College wide master key theory

[mike]

We've been having this theoretical discussion and I'm supposed to find the
answer to the question but I can't find what we've been discussing in a
google search.

Someone suggested you people as the experts.

If we take all the dorm 7-pin room keys for an entire floor, and put them
together, we should be able to derive the superset of the master key, for
that one floor, right?

If we then do that for all 7 floors of that one dorm, we should get a
superset master key for the entire dorm, right?

And if we do that for all the dorms, assuming there is a master key (and we
know there is by methods elsewhere from people in the safety services
squad), wouldn't we derive the master key for all the dorms that way?

That isn't the question as that makes too much sense to be a question.

The question is HOW MANY KEYS would we need as a minimum set to be
accurate?

Do we really need ALL of the keys (hundreds if not thousands)?
Or just a few?

Is there a mathematical algorithm for how many keys are needed to derive
the master key?

[Jay Hennigan]

Post by mike
We've been having this theoretical discussion and I'm supposed to find the
answer to the question but I can't find what we've been discussing in a
google search.
If we take all the dorm 7-pin room keys for an entire floor, and put them
together, we should be able to derive the superset of the master key, for
that one floor, right?

Yes. Typically you'll find that all of the keys for that floor have the
same cuts in several positions and vary only in others. The cuts that
are the same on a floor/dorm are usually grouped together either at the
tip or bow (handle) side of the key. These determine the floor. Those
that vary on a single floor determine the individual door.

Post by mike
If we then do that for all 7 floors of that one dorm, we should get a
superset master key for the entire dorm, right?

Yes.

Post by mike
And if we do that for all the dorms, assuming there is a master key (and we
know there is by methods elsewhere from people in the safety services
squad), wouldn't we derive the master key for all the dorms that way?

Yes.

Post by mike
That isn't the question as that makes too much sense to be a question.

This exercise has been performed by inquisitive college students for
decades, I speak from personal experience that far pre-dates Usenet. In
2003, a security researcher wrote a research paper on it. See here:
https://www.mattblaze.org/papers/mk.pdf This should be very useful in
your theoretical discussion.

Post by mike
The question is HOW MANY KEYS would we need as a minimum set to be
accurate?

If you're lucky, skillful with a file, and pay attention to the math,
about a dozen blanks. In many cases you can derive the system master
with ONE key to ONE lock.

Post by mike
Do we really need ALL of the keys (hundreds if not thousands)?
Or just a few?

Having a number of samples simplifies the process. In theory it can be
done with one.

Post by mike
Is there a mathematical algorithm for how many keys are needed to derive
the master key?

See the referenced article. Variations are the number of pins, the
number of depths used per pin, how extensive the system is, the
algorithm used by the locksmith who set it up, etc. Typical American
cylinder locks used in schools, etc. have six pins, but the SFIC
version (Best, etc.) uses seven. There are typically ten possible
depths per pin. However due to mechanical tolerances most systems use
either all even or all odd depths per pin position as a key that is
only one depth off can operate locks that it isn't supposed to. If this
is followed in your system, and it usually is, that means only five
possible depths per pin will be used in that system.

You'll need several key blanks that fit the locks, a fine Swiss round
or pippin (teardrop-shaped) file, a dial caliper or micrometer, and
preferably a spreadsheet program to record things. Having the
manufacturer's data sheet for the depth and spacing dimensions will
help also, and are easily found online. A key machine and "depth and
space keys" will make things a lot easier. A "Blue punch" and good
understanding of the principle will make it a trivial joke.

What you're looking for is a key that operates the lock when one of the
cuts is different from the single door key (called a "change key" in
the industry). Then find a second position that also operates it, etc.
You'll find as you progress that your key will operate some but not all
of the locks in the system until you have determined the master
position for all pin chambers. Start cutting high and work down. It's
easier to remove metal than to add it.

If your system is SFIC (Best), there's another unique key that isn't
related at all to the keys that open the lock that you should research
in your theoretical discussion. It's way cool and can cause no end to
mischief in the wrong hands. Careful destructive disassembly of a lock
is one way to reveal the secret.

