Captured-wafer pin-tumbler lock

[Jacob Morgan]

I might be interested in trying some 3d design tools; do you have any recommendations for free or cheap tools that I could use to do some renderings?

Try SketchUp, it is a free 3D drawing tool available from Google. Should be plenty of tutorials on YouTube.

In theory, I would wonder if impresioning would not be a means of attack. If the "secondary" lock is connected, pin for pin (or pin for lever or whatever) then the secondary wafer/lever/pin that does not open in the secondary lock would apply greater force to the bottom pin in the first lock. If a person impressioned enough to get the first lock to turn they could then continue to impression until the second lock turned as well.

[supercat101]

I might be interested in trying some 3d design tools; do you have any recommendations for free or cheap tools that I could use to do some renderings?

Try SketchUp, it is a free 3D drawing tool available from Google. Should be plenty of tutorials on YouTube.

I'll look into that.

In theory, I would wonder if impresioning would not be a means of attack. If the "secondary" lock is connected, pin for pin (or pin for lever or whatever) then the secondary wafer/lever/pin that does not open in the secondary lock would apply greater force to the bottom pin in the first lock. If a person impressioned enough to get the first lock to turn they could then continue to impression until the second lock turned as well.

It may be important to have the lock assembled out of components that are pre-worn by random amounts to avoid having usage of the lock leave some master wafers able to slide more readily than others, but otherwise I don't see any usefulness for an impressioning-based attack (unlike with the Forever lock or "dustproof" safe lock) if the mechanism does not allow the second-stage mechanism to be put under tension until the lock is turned enough to break the shear line. Impressioning well enough to get the first stage to turn would be trivial, but once it turns the pins in the plug would no longer have any mechanical connection to anything in the second stage, nor to anything which "knows" anything about the correct key. Am I missing something?

[Jacob Morgan]

Impressioning would not work to directly open the second lock, I was thinking about a possible variation of the lock design--a few hours later I realised the mistake.

But, maybe a hybrid approach would work for this design? Impression a key to open the first lock. The cuts can only be deeper from there for the second lock. Attach a wire pointer to the plug. Tape a graduated dial under the wire (some people do this, for a different reason, when manipulating safes). Put in the impressioneed key and place a weight on a lever on it. Read where the wire points. Bring in a punch or a code machine. Take a blank cut to the impression, cut one notch one depth deeper, and insert it and put on the same weight/lever. If a lever/wafer/pin in the second lock is set the wire should move, like a tension wrench moves when a pin is set. Cut the next notch one cut deeper, repeat. Keep cutting until the reading shows less rotation than the prior key, that would mean the prior key had a proper cut that the new key does not have--the last notch cut deeper was correct before it was cut deeper, so now the correct cut is known for that position. Repeat the process. A person would only know the right depth once it was too deep, so they would go through half a dozen blanks or so, so it would only be practical if one had a punch or a cutting machine or were fast with a file.

[Jacob Morgan]

Maybe this would be a simple-to-produce version of the concept:



Just take an old-fashioned side bar lock and extend one or more parts most discs/wafers into semi-circular traps that are molded in (or broached out of) the cylinder and then cut some false side-bar notches into each disc. At least one of the wafers would be a normal side-bar wafer so at rest the sidebar would be where it should be. Basically a hybrid side bar and disc tumbler lock, has anyone made those before?

To release the side-bar (the first lock) the key would go in, then the side-bar would lock the discs in place then upon rotating the plug +/- 15 degrees or so the discs themselves would (with the right key) clear the cut-outs in the plug (the second lock). If any wafer is too low (in the bottom trap) or too high (in the top trap) then the plug would not finish turning.

Picking it, one or more false-notches would connect with the side-bar, the side-bar would lock the discs in place, the plug would turn, then one or more of the discs would not clear the bottom trap (and/or enter the top trap) and the plug would stop turning. In the rough sketch above the top and bottom traps need to be a little wider than drawn.

[supercat101]

But, maybe a hybrid approach would work for this design? Impression a key to open the first lock. The cuts can only be deeper from there for the second lock. Attach a wire pointer to the plug. Tape a graduated dial under the wire (some people do this, for a different reason, when manipulating safes). Put in the impressioneed key and place a weight on a lever on it. Read where the wire points. Bring in a punch or a code machine. Take a blank cut to the impression, cut one notch one depth deeper, and insert it and put on the same weight/lever. If a lever/wafer/pin in the second lock is set the wire should move, like a tension wrench moves when a pin is set. Cut the next notch one cut deeper, repeat. Keep cutting until the reading shows less rotation than the prior key, that would mean the prior key had a proper cut that the new key does not have--the last notch cut deeper was correct before it was cut deeper, so now the correct cut is known for that position. Repeat the process. A person would only know the right depth once it was too deep, so they would go through half a dozen blanks or so, so it would only be practical if one had a punch or a cutting machine or were fast with a file.

What you're describing is very much like the "micrometer attack" used on combination safe locks; countering it would require that the sensing bar be moved not directly by core rotation, but rather via spring tension from a device which would "snap" into one of two positions based on core rotation. Such a countermeasure could be easily accomplished in a safe lock, but would be harder to accomplish in the space available in a standard cylinder-lock profile.

An additional countermeasure might be to allow the sensor bar a little bit of travel perpendicular to the direction it needs to move for the lock to open, and have pins include a variety of false gates that would cause the sensor bar to shift left and right by varying degrees, such that in most cases the lock would be binding on two pins rather than one, and some false gates would allow more motion than the real ones. Someone who took careful notes about what keys produced what readings could probably eliminate from consideration many keys that couldn't possibly work, thus allowing an attack that would be considerably faster than brute-forcing the key space, but the attack would still be a lot slower than conventional picking attacks.

