108930	2115070	where if you failed to replicate that sufficiently well,
2115070	2118530	what would happen is that even though you may have a key that opens the lock,
2118530	2123530	you then wouldn't be able to remove the key from the lock, and so the key would
2125110	2129470	remain inside the lock, and the lock would still be tamper-evident,
2129470	2133970	even though it had been successfully defeated, which was one of the requirements for a high
2133970	2144670	security lock. To move away from the key and back to the lock, let's take a look at the keyway.
2144670	2151710	There is no core that you can tension up. This is a solid plate that's held in with three screws.
2155800	2161260	There is no way to tension the lock directly around the keyway, and in the center you can
2161260	2169680	see the poster, which matches the hole in the key, and you can start to see some of the different
2169680	2177200	shapes of the wafers through the keyway. Here it is with that top layer taken off,
2177200	2182920	and so we can see the top layer, layer 11, which is one of those split wafers, and it's the only
2182920	2189520	wafer, or set of wafers in this lock, the only layer that isn't actually sprung.
2192240	2197540	And we can kind of see looking down that we have, here's the little portion that sticks out that
2197540	2204420	engages with the ramp, and this little slightly curved portion is the portion that engages with
2204420	2210740	the weird angled cut. And you can sort of see that every single wafer all the way down is very
2210740	2218440	differently shaped. And so as a result, it's very, very difficult to look at them and try and discern
2218440	2225460	any kind of meaningful pattern in order to decode which position that wafer might need to be placed
2225460	2234430	in order to open the lock. Having now covered the basic idea behind the wafers, and without
2234430	2239210	digging too much into how each of them works, there are two wafers that I'm going to draw
2239210	2247310	particular focus to. The first wafer is number 7 in my lock, which has a square cut out in one
2247310	2253030	corner of the wafer end. This effectively acts a bit like a false gate does on a traditional
2253030	2259730	on traditional slide locks, albeit less effectively. And this is one of the reasons why I think false
2259730	2267630	gates spooling and serrations aren't so simple when it comes to wafer locks. For this cut out
2267630	2273110	to have an effect, all the other wafers would first have to be set correctly, and then the
2273110	2278010	core will turn partially and stop getting caught in this cut out. Sounds like it'd hamper an attacker
2278010	2284530	pretty effectively, right? Except there's no way for the other wafers to counter-rotate the core.
2285110	2290470	The wafer itself supplies no counter-rotation either, because it can't with the notch squared
2290470	2296270	off. And what this means is that an attacker needs only to keep pushing on the wafers until they
2296270	2301410	finally fall into place. They can't lose progress towards getting the lock open, they can only really
2301410	2309910	gain progress. So that was the boring detail of the two. The other one reveals what I think
2309910	2316930	personally is the Achilles heel of all wafer locks design's tension of the wafers. And yes, I think
2316930	2323310	they're high security, but I still think they do have a fundamental problem, and it's a very difficult
2323310	2329570	one to grapple with. And I think that problem is essentially getting the lock to counter-rotate
2329570	2337650	open again when you're using those wafers to tension the lock to open it. I mean, of course
2337650	2344310	I think that, right? Because that's the design feature that I overlooked in my own design, right?
2345930	2349810	But I then did a lot of thinking about how to solve that problem.
2350870	2356250	So the animation on the left here is the most obvious and basic approach to solving that
2356250	2363470	problem. You've kind of got this like bow tie or hourglass style cutout, and essentially
2364810	2371250	any bit on the key when turned, in this case 45 degrees, will begin to tension the lock.
2372310	2376970	And as long as nothing blocks the key when it's counter-rotating,
2377830	2379950	you can counter-rotate or make contact on
2381790	2387810	two surfaces again, and it'll counter-rotate really smoothly. The only problem with this is
2387810	2394510	this wafer doesn't have the freedom to move at all, and so it'll trivially...
2395810	2402610	it'll allow the lock to be tensioned trivially, which undoes the whole point in designing the
2402610	2409050	lock to tension off the wafers in the first place. So the way they've tried to do this
2409050	2414610	in the chroma is a little bit more complicated than that. If you take a look at the animation
2414610	2419970	on the right hand side, this is the exact same animation as the one on the left, just with a
2419970	2426430	little bit more material cut away. It still functions in exactly the same way, but hopefully
2426430	2432610	you can see the similarities between the animation on the right hand side and wafer number four in
2432610	2442160	my chroma lock. The only difference between the animation on the right and the actual wafer in
2442160	2449740	my lock is that in the top right hand corner they haven't given the same surface to tension off as
2449740	2457980	in the animation. They've got a surface which the key needs to touch and move laterally into the
2457980	2467420	position. But when you design the wafer this way, what you'll find is that the
2468140	2475200	the prong that sticks out here on the bottom right hand side
2477800	2482660	obstructs the keyway. And in fact you might even be able to see this kind of darker portion on it
2482660	2487760	where that surface has kind of been rubbed away a little bit or has become worn. And the reason
2487760	2494380	for that is this is the portion of the wafer that makes contact with the ramp on the key.
