Welcome! (What's all this TOSL stuff about...)

[vov35]

Is there some way that a battery or capacitor could be charged by the twisting of the key?

Or the insertion... See e.g. http://www.iloq.fi/

Or you could induce currents in the key to power it similarly to how the RFID tag in a car key works.
Except you could have a more powerful device dedicated to powering up your key plugged into a wall socket w/ rechargable battery backup placed near the door.

[Reallunacy]

I would like to see an electronic lock that had a mechanical input. My initial thought is to have the width of the key entryway having three pins that are activated in a specific sequence based on raised or depressed parts on a key. If you made it into a three by ten grid on the key you would have a lot of possible combinations. This would prevent a picking or bumping, because for bumping it would be impossible to make the combination, and picking would technically be possible, but the likely hood of the assailant keeping the circuit closed and hitting the pin in the right sequence which can require two or even all three being hit simultaneously is practically nill.

Also to prevent some of the electrical attacks, the tip of the key could be the only conductive portion and when inserted it closes the circuit allowing the interior electronics to turn on only when the key is being entered.

I figure the best option to allow re-keying would be to require the key to be in the lock and a USB port on the inside of the door. There would be an option that would require a blank and the serial number of the key to allow coding a key in the even the original is lost. This type of set up would also allow the system to save multiple keys that way for a business, they could issue different keys to different employees so that in the event something turns up missing they could see who it was that unlocked the door last.

Criticism welcome.

~Mike

[Elkram]

Don't you think that a mechanical lock with a electrical output would be better?
Perhaps such that the key would provide one or more electrical charges of set voltage/amperage and duration, as this would be difficult to guess the correct voltage, and timing, especially when one is attempting to pick a lock at the same time.

[Reallunacy]

I think having the key providing voltage, would require a lot of power in a tiny form factor. I think having different resistance options for the key would be a more realistic option.

[vov35]

I think having the key providing voltage, would require a lot of power in a tiny form factor. I think having different resistance options for the key would be a more realistic option.

and then we end up with the VATS system stuck in some american cars, nothing new, nothing unbeatable.


I do like electronic locks, because most electronics, if properly executed are pretty much immune to manipulation. No, I don't mean unencrypted RFIDs, but something more serious than that.
The issue is that electronics are a little less reliable. batteries and such can die.
When you look at a cyberlock or whatever medeco's equivalent is, there really isn't much you can do to pick it except for go for mechanical vulnerabilities.

Basically, a properly executed electronic lock will be less vulnerable than the door hardware and building windows.

[amine]

I haven't contributed anything substantial yet to this great forum but I've always absorbed the info in the articles here, because 'lockpicking' is a hobby of mine, and many thanks for the knowlegde around here!
So this project, TOSL, is something I maybe can contribute to . I've read the idea, but forgive me , I haven't read all the posts/replies in detail yet so I will UTFSE and delete text if it's already here. (And please forgive my English mistakes as it isn't my native language).
The TOSL: apart from all the high tech, I think the lock has to be affordable in the first place. So as i studied locks earlier i was surprised to see this 'battle in court'(in The Netherlands) between eg. M&C and NEMEF/LIPS about bumping proof locks etc. My thought about a really safe lock, and because of my background (chemical engineer) I wondered, and I have experimented with it but then as a replacement for EPG needels, is to introduce two types of polymers. For those of you who are still reading (i always use to mjuch words, sorry ) if we imagine just a plain cylinder, eg a 6 pin and one pin, the 'middle part'is replaced by HP rubber and on other one with something like PMMA(plexiglass with CaCO3 added standard), the 'rubber pin' makes the lock pretty much more resistent against 'EPG attack' and the 'prespex pin' with an 'easy identifier loop' (don't know how to say this better ) will show iff the lock has been attacked with a bump key and because the PMMA immidiately shettered, the pin 'fell into safe mode' and can't be opened by bumping and the legal owner of the lock sees directly he has been victim of a 'bumper' Okay, I'll make some drawings to make it more understandeble because this description takes to much of ones imagination I imagine, I'll figure out how to post them.
Well, this is my first thought about the TOSL and I hope it wasn't already been supposed. I was immidiately enthausiastic so I wrote directly some thoughts about it! I look forward to join this further conversation!

