Master Key Duplication

[cheezewiz]

Forgive me if this is considered an advanced or inappropriate topic, go ahead and remove and move it if it is.

I have been wondering this for a while now. Would it not be possible to duplicate a master key by opening up the lock (assuming you have a key and that the lock pinned to accept a regular and master key) and measuring distances of the pins with a pair of calipers and cutting a key to those specs? It seems like this would be too simple of a security risk, am I missing a key point?

[jimmysmith]

as far as i know.. If you can open that lock and get to the pins.... yes it can be done.

[cheezewiz]

wow, sounds like trouble to me. But I guess if someone all ready had access to the lock / locks there wouldn't be much incentive, especially if they weren't the type to cause trouble.

[Squelchtone]

Forgive me if this is considered an advanced or inappropriate topic, go ahead and remove and move it if it is.

I have been wondering this for a while now. Would it not be possible to duplicate a master key by opening up the lock (assuming you have a key and that the lock pinned to accept a regular and master key) and measuring distances of the pins with a pair of calipers and cutting a key to those specs? It seems like this would be too simple of a security risk, am I missing a key point?

Your biggest challenge would normally be that your change key (user key) is already cut down too low to make a master key. *BUT* if you can get a blank key for that system, then yes, you could measure all the pins you remove from a master pinned lock cylinder and cut yourself a working master key onto the uncut blank.

That said, the company someone works for, or school someone attends puts a lot of trust in the end users hoping they don't misuse that trust of being given a key for their office or dorm room in order to remove the lock and extrapolate a working master key to the other offices or rooms.

It's all a matter of ethics from that point on.

Squelchtone

[cheezewiz]

Sounds kind of like the security through obscurity scenario you hear about in the computer security world. I guess this is why security is so interesting to me. There are always inherent flaws and always things to be improved on.

Btw, wow replies sure come fast here! <3 the internet.

[jimmysmith]

not trying to get into or start a conversation that has anything to do with criminality...but.. i wonder if a place that had a master key system notice one of the locks "missing" if they would replace all the locks.. ?

[jimmysmith]

That becuase your on the best site there is!

[cheezewiz]

interesting point jimmysmith.

I'm assuming if a lock goes missing or for that matter a master key goes missing, a company/school is supposed to re-key everything? Obviously that's not always practical, is this just commonly ignored?

and ill second that this is the best site there is!

[linty]

I've had to do that before, works just fine.

There's also a way to do it without taking the lock apart, but I don't know if that can be discussed here. There was a paper published on this a few years back.

Generally everybody with a master key system knows that losing a key compromises the premises, but i don't think they would even consider losing a lock to be a major breach of security. Unless it's a high security system, losing a key is no different then letting a key out of your sight for more than 10 minutes, because that's about all it takes for somebody to get a copy made at the nearest key cutter.

[unjust]

that would depend on teh relative security of the system. and what went missing. keepign in mind that this is theoretical, and not designed to grant access to something you shouldn't have access to.

i.e. if you have access to one change key, you can dramatically reduce the # of possible keys, and as shown in a whitepaper, raise up your authority level.

so loosing a key is *potentially* as big a deal as loosing a cylinder, however if someone is going to go to the trouble to take apart a lock and generate a key from that, then realistically it's going to be easier and cause less notice to impression a couple of locks and use them to generate pin ranges and from there create a higher level master.

from a security standpoint: loosing a cylinder is no more a threat than loosing a change key, however, would certainly arouse more suspicion. you're not *necessarily* know what pins are master and sub from disecting a lock, and coudl end up with a submaster instead of a gm, and depending on the # of levels of master, and # of pinnings could still have a ~20-100 keys to try out.

[jimmysmith]

thats a very good point.
So if a guy was to take apart a master keyed lock..
how could you tell what pins are for the master key?

[zeke79]

You cannot. All you can do is reduce the number of possibilities.

[jimmysmith]

I believe that, first thing I would try is cut two keys one for each shear line. ...and pray it works.

[zeke79]

If the system is setup right it will not.

[Gordon Airporte]

And the more locks you can open, the more you could narrow down the possibilities. Here's the Matt Blaze paper on master keying vulnerabilities - but his attack doesn't need to take the lock apart, it just needs a user key and a supply of blanks for some trial and error.