lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 26 Mar 2014 15:38:13 -0700 From: Richard Chycoski <rac@...co.com> To: Daniel Miller <bonsaiviking@...il.com>, Jon Hart <jhart@...ofed.org>, fulldisclosure@...lists.org Subject: Re: [FD] Master Lock random key code generation/distribution Fails Keycodes on padlocks do not (normally) have the bitting code numbers on them. The keycodes have no relation to the bitting codes. Master locks that I've seen certainly don't, and even the cheap locks on our cabinets in the office do not either. When I had a set of locks custom-keyed for a previous house, the locksmith put the bitting code on one key of each time to make it simpler to set up if/when I needed more keys. I never carried these keys around, since anyone spotting the bitting code could easily make a copy. I recommend that people never carry keys with the bitting code on them, put them away in a safe place. For my current house I keyed it differently. There is a master key that opens everything. There is a front-door-outside key that only opens that one lock, so that if someone (read - some kid :-) ) loses that key I only have one lock to change. There is an 'inside' key that only opens the inside deadbolts, and when the house is occupied we leave inside keys in those locks - and if someone wanders off with one, they're not useful for getting into the house. For these keys, the locksmith did not stamp bitting codes on any of them. It depends on the locksmith. - Richard On 3/26/14 3:17 PM, Daniel Miller wrote: > On 03/26/2014 05:03 PM, Jon Hart wrote: >> This is definitely an interesting finding. I'll admit that I don't know >> what the key code actually does or how it is used, but at the risk of >> stating the obvious this is physical world equivalent of problems we >> face >> daily in the infosec field -- randomization is hard, small key spaces >> are >> bad, and vendors will continue to make this mistake (hopefully) until >> it is >> disclosed. >> >> -jon > Jon, > > The key code is used to identify locks that share the same key. For a > pin tumbler lock, it usually corresponds exactly to the height of each > of the pins in order. So the key code 2685 in the image probably looks > something like this: > > > |^\ > |..| > |..\___ > |......| > |......\_ > |........| > |......_/ > |.....| > ******* > > Dan > > _______________________________________________ > Sent through the Full Disclosure mailing list > http://nmap.org/mailman/listinfo/fulldisclosure > Web Archives & RSS: http://seclists.org/fulldisclosure/ _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists