ERIC VAN ALBERT: I'm Eric Van
I'm David Lawrence.
DAVID LAWRENCE: And
here today.
He contributed a lot to the project.
We're just two MIT students.
We don't have more credentials than
Playing with locks is a hobby.
If you'd
Hope you enjoy this lock.
How many of you guys were here
Fantastic.
I'm going to talk
We can do more of a quiz
When you have
and body and stacks constraining them
If you select the key, you raise
up to the interface
allows that to turn.
What's that interface called.
Wonderful.
We have I a video here.
This is a cutaway lock so you can see
As you insert the key, you can see
When it's not inserted
above the shear line so
the pin from turning.
If you insert it all the way
Everybody see that?
Great.
These locks are vulnerable to a lot
as Marc and Toby talked
You can take these keys
and they'll copy them for you.
Another thing you can do is picking.
And inserting long wires
I'll go over those quickly
about them a lot.
Picking is where you exploit
By applying torque
all the pin stacks to bind.
In a perfect lock they would all bind
at that point you'd be screwed.
But because the holes are slightly
on the plug, only one of them
And if you use a pick
up to the shear line, then it will set
a very small amount and it will trap
down and then you don't have
and you can repeat that
Impressioning I'm not going to go
because I'm not very good at it.
It involves taking a blank key,
and using the torque and binding action
and you can file
up with a working key.
So pin tumbler locks
for the sleighing prime us
of the Schlage Primus key there
the SCHLAGE
which is the squiggly line on the top
We're going to call that
Now an important part
is you can completely separate these
In fact, we've cut a couple keys
the side bar or just the top bidding.
Now, here's a side bar only.
And then here is a full key,
the side milling on it.
Can anybody pick a Primus lock,
One guy in the back.
I salute you.
Much more skilled than I am.
We cannot pick Primus locks.
I have one friend who can do it.
He's very good at it but we have
of opening these.
Now, what we're going to do
at keyless entry, we're going to look
So this is basically using information
you gather somehow about the key
to the lock.
There's a lot of things in place
The way you get these keys
to send them proof that you are who
And you're entitled to get keys,
This key is blank
bidding on it.
But it does have a side bar.
Schlage claims they're
side bar and they go
a lot of money to get side bars.
In order to attack this lock,
first we have to figure out how
and how it actuates the parts
We're going to create a 3D model
is the first step
Then we're going to look at additive
and implication of this for Primus
All right, so we'll start
we're calling it reverse engineering
There's no great amount
So start out with a Primus key
about the lock.
And what does it say on it?
Primus, do not duplicate.
Actually, we may have to end
all for come.
(Laughter) The third line of the key
A U.S.
patent number.
I'm guess Schlage thinks this
But actually U.S.
patent filings are public.
So you look it
of about 20 pages
explaining exactly how it works.
So you can see that
on the top of the key.
There are 5 additional cuts
And there's
on the side of the lock which
We'll take a closer look at that soon.
You read through the patent
But there's a lot more information that's
So suppose you do a Google search
Well, there you are.
They have it up on their Web site.
And if we look inside there, there
that they've provided to us.
So here you can see how that side
There's an L.
shaped pin called
down in the grooves on the side
That meshes
to the side bar in the previous talk,
And when those finger pins are lined
as you can see in the drawings at right,
the cylinder can open.
If the finger pins are not aligned
the side bar and that will prevent
So the fingers pins have got
and rotated to the correct angle.
They have two degrees of freedom.
So let's take a look.
Here is a cutaway lock and side bar
the finger pins.
You'll see them moving
to be misaligned until the key
of them will be lined up.
Until you rotate it back and forth
of light on them.
You see there they rotate.
Until the key is all the way
and if the wrong side bar is us used
That's basically it
If there are any missing details,
of course take one apart and look.
But it turns out that
at lock Wiki already did that and put
So all you have to do is look
and you can see exactly how this side
It's got little notches
on the finger pins that fit
as the bump is in the right spot.
This is the lock and Schlage believes
secure, resistant to duplication
And they're almost right.
So next thing we'll take a look
So that is now that you have
out the exact dimensions that are
the finger pins and the pin on the top
into the lock.
So we'll start out with a top
This is a page from the service manual.
This is backwards compatible
of this is secret at all and this
for the top of the key.
The side of the key
because all Schlage tells you
They can be left, center or right.
And high or low.
So what we did to figure
for this not using any special tools,
on a flatbed scanner run them
and exact the parameters.
We got nice results.
Here they are.
Now you know.
You can also see here a picture
those different positions map
This is side bar 64246 deep right,
deep left, deep right.