[Jacob Morgan]

https://www.google.com/patents/US7225651

Here is a patent that Master Lock filed several years ago, it does use the concept of a lock within a lock where the first lock is set then rotated a few degrees before the second lock is encountered.

Maybe off topic, but is there any reference out there that catalogs lock designs with a formal typology? So that one could select certain characteristics then see if there are already designs along those lines? And for each design have links to patents, manufacturer part numbers, etc. Does Pulford's book on high security locks have anything like that? (I'm saving up for it, have never read it myself.)

[supercat101]

https://www.google.com/patents/US7225651

Here is a patent that Master Lock filed several years ago, it does use the concept of a lock within a lock where the first lock is set then rotated a few degrees before the second lock is encountered.

Maybe off topic, but is there any reference out there that catalogs lock designs with a formal typology? So that one could select certain characteristics then see if there are already designs along those lines? And for each design have links to patents, manufacturer part numbers, etc. Does Pulford's book on high security locks have anything like that? (I'm saving up for it, have never read it myself.)

Unless manufacturing tolerances are very tight, I would expect that locks which rely upon overhanging wafers would be susceptible to decoding by feeling whether wafers are binding on the top or bottom (which would thus indicate whether they are too high or too low). The sidebar mechanism could actually assist in a deciding attack using a set of straight "try-out" keys, one for each bitting depth. Insert key, tension the lock, remove key, and feel the wafers.

To my mind, mechanisms which have a sliding surface with gates and an object which fits into them should be more secure than mechanisms that rely upon a shear line or overhanging wafers; I'm not quite sure what advantage there would be to having the sidebar merely hold the wafers roughly in position and then using overhanging wafers to prevent rotation, versus using one or more sidebars to block rotation, but having false gates that are just as wide as real ones but not as deep.

If one wanted to prevent someone from feeling which tumbler was binding, a wafer/sidebar lock could be improved by having each wafer be a folded "U" shaped piece of metal (with the fold sitting across and riding on the key) that had a second wafer riding inside it. The outer wafer would have a full set of full-depth notches, while the inner wafer would have a bunch of shallow gates and one deep one, aligned and beveled so that when the sidebar is inserted it will raise the inner wafer slightly off the surface of the outer one, making the range of motion available to the outer wafer independent of whether the sidebar has bottomed out in a false gate.

[supercat101]

If one wanted to prevent someone from feeling which tumbler was binding, a wafer/sidebar lock could be improved by having each wafer be a folded "U" shaped piece of metal (with the fold sitting across and riding on the key) that had a second wafer riding inside it. The outer wafer would have a full set of full-depth notches, while the inner wafer would have a bunch of shallow gates and one deep one, aligned and beveled so that when the sidebar is inserted it will raise the inner wafer slightly off the surface of the outer one, making the range of motion available to the outer wafer independent of whether the sidebar has bottomed out in a false gate.

Things wouldn't quite work as I meant to describe them, and my explanation was unclear, so here's my attempt at a picture. Each wafer assembly is two pieces--a stamped and folded piece in green and a flat piece in blue that fits between the folded-over sections of the green piece so that the relative heights would be as shown in the picture. When no key is inserted, the side bar would enter the top notch and a solid piece of the core would sit to the left of that notch. A spring would push down on the nub near the lower-left of the blue piece. Inserting a key would raise the wafer above the point where the core would be reinforcing it, but the sidebar wouldn't be engaging it there so it wouldn't need reinforcement.

Turning the lock would cause the sidebar to be inserted in such a fashion that after it entered the notch on the green plate, it would enter the notch on the blue plate and raise the blue plate slightly so that its position would be controlled by the sidebar rather than the green plate. The range of motion available to the green plate would thus be independent of whether the blue plate was binding on the sidebar.



This is my first try putting an image here--hope it works.

[supercat101]

Any new lock design that has some validity is a good thing, but to make a difference it needs to be easily manufactured. Taking the concept of the OP, the sketch below is one idea on how to take that concept and maybe make it easier to produce:
...
It takes a normal rim mortise cylinder and drills two new sets of holes and adds some semi-circular cut-outs in the plug (with a Woodruff milling cutter, etc.) It would then take two sets of new pins and the top pin would need to be a mushroom-looking pin with a reduced diameter area of a given size.

Inspired by an idea of LockPicking Layer's YouTube channel, I think I thought of a much simpler way of doing things. Have each pin stack hold both a flat-bottomed pin and a T-pin above the key pin (in some order), and then mill slots on the core over/through which each pin on the bible would ride. Have some slots be narrow enough that a T pin will enter and get stuck (include a gentle slope back toward the start position to allow the lock to be reset) but a flat-bottom pin would ride over. Make other slots wide enough for either kind of pin to enter (with a gentle slope back toward the start as above) and then have the wide part end abruptly while a narrow part slopes back out. To prevent a plug-spinner attack from having the bible pins simply ride over the plug, include a notch in the upper part of the housing that could momentarily snag a pin in the cylinder if it's rotated too fast.

Having two kinds of slots in the core would make re-keying somewhat complicated (a picker who knows the pattern of slots on the core would have a huge advantage, so having all cores use the same pattern would not be a good idea). On the other hand, such an issue wouldn't be a problem for a challenge lock. I'm not sure what the minimum practical height for a "mechanically-stable" T-pin wafer would be, but it would be conceptually possible to have two different kinds of T-pin as well as the flat-bottomed pin (allowing three potential sheer lines) and design slots that would catch any two out of the three types of pin.