Overview of

Locksmithing
Splash! 2007 (November 18)
Sho Uemura (meeg@mit.edu)
 What is
locksmithing?
• The science and art of making and
defeating locks
• Lockpicking uses knowledge of lock
design
• Lock design uses knowledge of
lockpicking
 Why study locks?

• Not because it’s useful (it’s not)

• Know the law and be ethical

 Lock design
• The purpose of a lock is to make
something more accessible to the
owner than to attacker
• Convenience: minimize difficulties
for owner
• Security: maximize difficulties for
attacker
Principles of design
• Lock must be cheap and durable
• Lock must be easy and fast to open
• Key/combination must be easy to carry
• Design should be expandable

• Picking the lock must take time, training and

tools (the three T’s)

• Method of entry should not be reliable and

 Lockpicking
• Every technique relies on one
weakness of the design: the
dominant imperfection
• Two methods: “mind” and “hand”
• “Mind”: fool the lock into thinking
you have the key
• “Hand”: use weaknesses in design
to bypass lock security
 Pin tumbler lock

• Most common type of key lock

today
• Cheap, mass-produceable, durable,
compact
• Many variations, but basic principle
is the same
 Pin tumbler
internals

• Key has cuts of varying depths

• Lock has spring-loaded pins that contact the
key

• If all pins are at the correct heights, cylinder

turns
 The sequencing
defect
• Locks are designed to test
key/combination at multiple points
simultaneously
• Imperfect manufacture -> some
points are tested before others
• Guess each point in sequence to
pick a lock
• 100000 combinations, but only 50
guesses
Picking a pin
tumblerarelock
Ideal lock: all pins
same size, and
holes are in a
straight line; all
pins must be set at
the same time
Reality: someto
open
pins will lock
bind in
their holes before
others; this
creates a
sequence in
which the pins
How to crack a lock

• Bypass the lock

• Use “magic”
• Decoding
Opening locks with
magic: bumpkeying

• Hit the bottom of a pair of pins, and

the top pin bounces up; a gap is
created
• Hit all the pins at once, and the
gaps allow the cylinder to turn!
 Bypassing a lock

• Push the bolt back: shimming (for

padlocks), carding and sliding (for
doors)
• Remove the lock
• Open door from inside
 Shortcuts
• Drill holes in a lock to see
combination or break pins
• “Read” previously dialed
combination
• Research lock type - limited
combinations, preset combinations,
key cut depths
• Skeleton keys
 Common design
improvements
• Sidebars
• Security pins
• Pin-in-pin locks
• Tubular pin tumbler lock
 Tubular lock
• Same principle as pin
tumbler, but pins lie in a
circle
• Advantage: lock must be
picked 6-8 times to unlock
• Disadvantage: pins are
more exposed
• Flaw: Impressioning
Impressioning a
tubular lock
 Multiple-dial
combination lock

• Combination is a string of dial

positions
• Bolt has teeth touching dials
• Correct combination aligns gates in
dials with the bolt
 Multiple-dial
combination lock
• Sequencing: Since the bolt contacts
some wheels before others, each
wheel’s gate can be found to open
the lock
• Decoding: A thin piece of plastic
can feel the gates in the wheels
directly
 Single-dial
combination lock

• Cheap, simple; very popular

• Can be very secure; used in most
safes
 Single-dial
combination lock
• Combination is
series of dial
rotations
• Dial pushes
wheels inside lock
• Correct
combination
aligns each wheel
with fence
Lock manipulation
• Uses the sequencing defect
• Ideally, all wheels contact the fence
• If one wheel sticks out, the fence
will drop down at that wheel’s gate;
this identifies that wheel’s
combination
• Repeat for all wheels to get
combination
 Warded lock

• Oldest type of lock (Ancient Rome)

• Easy and cheap to make
• Insecure
 Inside a warded
lock

• Key has notches of varying shapes

in varying places
• Lock has wards blocking the key’s
path
• If notches correspond to wards, key
can rotate through to push a bolt
Lever tumbler lock

• Evolved from warded lock

• Chubb detector lock is still one of
the best locks ever designed
• Complex, bulky, fragile and
expensive
Lever tumbler lock

• Key has bittings of varying heights

• Lock has levers with cuts in varying
positions
• Bolt is released when all levers are
raised to the correct position
 Further reading

• MIT Guide to Lockpicking

• Wikipedia
• OldLocks.com
• “Locks, Safes and Security” by Marc
Weber Tobias
• Crypto.com - Matt Blaze