And that's about it for this side pitting.
There are a couple other things we have
a key that can be used.
We have a minimum slope
down to each cut
to rotate, that's got
down to the bottom of the cup.
Otherwise, the friction
There's also
because if it's the ramp is too steep,
the key won't be able to go in and out.
So because there's this rotating pin you
out these two factors and there's only
of slopes that work.
And finally the bottom
to match the curvature
So we went through and figured
as well And that's it
for all of the control surfaces
With this, you can put
All the finger pins in the right place
Of course, the last piece
a key cross section that will fit
Now, eventually,
in all of their standard Primus locks
a bit more material from that, it fits
And we speculate that the reason this
the side bar mechanism imposes such
and that the key has got
This one.
There's got to be a big hole
the finger pins can ride
There's got to be side bar there's got
There's very little flexibility
around the side bar.
So in that respect, the side bar
a regular lock where there could be
a key.
And once we have that key cross
all these pieces together
And to do that, we used
Open S cut
like syntax that compiled to 3d models.
It was first used to model keys
So we saw that and thought it was
and implemented the Primus key.
It was only a few hundred lines of code.
Not a lot of work.
Considering the purported security
Here's an example of what it looks like.
This is our top level function called key.
Which is taking the top code
and it's calling out to a bunch
to draw the top of the key and
out all of the bumps that need
And this is what you get.
You call the function key and get
working Primus key (Applause.)
we'll tell you about a bunch
to easily and cheaply fabricate these.
Three D models are great
if you can't make it.
Has anybody filed keys?
Show of hands.
Take a file, work it for a while.
It takes a steady hand, a pair
Now we thought that hand machining
Until one day our friend Rob sends us
by hand opening a Primus lock.
And we're like wow,
He used very complicated tools,
He used a dremel, a pair of calipers
Only material cost
he basically described
all of the dimensions
with dremel
and stuck it in the lock and it worked.
He's done it
the 11 numbers describing the key
a key that will open the lock.
It's fantastic.
Here's photos of the process.
You can see
in the Primus key way
to prevent you from breaking
Thin it down using the dremel.
You see the complicated tools we have
It also happens that 0 you are key
as our kitchen table.
So once the key is thinned
in the Primus key way you can start
to setting into and here we've got two
And you basically scribe
scribes more measure repeat ad
Here it is with almost
of polishing it
in the lock and it opens.
And we have that to show you now.
Here's the hardware store key blank.
This one I think was 25 cents
Here is the result.
There's the part we dremel'd out.
Here's the stock key
See that biting there compared to ours.
And let's put it in the lock.
Here's
That works fine.
Here's our key opening the lock.
(Applause) So that's it.
Yeah, you can dremel it.
If you've had
you can do this.
This is how Schlage makes their keys.
They mill
numerical control.
If you are interested outsourcing this
the setup cost
because you have to there's a lot
of common milling machines don't have
to operate the small tool diameters you
And so the a better tool than
is probably a desktop micro mill
through the market.
Keep ap eye out for ones
will run you probably
The other shown here is another mill
of milling
into a Primus key.
This is not out yet.
It's a funded kick starter project.
But the most exciting thing we tried
a new space
printers have hit the levels
a high security lock.
So we took that 3d model and just sent
Shapeways.com and iDotmaterialize.
We got keys back
We tried two different mastic processes
And well, it turns out that
(Laughter) So we're going
(Applause) The first material we tried
frosted ultra detail
as much precision as we can here.
And this is a stereo process secured.
Very expensive.
There's a 5 dollar setup cost
How much is it going to cost you
at the hardware store.
$3?
Precision was excellent.
We measured it.
It was great.
Issue was it was not that strong.
It was plenty strong to attack
but when it comes
the half spot at rust padlock,
But there are a lot
like figuring out whether you have
for a lock or removing the cylinder
What's it it looks like.
We don't put the bumps
because they're useless
There it is.
There it goes going
real smooth.
(Applause.) Next thing was different
strong and flexible.
This is laser centered nylon.
This is cheaper.
Only $3 total.
The issue here was the precision.
This is not
It's not high resolution but it's enough.
It's less smooth going into the lock.
Sometimes you've got to give it
enough to operate most locks
So we can take a look at that.
See if you can see the side bar there.
It's hard.
Yeah, there is a side bar.
It's just hiding.
Little harder to insert
it opens fine and it's quite strong.
By the way, we got old FL.
This is a key that doesn't open anything
an idea how brittle the first one was.
That's it.
So you don't want that happening
of cases where you might be using
And then the third thing we tried just
out is this titanium process which
to deposit titanium powder
And that turned out awesome.
The down side is it ran us $150
But you want to show that?
It is an amazing looking thing.
We measured it and it was more precise
you how good it is.
But it's certainly
the Schlage factory, most likely.
Yep.
Here it is.
We go into the lock and no problem.
This stuff is super strong.
(Applause.) So there it is,
I suspect there are many more ways
of these outfits are just starting
they have 3d printers that print in wax.
And maybe they'll even give you
So we have no reason
of these other processes wouldn't work
And we also expect
Because
is the white 1 and titanium are currently
a royalty fee that's part
in 2014.
Historically speaking, when
went down 25 30%.
And we start seeing things
So that's going to be exciting.
Maybe we'll get
Finally, let's take a look
So first for Primus locks,
We know all of these dimensions now,
is a key or else a picture
if you've got a sense of you know,
But it's not going to be hard.
Especially if you're decoding that side
Because there's only six possibilities
they look quite different.
Of course that means key duplication
your key you're going to need
to ship off to shapeways and that's it.
You've got your copy
going to the hardware store
So one thing this means
It's standard attack that can be
in which you start
and a couple of key blanks
out one pin at a time to find where
In a master system, the side bar
because that's built
the ability to produce blocks
the same attack and this
a regular pin tumbler lock.
Have you seen the Matt blaze paper.
Matt blaze master keyed systems.
(Talking simultaneously.) But
These are still a pain to pick.
So we're just looking at starting
of the information contained in a key.
Although note that's not going
by there's been other work
there's a key at Berkeley I believe
have been at one
They successfully decoded
from a guy sitting at a table
of a 4 story building
If you see anyone walking
from their belt,
of one of those.
All right.
So we're going to have
want to use a Primus lock
If you're using Primus locks already,
if anyone at all can go duplicate a key.
It's not new that you can duplicate
You could get a machinist
But what's new is anyone can do it.
There's no barrier in terms
No cost barrier, anyone who feels
But the interesting thing
to Primus locks.
There's no specific weakness
Any physical lock
and printed.
So it's an industry wide problem that's
up now 3d printing
to have these precisions.
Key duplication
It will be like pirating movies.
It still takes one person who can go
or take their video camera
But as soon as they've done it,
to download the movie.
It takes one person to model a key
and download and print them off.
So I think we'll find those people
Physical security
on information security.
We're breaking
by writing code for a key.
I think that's cool.
Patent protection
for lock companies
to threaten legal action
physical reproductions
I don't think they'll be able to go
the same information included
Go after each individual person that
of these keys.
But I don't think they'll be able
the distribution
on a patented key.
But we're not lawyers.
You should talk to Marc Weber Tobias.
Lawyers can make your day suck
Here's other keys this
This is all recent work
This is for a mini Cooper.
This does nothing about the chip
the real key.
It works for the physical section.
This is used commonly in bike locks.
Other stuff.
People have three d printed handcuff
Field is wide open.
Anything that's a physical lock,
up wherever it
and people can print it out.
We have audience projects here that
if someone else wanted to do.
We'd like to see 3d models
in open S cat because it's not that hard.
Especially Medeco which a lot
is the highest security
If you've ever looked
he's published most
Probably print out a model of that
It would be neat to integrate models
the process fully automatic especially
That should be fairly straightforward.
Maybe there's a market
iPhone app.
Take a picture of your key, get
It would be neat to have a place to go
for pirate bay for keys.
And here's some food for thought.
If you're
about these.
There's a lot
because a retired locksmith was selling
Called him the master keys
These are keys that are used
fire departments in New York City,
to electrical circuit breaker boxes
People were getting upset that
But what's going
the 3d models for these keys?
These have got to be in hundreds
There's no way to change these locks.
The interesting thing
by the New York post has probably got
ahead and do it right now.
(Laughter) (Applause) Also, one
manufacturers uses the same key
and I believe that they put a picture
On their online storefront.
Even if not, how long will it be
Models it, dollar, two dollars, buy
If three d printing keeps picking
to be a major change in the field
So I think that's about all we have here.
We have a couple people to think.
Yeah, sure.
A lot of people worked on this
of us up here.
I'll like to thank Gabe,
of course Rob who couldn't be here
the person manufacturing
and Schlage for publishing
the MIT lock sport community
in the first place.
Thank you very much.
(Applause.) So we have quite a bit
We have about 15 minutes
But, if you want to come play
stuff works, come
we'll be there.
If we e mail you, can we get
The code
and file distribution and posted
What bit did you guys use
The highest speed you could get.
There was
but you can also use small.
3/64ths or less.