Slashdot Mirror
MIT Students Release Code To 3D-Print High Security Keys
Sparrowvsrevolution writes "At the Def Con hacker conference Saturday, MIT students David Lawrence and Eric Van Albert released a piece of code that will allow anyone to create a 3D-printable software model of any Schlage Primus key, despite Schlage's attempts to prevent the duplication of the restricted keys. With just a flatbed scanner and their software tool, they were able to produce precise models of Primus keys that they uploaded to the 3D-printing services Shapeways and i.Materialise, who mailed them working copies of the keys in materials ranging from nylon to titanium. Primus high-security locks are used in government facilities, healthcare settings, and detention centers, and their keys are coded with two distinct sets of teeth, one on top and one on the side. That, along with a message that reads 'do not duplicate' printed on the top of every key, has made them difficult to copy by normal means. With Lawrence and Van Albert's software, anyone can now scan or take a long-distance photo of any Primus key and recreate it for as little as $5."
Until somebody offends the G8. Vladimir Putin subsequently has him bound to a rock, where each day an eagle is sent to feed on his liver, which is re-printed and re-installed each day, almost like an old Windows version. .is bound to the same rock, and subjected to Barack Obama speeches in an infinite loop.
OR
. .
Unclear which is worse.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Really? That makes them difficult to duplicate? On which planet?
This will prompt someone to spend an inordinate amount of taxpayer money on electronic locks which are even less secure.
I'd hardly call any industry that uses a physical key "high security" in an age of individually-revokable key card technologies.
How secure can a facility be when the loss of one key means that everyone's keys have to be replaced in order to recode the lock?
I do not fail; I succeed at finding out what does not work.
I don't think so. A long distance photo is not going to give enough detail. You'll need a high resolution photo of the key.
Make the keys so that there are sheaths around them, which can bend away on a spring when you need to use the key, or the key can come out of the end of the sheath. Or some other way to hide the tooth pattern when the key isn't being used.
Technoli
This is nothing new; it's also very easy to do with a photograph, a file and a dremel tool. Not that I've got any experience or anything, but I certainly never paid a lost key fee in college.
Former locksmith here. The Primus (and nearly all of the other high security keys) are simply relying on patent protection to keep people from duplicating the keys. Any locksmith worth his/her salt already has key machines that could reproduce them onto a chunk of brass (worst case) or just onto a normal key blank.
If you want to see something that would impress me, look at a German company - DOM - that has a design that includes a floating ball bearing in the key, which is integral to making the lock work. If they could make THAT with a printer, I'd be impressed.
One model:
http://www.dom-sicherheitstechnik.com/DOM-ix-Saturn.667.0.html
For us carnivores, "Sucking the marrow out of life" isn't a transcendentalist philosophy but a practical instruction.
have 24 hour surveillance and use "man traps" which require multiple access keys, electronic or otherwise.
No, no, you're not thinking; you're just being logical. --Niels Bohr
what the lock companies do is they patent the blanks.
that's why lock companies come up with a new scheme every so often. and to buy those blanks you need to sign a contract that you wont copy without permission of the lock owner.. which is hard to check anyways.
world was created 5 seconds before this post as it is.
Scanning keys to generate plans for a 3d printer is groundbreaking research? Wow.
If you ignore ACs because they are anonymous - you're an idiot.
A lock will only ever serve to keep an honest man honest.
Try our newest, bestest attempt at "security": Biometrics. Someone copies the key, now what? Replace the compromised worker? Kill the citizen and hope the citizenry spawns a new one?
Note, however, that for some purposes individually revokable keys are not well-suited. Like the fireman's keys, that tend to be used in emergencies when comms lines may not be available to check for key validity... or even electricity for the electronic locks to work at all. Battery backups only add to the confusion, because they need maintenance and regular replacement that might well be forgotten, skimped, skipped over, you name it. Mechanical locks simply work better in this sort of scenario.
What this means is that you can no longer simply let the keys lay about where people can scan them, or take a picture of them. This is not much different from not leaving people alone with keys lest they make imprint copies. It is somewhat new that even a long range picture is enough (another MIT story previously here on slashdot), and now 3D printers turn out to be good enough. Clay moulds were already good enough and are still cheaper than 3d printers, if somewhat more messy, so really, this isn't much of a difference.
The simple fix? Keep those keys out of sight, like, inside a key bag or something. Like you would with your digital "private key", dig?
