Replication Prohibited: Attacking Restricted Keyways with 3D-Printing

Several attacks against physical pin-tumbler locks require access to one or more key blanks to perform. These attacks include bumping, impressioning, rights-amplification, and teleduplication. To mitigate these attacks, many lock systems rely on restricted keyways and use blanks that are not sold to the general public, making it harder for attackers to obtain them. Often the key blank designs themselves are patented, further discouraging distribution or manufacture by even skilled machinists.

In this paper we investigate the impact that emerging rapid prototyping—or 3D printing—tools have on the security of these restricted keyway systems. We find that commodity 3D printers are able to produce key blanks and pre-cut keys with enough resolution to work in several commonly used pin-tumbler locks and that their material is strong enough to withstand the requirements to perform the aforementioned attacks. In addition, in order to demonstrate the low skill requirements necessary to perform these attacks, we develop a tool that automatically generates a 3D printable CAD model of a key blank using only a single picture of a lock’s keyway. This tool allows us to rapidly manufacture key blanks for restricted keyways that were previously difficult to make or buy. Finally, we discuss possible mitigations for these attacks that lock manufacturers, installers, and users can perform to protect their assets.