[too-picky]

If you use electronics, don't forget about denial of service type of attacks. Keeping bad guys out is one thing, but letting good guys (and gals) in is primary!

So if the bad guy can keep you from getting into your home by his/her attack, then what good is the lock? And if the lock is otherwise perfect and keeps everybody out, then how will you get in once you've been denied entry? See the red warning flags?

I'd say start off with the absolute best mechanical solution our brains can conceive, then augment with electronics to add convenience and other features, but the fallback should always be excellent hardware (my opinion).

Hope this helps.

[SeattleTexan]

Hi All,
I'm new to the forum, but I've had an interest in high security locks and keys for quite a while. I currently have installed at home an Abloy Protec, Mul-T-Lock Interactive, Yardeni 10, and an older Medeco 5-pin rim cylinder.
Something I've always considered when I think about my "ultimate" lock, is one that borrows a bit of design from pretty much everything else: disc detainers, dimples, angled pins, side milling (like EVVA 3KS), plus electronics - either a prox system similar to my car's ignition, or contacted to supply power like Abloy's Cliq system. For deadbolts, I also like the double ball bearing at the end of the bolt like my MTL Interactive has.
As far as overall design goes, we're starting to see more Euro cylinders pop up here in the states. Pella uses Euro's that are set up on a KW1 or SC1 keyway, so I think this would be an idea to make this initially a Euro cylinder, but with a tubular lock body that would accept the Euro cylinder.
Doors here are a lot of the problem. Securing only the free end still leaves the hinge side vulnerable. Most homeowners have figured out to install 3" or so screws into the deadbolt strike plate so as to get a bite into the 2x4 framing, but this is a moot point if you still have 1" screws in the hinge side. I think a good door has built in multi-point locking with 3 bolts to the lock and hinge sides, and 2 into the sill and header. But I digress.
I also agree with another poster that, in a residential setting, the lock should include a digital key pad and/or remote control. The problem with the keypad is that it would allow the lock to be broken off the door more easily. I have a Kiwket SmartKey in my cabinet that I used for a while, and the keypad is just plastic, from what I can tell. I would say use an encrypted RF system for a key chain remote (similar to what Morning Industry has) then have a wireless keypad similar to something you'd have on your garage door.
Also, more home owners, like myself, are converting over to home automation systems. I have an older home, so running structured wiring is too cost prohibitive. My choice is an Insteon system. So having the electronics in the lock being able to communicate with the system would be a very good thing.
The "ultimate" lock is something that will have to be approached from all angles. But I think opening it to the community like you have done is a good start.

[greystorm]

If you use electronics, don't forget about denial of service type of attacks. Keeping bad guys out is one thing, but letting good guys (and gals) in is primary!

Good point - denial of service is a modest concern; however, most any key or keypad lock can be DoS'ed trivially. Purely RF (rolling code) or RFID (proximity) locks have no external moving parts, but don't make good residential deadbolts (due to lock/unlock power requirements in a deadbolt configuration); they are best as commercial locks on metal or solid doors with metal frames). For many, DoS isn't a huge issue because other even easier more common forms of vandalism are harder to protect against.

I don't think any one lock would be the "perfect lock". Security is always a product of its context and always involves tradeoffs; different people need to make different tradeoffs. I suspect that there won't be any one TOSL. There would need to be a set of them.

Open source and full disclosure work well in the computer security world. The physical security world is somewhat tougher because of the relative expense and difficulty of applying a "security patch" (i.e., replacing the lock). I do like the TOSL idea, though.

[serrurier]

Good day,

I have read all the posts and find this project quite interesting but the last post seems to be a while back. Nonetheless, after a bit of thinking I cannot help wondering what would be the best approach. I believe that first if power is used it should come from the key as stated by some. Not only is it a lot easier to change batteries but it is also something you don't leave outside. I would be inclined to suggest a hybrid system just because you cannot stop progress and as such a "handshake" system like you find on cars would be best. The kind that even if you can pick the lock the car won't start if you don't have the chip in the key frame and this would be a good first security level.

