Opensource maskerkeying project proposal - restarted

[PickPick]

I'd like the program to give me a printable chart on
which the necessary keys for TMK extrapolation are lined out.

I have no Idea what you're talking about *googles for masterkey
extrapolation* but it sounds like a good idea. one of the reasons
I included "must produce a printable sheet" is because it's often
easier to carry a piece of paper arround to
scribble on than even a PDA etc.

It's basically what Matt Blaze wrote in his master keying paper, an attack to generate a master key, starting form a change key and its lock. But I don't know whether Matt already used the term extrapolation, I picked it up during a talk that Marc Tobias gave.

[MrB]

The (dare I say "old fashioned"?) formal software development lifecycle is not the only way to go these days. There is now agile development, involving small repeated iterations. This is good, because it lets you see results quicker, it lets users try things out before you have made too much investment, and it lets you adapt more readily if you find you have made any design errors.

Agile programming has come out of a realisation that however much effort you put into identification and specification, you will always tend to find at the end of the project you have got it wrong. (The reason is that customers don't really know what they want, and will innocently give you duff information if you ask them. But show a user something built and working, and they will readily tell you all the things they don't like about it. That's life.)

Incidentally a very good way to write the spec for an application is to write the user guide for it. Where I work, we write the user guide with screen shots and everything before we start coding on any new feature.

[zeke79]

Checkout SuperKey2000. They have a trail download. It seems well laid out and easy to navigate. You may be able to get some ideas of at least how to layout the information in an easy to view and understand way.

[32768]

It's basically what Matt Blaze wrote in his master keying paper, an attack to generate a master key, starting form a change key and its lock. But I don't know whether Matt already used the term extrapolation, I picked it up during a talk that Marc Tobias gave.

I'm guessing this involves using multiple change keys and interrogating more than one lock to gather additional information?

I was doing some thinking along these lines. If you follow Blaze's paper, and you're in a system with multiple levels of mastering, you're likely to end up with a key which is a combination of the master, grand master, etc. If you want to get a real top level master, then you need to do the attack on two locks which have no common master key other than the top level master. Then you can compare your list of bittings for each pin of those locks and see which correspond. If you're lucky, that will only be one bitting. More likely, you'll end up with several possibilities for each pin and you'll have to repeat with more locks to narrow down the possibilities.

It's difficult to see how you could extrapolate too much useful information from a single change key. Now if we had the option to put in lists of how various cores are combinated- then we could do some extrapolation.

Hey! Another feature- It should have the capability to print nice color pictures of how each core in the system should be set up with the pins colored to match standard colors. Do different manufacturers use different color codes? If so, our intrepid user could set an option for which one they have.

I think at this stage we should get requirements in much the way we have been- random suggestions as we think of them. I'll try to keep a list. If we set up the sourceforge site soon, I could keep the list there.

[randmguy]

Okay first...Ditto what Varjeal said plus I've got demo versions of just about all the keying, coding and control software available. If you'd like to check out what's already selling. You could also take a look at Black Hawk's codes online demo to see working code software. They also have an SFIC pinning calculator online with some other features that look more and more attractive as my code software gets farther out of date.


One thing that may be of interest if this turns out well...BlackHawk Products already has web-based key code software available and they might be interested in something in the masterkeying and key tracking line if you can develop something that would work on the net. Their codes online software is available for web enabled phones too. It's becoming really popular with locksmiths starting out since its only $49 a year and they update frequently. I think thir biggest draw is still the low price. No one wants to shell out $500-$800 for code software when they're struggling to get a business going.


Storing your key records online would be loads better than the current practice of storing master key and bitting records (if you keep them)in a safe.


For features...I know I'd love to have something that allows me to group bitting records by say, building but still let me use the same master system campus-wide. We've got 25 office/classroom buildings and something like 30 residential properties that we rent out and use for odd housing situations (GLBT housing, Frats/Sororities, International students, various educational and research functions in small converted properties). I've still got tons of records on paper because its just too much time to enter each one on a master keying program and all those propeties share master keys. So something easily searchable would be a huge blessing.

[WhiteHat]

I'll try to keep a list. If we set up the sourceforge site soon, I could keep the list there.

I'll go through whatever's required to get the project happening on sourceforge tonight.

[32768]

Storing your key records online would be loads better than the current practice of storing master key and bitting records (if you keep them)in a safe.

Well... Until some l33t h4x0rz get ahold of them and all of a sudden some kid on campus has all the master keys and your boss is wondering why. There are probably a zillion more people out there who can crack a computer than a safe, and they can do it from anywhere. Strong crypto is a great mantra, but why put more trust in it than you have to?

I'm a big fan of computers, but remember that the first rule of the DoD's venerable orange book is that if you want a computer to be secure don't connect it to an insecure network. The same goes for your bitting records. (And keycard codes, etc., etc.)

[WhiteHat]

sourceforge application sent - my username's "whitehatnetizen" - there's already a WhiteHat on there, so don't get us confused.

I asked to take over the unix name of another project "OMK" but if that doesn't go through then we'll just have to think of another acronym or short name.

[Hojo]

So, who think we should start a team and work together and get this baby happening, Im only 15, but have been programming in VB for about 2 and a half years, VB is a strong enough programing language to use, so does anyone want to help me? I realise it will be a MASSIVE project, but its posible and should be done...Anyone willing to help PM me or just post here, we will need a few people, Programmers, GUI Designers and such...

[Hojo]

Ok, I have been thinking about this and I cant really think straight about it, so in the meantime I am going to make a master key system decoder, this is the basics so far:



I will be making it so it can handle more than one master pin, but just want to get the basic code right.

[32768]

Hojo,

Your enthusiasm is awesome, but I don't think we're quite to the coding stage yet. We need to make our plans a bit more concrete first. That's not to say we need to write out full requirements docs before we start (we'd be here for the next year), but we should have a better idea of where we're going with this. That way we can hopefully avoid making too mistakes that lead to having to redesign and recode pieces we thought were done. It'll also help with breaking the project down into manageable pieces so that everyone who wants to can contribute.

VB is a reasonable language to start learning with. My first language was basic (well, after english), and I know lot of programmers who started there as well. While we haven't picked a language yet, I think there are better choices for this project, particularly as VB is essentially tied to one platform. We're trying to write something that will be sustainable for a long time and usable to as many people as possible.

That said, I think you'll find that your programming experience translates well into many other languages. If you know the fundamentals well then most of the changes are just syntax. A for loop or a function call behaves the same way in most (imperative) languages. We can debate the finer points of parametric polymorphism in java vs c++ vs eiffel vs VB until the cows come home but 90% of the code would be the same in any of those.

[macaba]

I am quite willing to be a GUI designer. I have been described as very good!

I'm also a VB newbie, so i'd love to be involved in this aspect to learn from the source code and prehaps write some in whatever language is decided upon.

[MrB]

I'm guessing this involves using multiple change keys and interrogating more than one lock to gather additional information?

Oh no it doesn't!

According to Matt's paper, nearly every master keyed system in use is designed according to either the TPP or the RC schemes.

And with either of these schemes, you can guarantee to read the top master bitting for the entire system using just one lock, the correct change key for that lock, and some key blanks.

I think a different master keying scheme could be designed that does not have this vulnerability, but in practice systems are designed to TPP or RC because they are the standards.

[MrB]

Sorry PickPick, I got my quoting messed up. I wish there was an edit button...

[Varjeal]

Why not think of the "preview" button as an edit button?