2496520	2503880	And so the real reason to have the ramp is to correctly, well to allow the key to enter the
2503880	2510610	lock while not having to have this counter rotation wafer already set in the correct position.
2513030	2522050	Attacking wise though, these two surfaces on the key need to engage at the same time.
2523150	2529830	So if you have any tool which is equally lengthed and you counter rotate in the wrong direction
2529830	2536650	deliberately, you will align this wafer correctly. And if you had some kind of method of then
2537730	2542950	identifying how far away the surface is that the key would have to make contact with in order to
2542950	2551730	tension it clockwise, then you'd know the correct position of at least one wafer and you could
2551730	2565810	decode that. And that would allow you to tension the lock. So ultimately is this lock impossible
2565810	2574090	to breach or manipulate or pick? No, there have been reports of people managing it, at least
2574090	2581370	against some versions of the lock, even if there aren't any recordings on YouTube. But this is also
2581630	2587070	a phenomenally high security lock. It is hugely drill resistant, it uses a special plate right at
2587070	2591370	the bottom of the keyway to add extra drill resistance on top of the already significant
2591370	2598650	resistance of the plates that sit on top of the lock and effectively function as the faceplate.
2600850	2610790	The kind of totally patternless way that most of the inside surfaces of all the wafers have
2610790	2617050	been cut away means that it's incredibly difficult to decode. And in a best case scenario, if you had
2617550	2624430	huge number of samples, thousands of these locks, then you'd be able to maybe carry out some kind
2624430	2631050	of decoding. In a worst case scenario, for the attacker at least, what will be happening at the
2631050	2636670	factory is they will truly do something to randomize all of those shapes and so there will
2636670	2643850	never be a pattern no matter how many samples you collect. There's no way for us to easily
2643850	2654950	work out which one is the case, but it does seem like it would take a phenomenal amount
2654950	2662410	of resources to work out how to decode one of these locks. I didn't really discuss the blow
2662410	2672130	ring at all, but that's something to discuss. So around the back of the lock is a... if we can go
2676090	2684580	back... oh boy, okay, that's a bit further than I want to go back. Right, so there we go.
2685440	2691780	The brass ring that sits around the outer edge of this lock is the blow ring. And from my
2691780	2697040	understanding, the way that it's designed is so that if you pack the middle of the lock through
2697040	2703200	the keyway with explosive, which is one of the big downsides of keyed safe locks, is that you
2703200	2710620	can pack them full of explosive. When you detonate that explosive to create high pressure to tear
2710620	2717160	the lock apart, rather than the entire lock completely tearing itself to pieces, what happens
2717160	2724300	instead is the blow ring gives way under the high pressure before the lock actually does dismantle
2724300	2731360	itself, since the blow ring is much softer metal than the rest of the body.
2733140	2738260	And so what will happen is you'll end up fusing together all the various wafers in the middle
2738260	2747080	into one horrible blob, and the lock won't be opened. And so at that point the only option
2747080	2752340	would be to completely obliterate the lock. And considering this is normally used in
2752980	2757940	high security containers or vaults, this sort of thing, that means you have to go through the
2757940	2773250	entire surface of that vault or container, which will be no easy feat. And that brings me
2773250	2779950	on to the the final point, which is the super super tight tolerances. So I've attempted to
2780630	2786170	manipulate my lock with the face cover removed and applying direct tension to the core, which
2786170	2791610	obviously is cheating, right? You wouldn't be able to do that if the lock were actually
2791610	2802230	installed in a container. But even doing that, even basically ignoring the main security feature
2802230	2808330	that the lock has, and attempting to manipulate it like that, the tolerances are so incredibly tight
2809030	2818390	that with even more than two or three wafers, I can't manipulate the lock and have the wafers
2818390	2823730	hold in place even when they bind. They do bind, and it's possible to detect that with enough
2823730	2828850	force, and it's possible to move them into position, but they drop really really easily,
2830050	2839090	which makes it phenomenally hard to manipulate. And all in all, I would say this is a phenomenally
2839090	2847150	secure lock. And it largely achieves the goals that high security locks have.
2848390	2855610	And it's a wafer lock. So clearly, there is some potential for wafer locks to provide security
2856970	2864110	that we're looking for in high security locks in a way that isn't perhaps as inherent to,
2864110	2867650	for example, pin tumble locks. I can't think of a pin tumble lock that has a comparable
2868350	2872490	challenge with tensioning or manipulation.
2875550	2882710	So there we go. Hopefully I've convinced you that while lots of wafer locks are low security,
2884350	2887690	the wafer lock principle itself, especially when you have
2888430	2893130	the key tension, the wafers, which then tensions the core,
2893130	2900130	is actually really really quite high security, and it's got great potential to deliver
2901230	2905430	a much higher security solution than other types of lock design.
2908810	2913090	So hopefully you learned something. Hopefully I convinced you.
2913310	2919870	And I presume now we will lead into the question and answer section. Thank you very much.