full-disclosure - Re: [FD] Master Lock random key code generation/distribution Fails

Open Source and information security mailing list archives

Message-ID: <533356D5.2060604@cisco.com>
Date: Wed, 26 Mar 2014 15:38:13 -0700
From: Richard Chycoski <rac@...co.com>
To: Daniel Miller <bonsaiviking@...il.com>, Jon Hart <jhart@...ofed.org>,
	fulldisclosure@...lists.org
Subject: Re: [FD] Master Lock random key code generation/distribution Fails

Keycodes on padlocks do not (normally) have the bitting code numbers on 
them. The keycodes have no relation to the bitting codes. Master locks 
that I've seen certainly don't, and even the cheap locks on our cabinets 
in the office do not either.

When I had a set of locks custom-keyed for a previous house, the 
locksmith put the bitting code on one key of each time to make it 
simpler to set up if/when I needed more keys. I never carried these keys 
around, since anyone spotting the bitting code could easily make a copy. 
I recommend that people never carry keys with the bitting code on them, 
put them away in a safe place.

For my current house I keyed it differently. There is a master key that 
opens everything. There is a front-door-outside key that only opens that 
one lock, so that if someone (read - some kid :-) ) loses that key I 
only have one lock to change. There is an 'inside' key that only opens 
the inside deadbolts, and when the house is occupied we leave inside 
keys in those locks - and if someone wanders off with one, they're not 
useful for getting into the house. For these keys, the locksmith did not 
stamp bitting codes on any of them. It depends on the locksmith.

- Richard

On 3/26/14 3:17 PM, Daniel Miller wrote:
> On 03/26/2014 05:03 PM, Jon Hart wrote:
>> This is definitely an interesting finding.  I'll admit that I don't know
>> what the key code actually does or how it is used, but at the risk of
>> stating the obvious this is physical world equivalent of problems we 
>> face
>> daily in the infosec field -- randomization is hard, small key spaces 
>> are
>> bad, and vendors will continue to make this mistake (hopefully) until 
>> it is
>> disclosed.
>>
>> -jon
> Jon,
>
> The key code is used to identify locks that share the same key. For a 
> pin tumbler lock, it usually corresponds exactly to the height of each 
> of the pins in order. So the key code 2685 in the image probably looks 
> something like this:
>
>
> |^\
> |..|
> |..\___
> |......|
> |......\_
> |........|
> |......_/
> |.....|
> *******
>
> Dan
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives