Overview Of Locksmithing
Overview of Locksmithing
Splash! 2007 (November 18)
Sho Uemura (meeg@mit.edu)
What is locksmithing?
• The science and art of making and defeating
locks
• Lockpicking uses knowledge of lock design
• Lock design uses knowledge of lockpicking
Why study locks?
• Not because it’s useful (it’s not)
• Know the law and be ethical
Lock design
• The purpose of a lock is to make something more
accessible to the owner than to attacker
• Convenience: minimize difficulties for owner
• Security: maximize difficulties for attacker
Principles of design
• Lock must be cheap and
durable
• Picking the lock must take
• Lock must be easy and fast
time, training and tools (the
to open
three T’s)
• Key/combination must be
• Method of entry should not
easy to carry
be reliable and repeatable
(the two R’s)
• Design should be
expandable
Lockpicking
• Every technique relies on one weakness of the
design: the dominant imperfection
• Two methods: “mind” and “hand”
• “Mind”: fool the lock into thinking you have the key
• “Hand”: use weaknesses in design to bypass lock
security
Pin tumbler lock
• Most common type of key lock today
• Cheap, mass-produceable, durable, compact
• Many variations, but basic principle is the same
Pin tumbler internals
• Key has cuts of varying depths
• Lock has spring-loaded pins that contact the key
• If all pins are at the correct heights, cylinder turns
The sequencing defect
• Locks are designed to test key/combination at
multiple points simultaneously
• Imperfect manufacture -> some points are tested
before others
• Guess each point in sequence to pick a lock
• 100000 combinations, but only 50 guesses
Picking a pin tumbler lock
Ideal lock: all pins are
same size, and holes are
in a straight line; all pins
must be set at the same
time to open lock
Reality: some pins will
bind in their holes
before others; this
creates a sequence in
which the pins can be
picked
How to crack a lock
• Bypass the lock
• Use “magic”
• Decoding
Opening locks with magic:
bumpkeying
• Hit the bottom of a pair of pins, and the top pin
bounces up; a gap is created
• Hit all the pins at once, and the gaps allow the
cylinder to turn!
Bypassing a lock
• Push the bolt back: shimming (for padlocks),
carding and sliding (for doors)
• Remove the lock
• Open door from inside
Shortcuts
• Drill holes in a lock to see combination or break
pins
• “Read” previously dialed combination
• Research lock type - limited combinations, preset
combinations, key cut depths
• Skeleton keys
Common design
improvements
• Sidebars
• Security pins
• Pin-in-pin locks
• Tubular pin tumbler lock
Tubular lock
• Same principle as pin tumbler, but
pins lie in a circle
• Advantage: lock must be picked 6-8
times to unlock
• Disadvantage: pins are more exposed
• Flaw: Impressioning
Impressioning a tubular
lock
Multiple-dial combination
lock
• Combination is a string of dial positions
• Bolt has teeth touching dials
• Correct combination aligns gates in dials with the
bolt
Multiple-dial combination
lock
• Sequencing: Since the bolt contacts some wheels
before others, each wheel’s gate can be found to
open the lock
• Decoding: A thin piece of plastic can feel the
gates in the wheels directly
Single-dial combination
lock
• Cheap, simple; very popular
• Can be very secure; used in most safes
Single-dial combination
lock
• Combination is series of
dial rotations
• Dial pushes wheels
inside lock
• Correct combination
aligns each wheel with
fence
Lock manipulation
• Uses the sequencing defect
• Ideally, all wheels contact the fence
• If one wheel sticks out, the fence will drop down
at that wheel’s gate; this identifies that wheel’s
combination
• Repeat for all wheels to get combination
Warded lock
• Oldest type of lock (Ancient Rome)
• Easy and cheap to make
• Insecure
Inside a warded lock
• Key has notches of varying shapes in varying
places
• Lock has wards blocking the key’s path
• If notches correspond to wards, key can rotate
through to push a bolt
Lever tumbler lock
• Evolved from warded lock
• Chubb detector lock is still one of the best locks
ever designed
• Complex, bulky, fragile and expensive
Lever tumbler lock
• Key has bittings of varying heights
• Lock has levers with cuts in varying positions
• Bolt is released when all levers are raised to the
correct position
Further reading
• MIT Guide to Lockpicking
• Wikipedia
• OldLocks.com
• “Locks, Safes and Security” by Marc Weber
Tobias
• Crypto.com - Matt Blaze
