Master Key Questions

Don O'S wrote to me on this topic and I think it is worth sharing (with his permission):

Regarding UL 437, it poses little or no solution to the "Blaze attack". There are now machines on the market at a reasonable expense to create crude but usable keys for most of the high security locks on the market and given the blanks, the method will work in all factory masterkeyed systems. Rotating constant and selective masterkeying reduce the threat considerably, but do not eliminate it. Master Ring, properly keyed, are

----------------- end of Don's comment ----------------

UL 437, or more specifically, high security cylinders that have restricted and complex keys do offer a good bit of protection against the master key attack:

The sheer number of cuts that one would have to try on Medeco Biax, or Mul-T-Lock, in combination with the tough(er) machining required would be a pretty substantial disincentive, not to mention trying to machine something like Evva 3KS. For that matter, it would be a very difficult task to amplify one's key rights in an EVVA or MIWA magnet based system. Granted a really sophisticated person would get over those problems, but by the time someone is putting that much time into milling out keys, or buying a key machine and casting blanks, you have to assume that they would have spent 5 minutes searching google before the Blaze article and found the 1987 discussion. The big criticism of Blaze's paper is that it will spread the defeat idea to the stupid and otherwise incapable of figuring it out. Perhaps this is true on a system of Master keyed Kwicksets, but the sheer amount of effort to deal with restricted and complex blanks will go a long way towards weeding out those people.

If I had to guess, disassembly is definitely a bigger threat to master keyed systems, especially the high security ones. I think everyone here knows of a high school or college where students disassembled and simply measured pins. In fact, I suspect that college students are probably responsible for the vast majority of master key "hacking", and given the choice between simply pulling one cylinder, disassembling, decoding, and replacing...which is maybe an hour tops, or making enough blanks, and trying them...the kids are going to just disassemble and measure like they've been doing forever.

The real solution to the whole business is to move to systems that add an electronic component...which simply kills all simple mechanical decoding techniques. We've already seen that here: a couple of months ago there was a college student trying to figure out how to beat his school's Medeco Site Keys, and despite the fact that he knew a decent bit about both locks and electronics, he couldn't do it. Had his school been equipped with ANY mechanical lock on the market, he could have beaten it. Heck, we've seen more or less the same thing happening with transponder keys on cars, and with the electronic safe locks.

Not to go off in a tangent defending Mr. Blaze, but one could even argue that as the shift moves more towards electronic solutions, the software community's model of publishing defects will make more and more sense in locksmithing. Certainly, it can be argued that in the meantime, people with traditional pin tumbler locks could/will suffer...but progress can be cruel, and certainly lots of people suffered in the 1800's when the warded locks' impressioning defects became common knowledge during the shift to lever locks. Not to sound horribly cynical, but I cannot imagine a situation better for the locksmithing community, from a business perspective than if the doom and gloom predictions about the master keying attack did come true, there was a horrible increase in theft, and there was universal public demand to switch over to SiteKey and its ilk.

-bob

I used to rent a shop from a guy who kept a big key cabinet, and the book with the list of what worked what. He never locked the cabinet, and never locked his building. I stopped by the one time, about 9 PM or so, and found his office unlocked, and the key cabinet unlocked. Didn't make me feel very good.

Evan,

My, My, how can you type so much and say so little? Ed can write to who ever he wishes about whatever he wishes without your approval, my approval, or anyone else's approval and the way I see it that is basically what your tirade states only in volumes....

Leon Rowell

Evan wrote:

Updates are still available for 98. Security and general.

Open discussion of vulnerabilities with regard to electronic/computer security is a very widely established and common practice.

I'm not really sure why you think this info doesn't belong in a class called SECURITY VULNERABILITIES. It seems to be the class itself you object to not inappropriate content. You can complain until you are blue in the face but I gaurantee it will fall on deaf ears when you are talking about this area of the security sector.

Why do you keep saying computer class when the class name according to what you posted is "security vulnerabilities"? In any case a computer system is only as secure as the physical and electronic security that protects it's physical surroundings. You can't completely separate the two things.

Blaze's bosses agree wholehardedly with what he is doing. When you make irresponsible statements like the one about his being fired all you do is undermine your own credibility.

The information is out there. Whether you, I, Evan, or anyone else thinks it should be is essentially irrelevant. Use the disclosure of it as a sales tool to improve your customers security and increase your income.

Still paying as little attention as usual I see. I never said to disclose the information as a sales tool I said to use the fact that it has already been disclosed as one. The disclosure has already taken place. Whether you approve of it means nothing since there is nothing you can do about it nor anything you can do to prevent furthur disclosures. Simple as that.

