 Okay, well, thanks for joining us today at the Tool Lockpicking Village. The talk I'm giving today is key duplication. It's not just for the movies. My name is Tony Varelli, aka Byte Steeler, or some people just call me Byte. You can find me mostly on Twitter if you want to talk, and that's twitter.com at Varelli. I am a member of the Open Organization of Lockpickers, or Tool, and I'm based out of Iowa, and I'm a member of the Des Moines chapter there. So I highly encourage you that after this talk today, stick around. Keep checking out the Lockpicking Village in Defcon Safe Mode. We're going to have a lot of great talks going on. A lot of really smart people when it comes to locks bypassing them and physical security. So I highly suggest you stick around for those talks as well. Today I'm going to cover two types of key duplication. The first one I'm going to cover is how you can 3D print a key. And the second one will be molding and casting a key. This gives you two different attack vectors, specifically because in option one of 3D printing a key, you never need access to that key. And with option two, we can go a little bit further with what we can do on complexity of keys. You're not limited to the key type, we'll say. So first we're going to cover 3D printing, and it's way easier than you think. There's a few things you're going to need, obviously, which is a 3D printer, the material you need, and I'm going to go for that entire list now of what you need. So first of all, I'm going to need a 3D printer. The 3D printers I work with are an Ultimaker 2 Plus, and I also have a Prusa, excuse me, a Prusa i3 MK3S. These are just the printers I own, that's why I use them. If you have your own printer, it should work well. Some lower end printers, sub 200, sub 100 printers might have problems with this. But if you're experienced with 3D printing and you know how to really dial your settings in and get it configured just properly, you might have success with even some lower end cheaper printers. A lot of questions I get about the 3D printers are what size nozzle diameter do I use? It's a 0.4 millimeter nozzle, and I normally print at 0.1 millimeter layer heights. You could get away with 0.2 millimeter layer heights. I just go for the 0.1, especially if you're doing higher security keys. And I use PLA plastic all the time. You could use something stronger if you wanted to, but PLA works perfectly for what we're doing here. The next thing you're going to need is the key you want to duplicate. Now, you absolutely do not need to have access to this key. I can't be the only person who has a friend on Facebook or other social media who is not security conscious and they're new homeowners or something along those lines. And you see this picture where they're like taking a big smile, the picture like holding their keys up. If you get the right angle on that key, you can take that photograph and use it to duplicate a key. If you are a real world pen tester and you can get a photograph of a key, for example, if you have the ability to walk up to a security desk and on the background of the wall, there's keys hanging there and you can get a photo of those. That's all you need. If you can get a photo and you can identify the type of key, you can use those to duplicate the key from a photo, which is a really cool attack vector compared to casting and molding a key because that you do require access to the key for at least a short period of time. For the examples I'm going to show today, I just did a basic quickset KW-1 keyway. And then you're going to need a measuring tool. This isn't 100% necessary, but it makes life a lot easier, which is a key gauge. If you have physical access to that key, a key gauge lets you very quickly just move the key through the key gauge to get the bidding depths, the cut depths of that key. So you can quickly just know, okay, that's a one, that's a two, that's a three, so on and so forth depending on your key type. When you're working with photos of a key though, you're going to need a pair of calipers. Calipers make your life super simple. You can get a cheap pair for like $20 or less off Amazon.com and digital calipers are... I prefer digital calipers because they just read off very quickly. And then if you're going to do photos, I highly suggest taking a look at Deviant Olaf's GitHub repository. He has a repository called Decoding. And on here, he has photographs for all these different key measurements. If you look on the screen, you can see just a couple like American, Master, Quickset, Schlage, Sargent, EL, a ton of them are up there. It's a very awesome resource for decoding keys. Here's an example of a Quickset one he has. It shows the entire key from tip to bow and on that it shows the spacing you need for the cuts. And then on the bottom right hand side, it shows the depths you need to make for each of the depth. So one depth is 8.36 millimeters, so on and so forth, all the way across. So it's very cool that you can use this for a reference. I'm not going to cover filing keys down, but this would be very good for that kind of reference if you're measuring to have that information. He also has photos on his repository that look like this. And where these come in use is when you have a photo of a key. So for this example, for this presentation, I just went out and searched Quickset Key on Google Images. And I got this key, I brought it into Photoshop. Now you can use any photo editing software you want. I happen to have Photoshop, but you can use GIMP or anything else. And what you do is you bring the picture in of the key and then you cut out the key profile for the most part and you scale it down to fit on the photo here