I my jurisdiction it is (or was, a decade ago) against the law* for a locksmith to copy keys that are both marked "do not duplicate" and which used blanks available only to locksmiths required the locksmith to go through paperwork to make sure the person requesting the copy was authorized by the lock-owner to do so. This typically involved asking the requester to provide the lock's "number" which presumably the lock owner had but which was not on the key or lock itself.
Up until recent decades, one of the more practical ways to duplicate many security keys was to make a mold and build a key from it, like you saw in 1960s spy movies. Yes, that required physical possession, but it didn't require a locksmith.
--
*I'm not sure if the law has any real teeth, it may be just a "civil fine" or it may just open up the locksmith to civil liability if the key is misused, much like if a bartender serves a drunk person more booze and they drive and kill someone, the bartender can be sued by the victim's family.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
"Savage Wang"
hee hee
Can some explain to me why the only stories about 3D printing that make the news are ridiculously paranoid? Anyone can print out a secret key. Anyone can print out shitty plastic gun. What's next? Anyone can print out a bat'leth? Anyone can print out a plastic pressure cooker and make a plastic bomb? Anyone can print out plastic kiddie porn? Not one story discussing the incredible potential? Like, machines printing out copies of itself? Or the effects on a society and economy where any product can be downloaded and printed? None of that interesting stuff? Just the fear and paranoia stuff?
> printable keys, presumably with lookup tables
Stewie: (gets tired look on his face). Oh, here we go.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Why would they do this?
Is there some cure to cancer behind a locked door that they think needs to be free? Perhaps some long lost formula for turning water into gas?
None of the reasons always offered up to justify breaking encryption applies here. How is it that civilization is made better by this?
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
In some buildings the electronic system is for that office only and the building maintenance people have the keys for the traditional locks also traditional locks are needed when power fails or the electronic system fails. Also in some buildings when the fire alarm goes off the electronic doors unlock.
Some buildings make so that only the building maintenance people can change light blubs.
I for one would like to know when i can 3d print a buggy whip.
Huh?
....I do not think Les Claypool appreciates this.
I mean, there was nothing in the key which looked that difficult to duplicate, contrary to those key as you showed. Or even the round key , which have pins on all direction , not only 2 axis but on 8 axis or more (I dunno if you know what type I mean, when you look along the axis they look like a star with 8 ray and along the axis the pins at at random position and random angle). I never found a locksmith which had the way to duplicate those despite wanting a second set of key. (maybe I should have asked a crook ;)).
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Primus Sucks!
So, having read the fine article, where is the code? I didn't see any links to github or similar...
In USA, you 3d print a custom key after months of work. In Soviet Russia, you just use a sledge hammer.
stuff |
"If you have a blank" is a very big IF for the types of keys they are talking about. Wal-Mart doesn't sell sidecut blanks. Only locksmiths trust registered with the manufacturer can buy them.
99% of locks use the common keyways for which you can get generic key blanks. Those also have no effective key control - anyone can get copies made. In a high security environment you use high security locks with key control. The locksmiths who have access to the patented blanks will only duplicate a key after confirming with the registered contact person.
No security is perfect, but this system is alot more secure than just going to Wal-Mart. I worked as a locksmith for a little while. I've cut keys by hand. I can't do that with my office key. ( I work at a security aware agency). Being able to 3D print a key, or a blank, would be handy for me so I don't have to tell the security person that I lost my key AGAIN.
cracked the article is referring to restricted blanks. not available at Walmart or Home Depot. Those stores also do not have the special key cutting machine required to cut into the side of the key.
You don't have to replace all the keys.
If you're concerned, you replace one pin stack in xhe locks that key opens. You don't issue everyone identical keys. My key opens my office and the back door, only. The back door lock has a stack of pins that work as a bitmask, so many keys can open it and you can add or remove keys without necessarily affecting the others.
In re systems that use physical keys - key cards and key fobs are physical keys too. Key cards store their bit pattern in iron powder. "Regular" keys store their bit pattern in brass. There's no fundamental difference in security.
Not as convenient, but it's not as if this is new. I have easy access to a CNC mill. Pretty sure I can make any key that a key cutter can create, given the original (or very good pictures with something for size reference) and a small chunk of billet.
Just another ignorant American.
At some point it will require a license to purchase and own machine tools too.
---- Booth was a patriot ----
The question is how much time it takes. If you look in youtube, the primus one get picked in roughly 3 to 5 minutes.