Many of them have already been disclosed. The armed pilots and sky marshall programs to name two. The disclosure in that case can and will act as a deterent to some and there was little downside to the information being disclosed. Obviously you wouldn't want to disclose which flights armed individuals were on but that information is easier to keep secret than locking and other security mechanisms which are readily available for study.

The two examples above clearly demonstrate that that depends on the specific information disclosed.

So what? As I previously stated whether you, I or anyone else approve of the disclosure doesn't really have any effect at all and is essentially meaningless. So why continue to debate whether he should have done it? He will likely do it again and there is nothing you can do about that either except to educate your effected customers and sell them a solution to the problem if they are willing to buy it. Or in your personal case educate your employer and those you know. I personally was not thrilled with the publication of the rights amplication paper but so what? Do you think Mr. Blaze will stop publishing because I don't like what he publishes?? Complaining endlessly and pointlessly about that over which you have no control is a WASTE OF TIME.

You seem to think that every facility out there that wishes some greater degree of security has a limitless budget to replace locks in order to maintain key control...

I am NOT complaining... I do not give a rat's ass about what he wrote about... Other than motivating some engineering students in college and some dishonest yet also intelligent people to attempt 'rights amplification' with access they have it doesn't affect me... Anyone attempting to steal from me will be dealt with in the most cruel and unusual way possible at the time of the attempted theft... Thats one of the problems -- thieves quickly learn that they can get away with stealing even if they are caught... Jail time gets cut back and parole for 'less violent offenders' just puts these people back out on the street as if the prison system was nothing more than a revolving door...

You ask so what ??? Umm... People sue McDonald's over coffee being too hot or the food having too much fat in it... Or because they feel like it... So why doesn't the industry that was weakened by Matt Blaze collectively band together and sue him over it... That's what...

Evan the Maintenance Man

No I don't. However it's irrelevant. He published what he did and I'm sure would and will do so again. You, I, nor anyone else can do anything about it. He has a constitutional right to publish whether it's in the public good or not. That's what you don't seem to understand. You can go on and on about the right or the wrong of it. In the end it makes no practical difference to the situation. Whether a given organization or individual can afford to do anything to correct the vulnerability doesn't change any of that.

Then why have you posted so much on the subject?

If I were you I would be careful about those kind of statements. They and/or quotes of them get archived essentially forever and they might come back to bite you in the @^% if something happens, even if you did nothing wrong and were acting in self defense.

True to a degree.

Because it isn't the same thing. Mcdonalds does not have a 1st amendment right to serve coffee at a given temperature. Additionally it was pretty easy to establish who served the coffee. It's alot harder to establish whether a publication enabled or induced someone to commit a crime. I'm not and never have said that what he did was in the net public good, but in the end practicaly speaking it doesn't matter since there is nothing to be done to prevent it.

Unfortunately it does take a budget to maintain security - because of hardware wearing out, because of hardware becoming obsolete, etc. It isn't necessarily "fair" to people/businesses on a limited budget, but it is reality.

As a locksmith or security consultant you can help minimize this by pointing out better choices - whether at initial installation or later. (For example - if a customer asks about installing Kwikset KIK, wouldn't that be a great time to point out that it is relatively easy to penetrate vs. xxyy. You need to know your customer's budget and the lock's environment to point out the most cost-effective improvement. I think that this is the "sales opportunity" mentioned by putyourspamhere.)

I'm sure they would have already done that if they thought they had a ghost of a chance of winning. Individual suits are often done in a fit of pique without regard to the chance of winning - but businesses and lawyers on a contingent fee look much more closely at cost vs. revenue.

Just for the record

Actually Freedom of Speech for individuals is what the First Amendment guarantees, not freedom of the press -- that has only been implied over time...

" -- Then why have you posted so much on the subject? "

Umm you have posted quite often on this as well ??? Why do you ???

" -- If I were you I would be careful about those kind of statements. They and/or quotes of them get archived essentially forever and they might come back to bite you in the @^% if something happens, even if you did nothing wrong and were acting in self defense. "

Really -- If that was true then many more pe " -- True to a degree. "

What degree is that true to ??? Do you personally think that the 'correctional system' in this country works ???

" -- Because it isn't the same thing. Mcdonalds does not have a 1st amendment right to serve coffee at a given temperature. Additionally it was pretty easy to establish who served the coffee. It's alot harder to establish whether a publication enabled or induced someone to commit a crime. I'm not and never have said that what he did was in the net public good, but in the end practicaly speaking it doesn't matter since there is nothing to be done to prevent it. "

Ahh -- No -- however McDonalds does not instruct people to place cups of hot coffee in their laps while they are seated in a car... Is that not what a cupholder is for ??? Did McDonalds hold this woman who got burned at gunpoint and compel her to buy hot coffee ??? She was more that partially to blame here... The issue is symbiotic, it could not have existed if you removed either participant...