that you get from his repository. So here's a picture that I brought in and scaled down off Google Images. Now it may not 100% line up all the time, depending on how much you fiddle with it. But the good news is that it doesn't have to be that precise to get a basic idea of your depths. So if you start at the bow of the key, someone might call the back or the handle, and we work our way to the tip of the key, we can see here that the first depth cut is about a seven. Now I don't see the line for the seven, but I can see it's shorter than the six. So it's easy for me to assume that's a seven cut. And if I move to the next cut there, we can see that that's a five cut, the one next to it's a five cut. We jump up to a four cut and then we go back down to a five cut. So we have the code for this, which is 75545. This is a horribly bit of key, except for that far back deep cut on the seven. But now that I have this information, what can I do with this? This is a great way to get a photo and get the depth cuts, but how do I take this and model a key? So a lot of people don't have the skill or ability to sit there and get the warding cut into a key and the proper size, height and all this, the right angles, that would take a lot of work in using something like Fusion 360 AutoCADS, all the works, whatever you wanna use. Well, that's where a great talk that I believe happened at DEF CON 21 occurred. In the credits, I'll link to that talk that's on YouTube, I believe, and all the people who are part of that talk, but it was something along the lines of key duplication of and defeating high security Primus locks. And the people who created that created a software called KeyGen and they launched a website called KeyGen.co. This website is absolutely amazing. In your type, you select the type of key you're working with. Your outline might be like, if it's a five pin, six pin, seven pin, whatever, master lock, padlock, a four pin, and then your warding type, depending on which key you're using might have a different warding. And then using the previous slide where you figured out the cuts, like a seven, five, five, four, five, you just simply enter that number combination into the bidding and hit generate, and this generates an STL file. For those of you not familiar with 3D printing, an STL file is the base file you use as your 3D model to generate your 3D prints. So here's a quick video demo of me using the site. I select, this is not the key I showed you previously, it's just a demo real quick, but this is a quick set. On quick set, they only have the KW1 keyway and warding, and this is a bidding I entered for a test key I have for an actual lock I own. It's two, five, three, six, three, I hit generate, it takes a couple seconds here, and then it generates this beautiful 3D render of the key. I mean, they even have the end of the key to match what it would actually look like on the key. You hit download STL, it downloads this STL file to your computer. And then I opened this up real quick in Windows 3D file viewer, they call it print 3D. And this is just a basic idea of how it imports. It's an absolute perfect replication of a quick set key. At the time I was printing this on an Ultimaker 2 Plus, and the slicer software I used for that is called Cura. If you don't know what a slicer software is, it's a software that takes into 3D printers print on layers. This slices that software, or it slices the STL file into layers so that the 3D printer can print. Now I don't print vertically like this because it makes it very unstable and weak, and it wobbles as it prints. So the first thing I do is I rotate it flat down to the bed, and in this preview, you're gonna see this big ring around the outside. That's called a brim. It just helps bed adhesion. When I actually go to print it, I don't use that brim. I do print with supports depending on the warding, but for the most point, you don't need to use even supports on that. So here's just a quick time lapse. I'll probably skip ahead, I'm not gonna watch the whole thing on this of my Ultimaker printing that exact key we just showed in model. So if you're not familiar with 3D printing, this is just a quick overview of what that looks like. The gap you see on the bottom is part of the warding. I didn't do supports on this one, because I didn't need them. And you can see towards the top there, there's a little bit of stringing between the cut. That's simple. When I'm done, I usually take an Xacto knife and just clean that up. It doesn't really affect a quick little cut with an Xacto knife. Cleans up any stringing or weird little print artifacts that you may receive on the print. So this gives you the general idea. We don't need to watch the whole print. On average, this print takes between 10 to 15 minutes, depending on your printer. But it takes about 10 to 15 minutes to knock out an entire key print. So this is the quick set lock I modeled or that I modeled the key off of. This is the key I printed. You can see I stopped it early. That's why it's cut off on top. I insert it in and it turns the key or turns the lock opens the lock. One thing to keep in mind here is that this is a deadbolt and this deadbolt is not attached to the actual bolt. So a 3D printed key will twist this open because there's no resistance from the bolt having to be slid forward and backwards. One thing I could suggest if you're worried about snapping the key off in a lock is you can either use a tension wrench at the bottom, trim a little bit off the bottom of the 3D printed key with an Xacto knife and slide a thin tension wrench in or a small screwdriver to assist the turn because when you actually throw a bolt, you're gonna have a lot more weight