That is as far I went since I really need to munch on this a lot more.

Really nice project and it certainly got my grey matter spinning

take care and keep on picking

[krprice84]

I see where you are heading with this. Although in all practicallity, I see the future locking systems for doors being more about biometrics than mechanical.

If you remember the movie Back To The Future III, the house in Hilldale of the future, had a entry that was activated by a biometric signature. No physical keyhole as such would make an attempt at covert entry, virtually impossible.

Walk up to door...sensor recognizes you by your unique biometric signature and automatically opens to touch. This eradicates the need for keys of any type completely.

I believe this will be the wave of the future...that will eventually replace all mechanical key type cylinders. It might take 100 years or more, but I think that it will be the most truest form of physical security protection for entry systems.

Figured I'd weigh in here... biometrics are, I believe, an inherently flawed design. We humans are incredibly innovative and wiley creatures. When we want to figure something out, there's a good chance we'll do it. We used to think fingerprints were inherently secure, then we found out that they truly are not hard to replicate at all. Finger vein patterms - yes, much more difficult, but surely someone will crack that too. Retina scanning, I'm not 100% sure, but I know people have talked about being able to crack that too. Then we run into a problem such as "what happens if the person with the key dies?"... then what? AND (HUGE AND) what happens if (when?) the biometric security method IS compromised?? If the finger vein pattern gets compromised, then there's NO changing it, ever. Now, all of a sudden, that person is NEVER going to be able to use that type of "uber secure" lock, ever again. I think biometrics are cool, but I think they are a passing fad in terms of true security.

As far as encryption, if we're talking "with current technology" then the idea of an electronic lock that is well encrypted is possible to create that is as close to 100% secure as possible. But (and this is a HUGE but) as soon as quantum computing takes off, the idea of current cryptography methods is going to be null and void - it would be possible to determine the prime numbers used for PGP or other various public key systems in an instant. It would be possible to simply try all possible "codes" for a symmetrical encryption system within a matter of seconds.

I don't know enough about quantum computing, but I suspect there would be ways around it to encrypt things, though that would certainly take minds much smarter than my own.

I personally like the idea of a mechanical lock, or at least the an electromechanical lock. I don't believe it needs to be all that complicated either, I think there's likely a much simpler solution that could be designed that couldn't be picked. Something in the way of a system where the key, or part of the key, becomes captive in the lock and gets rotated or moved into a separate "chamber" of sorts. That could be the electro-part, if you want to get complicated. Maybe an encrypted key which you slide into the lock, the locks checks the encryption on, and if it matches then the key gets electromechanically moved into place in a sealed off chamber/area of the lock where the "pins" are fit to the key and, if they fit, the lock opens. If you wanted to stay simpler, you could have it moved and "tested" by using a knob or some other mechanical device.

I think this would be one of the most secure mechanical locks possible. If the key gets moved to a completely separate chamber, and if getting to that chamber is sufficiently impossible with any sort of tool, then picking it now becomes impossible.

[kwoswalt99-]

Hello,
I have been working on something similar for a little while now, and have designed a quite a few entirely mechanical locks. A believe a couple of them are completely pickproof, even though I know it has been said that any lock with a mechanical key can be picked. My question is, even if a lock that is entirely immune to non-destructive attacks was made, would the electronic aspect still be an integral part of this project? After I created my first theoretically unpickable lock, while searching patents, I discovered someone had already patented one similar. The problem with my two most secure designs is that they are not conveniently sized, and could probably only be used in a safe. I haven't yet been able to condense this principle into something small enough to fit into a euro cylinder. Also, is creating a better mousetrap that catches 100% of the mice 100% of the time absolutely critical? Eventually, I am hoping to make some of the locks that I've designed, and have a contest to see if anyone could open them.
Kyle

[mh]

Hi Kyle,

If it's purely mechanical and still 100% manipulation proof, you can of course also make it open source and challenge the Locksport community to open it.

Cheers
mh