Duplicating house keys using a 3D Printer

I had the idea to duplicate some house keys on my Makerbot Thing-O-Matic 3D printer after seeing a post about in on thingiverse here.

So after messing around with the script for a while i couldnt really get it to work so i decided to just make a script from scratch to improve my SCAD skills. (SCAD is like a programing language for creating parametric 3d CAD objects)

After a few hours with a key and a pair of digital calipers i got an object that fit in the lock but has not been cut (think of a blank key).

Key Blank Openscad

Blank comparison - front

Blank comparison - Top

From there i started working on the cuts. On this particular key the cut depth appeared to be a multiple of 0.58mm with spacing from every cut being equal to 4.12mm. Some of these measurements where gained by using this cheat sheet.

This step was mostly trial and error, i made modifications halfway through to reduce printing time and many modifications to the multipliers, cut depths, ect…

All keys

Eventually came up with some results as shown above. After the measurements where perfected the keys started to work. The keys are brittle but do work and most locks don’t have much resistance turning the key when the key fits. The use of a torsion bar to turn the lock could be used on rusted or heavy locks.

Every key has a bit-code, this is a set of numbers that identify the key’s ID number. Any similar style key with the same bit-code will work in the same lock. I was able to guess the bit-code but this photo will show what im doing. We are measuring the dips and not the ridges, the ridges exist to ensure the tumbler pins rest in place.

Note: In my script the bit-code goes from base to tip, other scripts or even official documentation may be different.

BitCode

The keys only have 7 ridges based on documentation linked above. This gives a total key-space of 7^7 or 823,543 different combinations.

With such a small combination of ridges its not hard to see why lock-picking isn’t difficult. Not only that but the keys are pretty easy to duplicate based off visual identification, the SNEAKEY system deminstrated this (Link: http://www.schneier.com/blog/archives/2011/07/duplicating_phy.html)

OpeSCAD Render

Cut comparison

Cut - Lock

In total i did this entire project in just a few hours, its scary how simple many of these keys are in design. I would estimate that i could duplicate high security keys in a similar time if my printer has the accuracy. Sure some of these high security keys are very difficult to pick but if all it takes is visual inspection of a key to breach a lock then this presents a problem for people who wish to keep things behind locked doors.

Perhaps now with the boom of consumer grade 3D Printers its important then ever to move to digital keys.

My SCAD source file: key1.zip

10 comments

  1. J R Mole says:

    Great idea! I guess this is the final nail in the coffin for systems like Medeco that rely (partly) on restricting distribution of key blanks.

    If you are worried about breaking the plastic key, you can turn the cylinder with a tension wrench (from a lockpick set) while the key is in.

    Another thought: Locks on a master key system will accept two different heights for some of the positions. Suppose you have a legitimate key that opens a single door in a master key system. You could 3D print a number of alternative keys which differ from the legit key in just one position. Then you could test which ones still open the door, and that gives you the information necessary to reconstruct the master key. You can spread the testing over weeks in order to avoid suspicion.

    Anyway, great project, and happy hacking!

  2. datenwolf says:

    Just a little linguistic nitpicking. “bit” is short for “binary digit”, i.e. a digit with two (binary) possible values. So the term “bit code” is linguistically wrong. What you have there is a “digit code” or “digital representation”. (In that regard I’d like to remind people that “digital” doesn’t equal “binary” – it just means “described by a finite set of discrete states”, i.e. by a set of digits).

    • Ian says:

      PX is right, bit, in this instance, does not mean binary digit, but rather something like a screw driver or router bit. And anyway, bits are used to represent numbers other than just one and zero, if it was “3 bit code” it could represent 8 possible digits, 0-7. Bits are the same thing as digits, though bits are base 2 and digits are base 10. “Bit code” would not be semantically wrong in either sense, so stop nitpicking stuff when you don’t know what you’re talking about.

  3. px says:

    I’m pretty sure “bit” is referring to the drill bits that are used to cut the notches in the keys.

    http://en.wikipedia.org/wiki/Bit_(key)

  4. Nick Andre says:

    I believe it’s sometimes called a “bite” code?

    Anyways, yes there’s an MIT paper floating around about going from user key -> master key. Basically, you need a code cutter and an equal number of keys as pins on the key. The depth of each notch that is NOT on the user key is the master key depth.

    Also, lock picking exploits mechanical flaws in the lock. After applying tension, one pin “binds” at a time and you just push that pin until it unlocks and move onto the next pin that binds. Tension is key.

  5. Dave says:

    If I may offer a couple of corrections.
    Firstly I hope this doesn’t come off as rude, I’m just trying to help. :)

    Lockwood uses 10 depths of cut and usually to 5 or 6 cuts, not the 7 that you suggest; I’ll get to that.
    Lockwood spacings are measured from shoulder to tip. In this case your original key has only 5 cuts. It’s hard to tell from pictures alone, but the shallowest cut in your key is a 1 maybe 2. The deepest is certainly an 7 possibly 8.

    The 7 that you refer to being in the linked documentation I can only assume is the MACS that is listed with the Lockwood Space and Depth information.
    This is not the number of Spaces or Depths, but rather stands for Maximum Adjacent Cut Specification.

    This is the maximum allowable difference in adjacent cuts; e.g. a 1 cut next to an 8 cut, or a 2 cut next to a 9 cut is allowable, however a 1 next to a 9 or a 0 next to an 8 is not. If this is breached, the entrance and exit ramps begin to encroach on the root of the cut and this increases the effects of wear on the key (in the case of a difference of 8), or completely cuts out the shallower of the two cuts.

    I hope I have helped. :) Any questions, just reply to this and I will try to help.

    • ginaux says:

      Please make as many corrections as you feel like! I started this project with no more knowledge of keys then a old lock/key and a pair of calipers. There are no nice datasheets on keys Ive found so i just started from scratch.

      You do add a good point about the maximum key-size.

      Honestly i need to rewrite this entire article when i get time…

  6. Colin says:

    My old security professor from UCSD published an interesting paper on duplicating keys from photographs. Combining your 3D-printing scripts with his software for decoding keys from a distance would make it very easy for anyone to duplicate.

    http://vision.ucsd.edu/~blaxton/pagePapers/laxton_wang_savage_ccs2008.pdf

  7. Squelchtone says:

    Just a quick correction for our coder friends, from your lockpicker friends. I’m not sure what the OP/author meant by bitcode, other than perhaps he/she meant the word “bitting” which is what locksport types and locksmiths use to describe the key cuts. It has nothing to do with bits and bytes, it is its own word used as part of every day locksmith work. Some people pronounce it bitting as in “hitting” some people say it as biting as in biting into an apple. Or you can say the “key cuts” if you do not like using the word bitting, which some folks don’t.

    Very cool project, and it’s nice to see the coder, hacker, maker, and picker worlds intersect like this! =)

    Thanks and have a good weekend,
    Squelchtone
    Lockpicking101.com

Leave a Reply

Your email address will not be published. Required fields are marked *