behind it and it's gonna be a little more difficult to turn and you don't wanna bend or snap a 3D plastic key off inside of the deadbolt lock. So that's just something to keep in mind. So I had this key, but what now? I have a 3D printed key. 3D printed keys are not durable. They will not last. So I was walking through my local hardware store, Mines Menards, and I saw the Keemey machine and I'm not gonna get into how much I hate this company and the ridiculous security options they offer and by ridiculous, I mean, they don't have them. So I had printed two keys on this machine and what this is, is if you have a key, it'll duplicate your key for you unmanned and you can see I'm entering, this is a slag. It's a totally different key I was testing at another time. It was a white filament and we assume they use optics to scan this key for depth and it misread the key. You'll see here in a second that it misread the first key thinking it was something that it's not and it failed. I had also printed this in a black or a dark, dark gray PLA as well and I'll show you that here in a second and how that works. So you can see it says here, this is a less common key. It thinks it's some weird slag, which it absolutely is not. So at this point I was confused why it wasn't working. So I canceled out of this and I decided I'm gonna try again. And at this point I went ahead and pulled the white key out and I put the darker key in and it definitely helps. So I would suggest if you're gonna take this attack vector to the point where you wanna try to get a real key made from it, that you use a darker PLA, don't use white, something that's gonna be super reflective. So here's the darker, dark gray key. I'm being very gentle shoving it in because it's got spring-loaded shutters on it and I didn't wanna snap it off inside there. And yes, you did see that correct. That is an NFC reader, RFID reader on one side and it's got a fingerprint scanner on the other side. The fingerprint scanner's purpose, as horrible as this is, is that you can save all your key profiles in the cloud. So if you don't have your key with you, you can always come back and duplicate later. I don't wanna get into the security implications of that. So you see that it's $1.99 to get a key duplicated here, standard brass. If you'd like, you can get your Mickey Mouse or Darth Vader key, but this is for testing purposes. So after attacks, it was $2.12. This is the part where I turn the camera away as I insert my credit card to pay for this transaction. Sorry, this video's a bit of a lengthy video because it took me a minute. Before they had this key me, they used to have a machine called Minute Key. And I liked the Minute Key, it worked well. It was very simple. There wasn't all this extra save your data, all this different crap. They're trying to do an upsell here. I get a secondary key here for a few bucks cheaper. I'm like, no, I'm good. I just need a test to make sure this works. And then they want your email address so they can email your receipt, AKA market to you. So of course, you know me, I enter my real email address and they wanna know if you wanna save your key for later. That's where the fingerprint comes in. Hell no. Moving on. So it starts going down this path where it starts updating you. So here's the concept. You have a 3D printed key that is not durable. However, I can take a 3D printed key, go to an unmanned key duplication system in the very back of a hardware store that is in my local town and I can duplicate this key. Now you saw it does have the ability to do higher security keys than your standard slags or quicksets or less common keys we'll call it. To do that though, they do ask for a mailing address because they cut it and then they mail it to you. So that's something to keep in mind as well. But if you have a standard Schlag, a standard quickset or other master lock, standard keys that are what this company considers common, it's going to cut this key in front of you and then dispense it out from the machine. And again, I have to definitely apologize the time of this video. The other thing is it says that it does have an Android and iOS app that it can scan your keys in home. I have not tested this, but I'm planning on it where I'm wondering if I'm able to just set my key down on a desk and the app will scan it. So I'm going to be testing that in the future because if you could do that, if you had access to a physical key be set. Okay, so the key's done cutting. You can see it does an absolutely horrid job. You can see little pieces of flashing sticking off or it cut it, but nonetheless, you now have a real physical metal duplicated brass key of something you just three printed, which is awesome. So that concludes the three printing and cutting a key. Like I said, it's very simple. The hardest part is, let me rephrase that, if you have access to the key, this is dead simple. You get the measurements with the key gauge, you type it into keygen.co, you spit out an STL file and you print it and you're done. You have a three printed key. You can take that to an unmanned key duplication because if you go to a hardware store and ask a real person to cut this key, you might get a weird look. I'm considering trying that just to see what happens if they'll even do it. But you'll have a physical key if you can go to an unmanned key duplication center. So now we're going to go into molding and casting a key and this is where you start to feel a little more like James Bond or a spy in this case because you're starting to do a little more covert, see it in the movies kind of stuff. And the cool part is you got to play with fire. So where did I get the idea to try this? So I've been wanting