People also do not have the RIGHTS to say certain things that could cause a public panic... Such as "Fire" in a theatre... Or "Bomb" in an airport... "Gun" in a courthouse, etc...

Matt Blaze did more harm than good by studying keyed locks... He failed to realize that they are not as flexible in security capabilities as computers are... Also many computer software packages in use eventually stop responding to failed attempts to access them automatically at some predetermined point... A mechanical key operated lock doesn't do this, nor does it record every failed attempt at access in a log for some 'network technician' to be able to review at some later time...

Evan the Maintenance Man

Umm the last time I checked Matt Blaze is an individual. Also go to court and try and argue that the 1st amendment doesn't gaurantee freedom of press and see how far you get.

All I've posted lately is in response to the silly arguments of others that there is somehow something that can be done about the dissemination of this type of information. I posted some comments at an earlier date directly to the attention of Mr. Blaze and a couple others, whom, it was quite clear disagreed and had no intention of changing there position, which is of course their right.

Many more than what? Many people HAVE been convicted of crimes based upon threatening statements may prior to the act. It happens all the time.

I am the last person to argue your right to self defense. However if you act in self defense or to protect your property you had damn well better make certain that you do it in compliance with the law or be prepared to have the weight of the legal system land on you instead of the perpetrator. Is that right and the way it should be? Once again who cares? That's the way it is.

Should they? In my opinion no. Unfortunately my opinion is worth nothing in court and in many jurisdictions they can do just that. Especially if they are in a crosswalk.

Please answer that -- as it will help me

He may well be, but that doesn't change the fact that if you act outside the laws with regard to potentially deadly force in your area you will likely be the one on trial. Anouncing your intentions to do what sounds like exactly that on an open forum is not especially intelligent IMHO.

It works as well as it's reasonable to expect it to in what is and is intended to be a highly adversarial process across the board.

You're not going to get me to argue that she should have gotten any money. She should however have the right to have her case heard in court.

Those things all cause immediate and immenient dangers. An article on security does not do that, and if it did it would be virtually impossible to prove. The proof if you demand it should be that AFAIK no such lawsuit has been won, the Paladin Press/Hitman how to case aside, and that material was of such an inflamatory nature that the jury was likely strongly predjudiced on the face of it. Even that case if I'm not mistaken was settled for less than the jury award pending appeal since survival of the award on appeal was very much in doubt.

While all those things are true, once again so what? Blaze disagrees and will continue to publish. If not him then someone else. As long as something is available for public scrutiny it's workings and vulnerabilities are not going to stay secret for long.

This information is as it turns out wrong. The case was never decided by a jury as it was settled before intitial trial.

Actually Freedom of Speech for individuals is what the First Amendment guarantees, not freedom of the press -- that has only been implied over time...

" -- Then why have you posted so much on the subject? "

Umm you have posted quite often on this as well ??? Why do you ???

" -- If I were you I would be careful about those kind of statements. They and/or quotes of them get archived essentially forever and they might come back to bite you in the @^% if something happens, even if you did nothing wrong and were acting in self defense. "

Really -- If that was true then many more pe " -- True to a degree. "

What degree is that true to ??? Do you personally think that the 'correctional system' in this country works ???

" -- Because it isn't the same thing. Mcdonalds does not have a 1st amendment right to serve coffee at a given temperature. Additionally it was pretty easy to establish who served the coffee. It's alot harder to establish whether a publication enabled or induced someone to commit a crime. I'm not and never have said that what he did was in the net public good, but in the end practicaly speaking it doesn't matter since there is nothing to be done to prevent it. "

Ahh -- No -- however McDonalds does not instruct people to place cups of hot coffee in their laps while they are seated in a car... Is that not what a cupholder is for ??? Did McDonalds hold this woman who got burned at gunpoint and compel her to buy hot coffee ??? She was more that partially to blame here... The issue is symbiotic, it could not have existed if you removed either participant...

People also do not have the RIGHTS to say certain things that could cause a public panic... Such as "Fire" in a theatre... Or "Bomb" in an airport... "Gun" in a courthouse, etc...

Matt Blaze did more harm than good by studying keyed locks... He failed to realize that they are not as flexible in security capabilities as computers are... Also many computer software packages in use eventually stop responding to failed attempts to access them automatically at some predetermined point... A mechanical key operated lock doesn't do this, nor does it record every failed attempt at access in a log for some 'network technician' to be able to review at some later time...

Evan the Maintenance Man

The lawfullness of use of lethal force to protect property varies from state to state, and is greatly dependent on the exact situation even within a state (e.g. day vs. night.)

I'd urge people to find out their local law before they get into severe legal problems.