[[e-mail]]

Post by Jay Hennigan

Post by mike
We've been having this theoretical discussion and I'm supposed to find the
answer to the question but I can't find what we've been discussing in a
google search.
If we take all the dorm 7-pin room keys for an entire floor, and put them
together, we should be able to derive the superset of the master key, for
that one floor, right?

Yes. Typically you'll find that all of the keys for that floor have the
same cuts in several positions and vary only in others. The cuts that
are the same on a floor/dorm are usually grouped together either at the
tip or bow (handle) side of the key. These determine the floor. Those
that vary on a single floor determine the individual door.

Post by mike
If we then do that for all 7 floors of that one dorm, we should get a
superset master key for the entire dorm, right?

Yes.

Post by mike
And if we do that for all the dorms, assuming there is a master key (and we
know there is by methods elsewhere from people in the safety services
squad), wouldn't we derive the master key for all the dorms that way?

Yes.

Post by mike
That isn't the question as that makes too much sense to be a question.

This exercise has been performed by inquisitive college students for
decades, I speak from personal experience that far pre-dates Usenet. In
https://www.mattblaze.org/papers/mk.pdf This should be very useful in
your theoretical discussion.

Post by mike
The question is HOW MANY KEYS would we need as a minimum set to be
accurate?

If you're lucky, skillful with a file, and pay attention to the math,
about a dozen blanks. In many cases you can derive the system master
with ONE key to ONE lock.

Post by mike
Do we really need ALL of the keys (hundreds if not thousands)?
Or just a few?

Having a number of samples simplifies the process. In theory it can be
done with one.

Post by mike
Is there a mathematical algorithm for how many keys are needed to derive
the master key?

See the referenced article. Variations are the number of pins, the
number of depths used per pin, how extensive the system is, the
algorithm used by the locksmith who set it up, etc. Typical American
cylinder locks used in schools, etc. have six pins, but the SFIC
version (Best, etc.) uses seven. There are typically ten possible
depths per pin. However due to mechanical tolerances most systems use
either all even or all odd depths per pin position as a key that is
only one depth off can operate locks that it isn't supposed to. If this
is followed in your system, and it usually is, that means only five
possible depths per pin will be used in that system.
You'll need several key blanks that fit the locks, a fine Swiss round
or pippin (teardrop-shaped) file, a dial caliper or micrometer, and
preferably a spreadsheet program to record things. Having the
manufacturer's data sheet for the depth and spacing dimensions will
help also, and are easily found online. A key machine and "depth and
space keys" will make things a lot easier. A "Blue punch" and good
understanding of the principle will make it a trivial joke.
What you're looking for is a key that operates the lock when one of the
cuts is different from the single door key (called a "change key" in
the industry). Then find a second position that also operates it, etc.
You'll find as you progress that your key will operate some but not all
of the locks in the system until you have determined the master
position for all pin chambers. Start cutting high and work down. It's
easier to remove metal than to add it.
If your system is SFIC (Best), there's another unique key that isn't
related at all to the keys that open the lock that you should research
in your theoretical discussion. It's way cool and can cause no end to
mischief in the wrong hands. Careful destructive disassembly of a lock
is one way to reveal the secret.

You are making several assumptions. First, that the locksmith or entity that set up the master key system did so logically and only changed one or 2 bittings on each floor. Second, that it is a Best IC Core system being referenced. Third, that there is only one master key, and not a grand master or great grand master key. Fourth, that there is a master key. Fifth, that there is only one control key in the system if it is in fact an IC Core lock system. Sixth, that at some point another locksmith or acting locksmith for the university did not randomly change any of the lock bittings at some point for some reason and thereby remove them from your logically created master key system.

I have worked at a college many times that uses a GGM, GM, and Master key system...everywhere EXCEPT the dorms. They do not want to be liable if there was a master key to a dorm room and it some how "got out". If a student gets locked out of their dorm, they call a locksmith to open the door.