to try key duplication for a while now but I had always seen every video, you need a clamshell, you need something to put the clay in to mold this key in and they're always milled or CNC'd out of like an aluminum or some kind of metal and I didn't have access to that. I live in a very small city, like population 10,000 people. And I didn't know anyone and if you were to send this off to be done it would be kind of a high cost. And then D.V. Noloff put out a video on his YouTube channel which if you're not subscribing, I don't know why you absolutely should be subscribing to his videos. He put out a video and he talked about how you could absolutely 3D print this. So I went out and searched Thingiverse for a 3D printable clamshell and lo and behold I found one and I'll get into who that's by here in a second. So once I saw that, D.V. Noloff talks about every little thing you need to cast a key, he goes step by step process on how to do this. So I watched his video, took inspiration from it and tested it myself and here's the link at the bottom if you're seeing that to his original key molding and casting video. If you don't know who D.V. Noloff is, there's his beautiful mug right there. His website is dvating.net, D.V. Noloff at Twitter. Check him out on Twitter for sure. So we're gonna go over everything you need. There's a much higher bill of materials on this. So let's go through them one by one. I try to give you an idea of where you can get them off Amazon pretty cheap and or the prices you can expect to pay. So in this case, you are going to need physical access to the key you're wanting to duplicate. If you prepare ahead of time, which I'll talk about in a second, you don't need much time. You maybe need like anywhere between 15 to 30 seconds hands-on with that key. Depending on what you're allowed to do on a job or your story for your job, you could get access to this key for like requesting access to a server room or wherever you're trying to access specifically. Had you need that key, you may have just enough time to get the mold of that key. And again, I did this all with a quick set KW1 key. Then you're gonna need a low melting point metal. So I do this demonstration at a lot of cons and some of these cons have kids. One metal that Deviant talks about and if you talk to other people, they suggest is called Woods metal. The problem with Woods metal is that it has lead in it and other toxic chemicals that when burned, the fumes rise up and you're breathing these in. Woods metal is relatively cheap. You can get a lot of it for a very low cost. However, because I was gonna have kids a touching the metal after they're done, melting it themselves, all this different stuff. I didn't feel comfortable using a Woods metal because of the toxins. And talking to some people in the tool slack, they suggested Fields metal. Fields metal is much more expensive by weight. I was able to get a small little brick of it, probably about two and a half to three inches by three inches by quarter of an inch thick for about 35 bucks off eBay. That's the exact link to the one I buy. This is a reputable buyer. He's got 100% positive feedback as of this presentation and he's always sent me the products I've needed. I did a con in Oman, Nebraska and at that con I ordered five different bricks and he got them to me and he was willing to work with me on price which I thought was awesome. So this is where I get my metal. It's Fields metal, it's very low point metal like the picture shows. It melts at about 144 degrees Fahrenheit and it doesn't have the toxins in it. And then you're gonna need something to melt that brick you get down so you can make ingots. Debian has some really cool big melting pot that he bought. I looked it up on Amazon, I think it was like 35 or 40 bucks, he might've gotten it cheaper somewhere else but I was walking through Walmart one day in the camping section and I saw this cast iron skillet and it was like five bucks. So I was willing to drop five bucks on a cast iron skillet which I bought. Obviously I only use it for this purpose moving forward. And then Debian had these perfectly square, small ingots of his metal and it just so happened that this ingot was exactly the right amount of metal to mold and cast one single key. So I reached out to him on, I can't remember if it was Twitter or Slack and talked to him and he's like, oh dude, it's awesome, they're these ice cube trays. So these are these silicone rubber ice cube trays that are meant to make tiny ice cubes so you can drop them in like in the mouth of a bottle of water or soda and they're super tiny. You can get them off Amazon and you get two trays which make a ton of ice cubes or ingots in this case and they're 10 bucks for both of them. Again, these prices might be different now especially with COVID going on. They could have completely changed because all prices and availability on Amazon are off the charts compared to what they used to be. But I got two of them for 10 bucks so you can either use them both or use one for key casting and one for your ice cubes. Then you're gonna need the clay and the clay is what you actually mold the shape and the indent of the key into. And Sculpey is something that Debian recommended. One tip, when you search Sculpey clay on Amazon select all the colors available. The reason I say this is that the price varies based on the color you select. I don't know, I don't get it. I've gotten yellow and green so far because they're usually between two to three dollars but if you select like black or white or orange it might be seven to $10 for the same size the two ounce size I buy here. This two ounce size you can see from the picture there's indents along each of the thing and pretty much it's got four logs of clay. One log of clay is exactly what you need to cast a key. So you get a minimum of four castings. I found that you can reuse this clay over and over again. It does dry out over time. It is heat set, it's oven baked clay. So heat sets it and makes it hardened. So you're not gonna get 100% reusability over and over again and your results might vary but I've gotten four or five keys out of a single piece of clay but again it all depends on how hot you heat your metal to before you pour it in. And then you're gonna need some kind of talcum powder. I bought mine at Walmart. I bought the little baby powder. It's a little size about this big. It's a travel size baby powder and it's perfect and this just stops the clay from sticking to itself. So when you cast the two key or take the two pieces of the clamshell and stick them together when you pull them apart they separate without the clay sticking together and ruining your whole mold. Then you're gonna need the clamshell. I 3-printed mine from Thingiverse ZBZZN Boris is the person who created this. There's a bitly link I created to link straight to the Thingiverse link for that. It works absolutely perfect. It's three pieces. You're gonna have a left and a right to your clamshell and then a base and this base is awesome. In Debian's video he had an aluminum one I believe and then he used like a C-clamp to clamp it to hold it together and kind of stabilize it on the table. This base you print for it works absolutely perfect. I love this clamshell. I've used it over 100 times and there's no deformation. It absolutely does not deform. It holds up to the heat. You have to realize that when you print PLA you print at a minimum usually of 190 degrees Celsius to 220 degrees Celsius and we're only hitting around 140 to 160 degrees Fahrenheit. Now unfortunately I use American units. I wish we'd switched to metric and Celsius but I don't understand it off the top of my head. So you could do the conversion but the point is you never get close to that melting temperature or the glass temperature of the filament. So you're gonna be absolutely fine. Then you're gonna need a melting ladle. This thing was like 10 bucks off Amazon. It's for melting lead, casting ammunition things along those lines. It was 10 bucks on Amazon. It fits a perfect ingot inside of it and you can hold a lighter underneath it to melt that down. Then you're gonna need a lighter. Debian suggested a torch lighter. I do as well. I think it puts out a little more heat than just a standard lighter. But I've tested with Fields Metal. You can use like a T candle or a standard BIC lighter or a Zippo lighter. It will get hot enough over time. It's just not as fast. If you're like me and you like a cigar renowned again I already own a cigar lighter. I bought this one off Amazon for 15 bucks like years ago for the purpose of actually having cigars. It just so happened to work perfectly for this situation as well. So this is a video of me trying not to upset my wife. This is the $5 cast iron skillet I bought from Walmart with the brick of metal of Fields Metal I bought off of eBay. I'm slowly just melting it down inside this pan. I make a very noob mistake here. Do not make my mistake. I took a like a kebab skewer and I was making sure it was fully melted and kind of stirring it around to make sure there was no more chunks of metal that it was 100% completely melted on my stove. And then to make sure I like an idiot swirl it around in the pan like you would with butter if you're about to fry a steak. And what I do is I just coat my entire pan with Fields Metal. So I lost a bit of metal because of that. But like I said, I'm not using this pan for anything but melting Fields Metal in the future. So it works perfectly. I put the wax paper underneath the ice cube tray in case I spilled. That's the only person that I have that there. If I didn't overspill, you land on the wax paper and not my stove and my wife would still love me. So I quickly just pour this in here and you can see that I got a whole bunch of full cube pours and then a whole bunch of random ones. And then you can see the cubes it makes. I think I got about 16 cubes out of that one piece of metal. So that's enough for 16 keys. One note when I pour into this ice cube tray, it doesn't fully fill all the cubes. So what I did is I popped them all out and I think that was a full cube I set aside. Anything that was a partial cube I took into my melting ladle. I melted it down all the little fragments, little pieces and I slowly pour them in cube by cube until I got a full ingot for each one. So that's just a little pointer there. So now we're gonna switch to demo time AKA time to play with fire. Don't try this at home or if you do, just don't blame me if you get hurt. I highly suggest you try this at home. Full disclosure, I've had this demo prerecorded for a time because it's one of those things that with COVID going on I've done a lot of virtual conferences and with a virtual conference it's just difficult to plan ahead. So I prerecorded the actual demonstration of this video. So you're gonna see here the background's gonna change. My hat won't, you won't see my face. It's gonna be all on table kind of thing but you're gonna see the whole demonstration. So we're gonna do that demonstration and then I'll come back right after that. Enjoy. Okay, so I'm gonna get started with my demo here. I'm gonna go over what I have here on the table. So some of the things you're gonna need. The first thing is a clamshell. This is what we're gonna use to actually mold the key. This is actually 3D printed. It's fully available for free download www.thingiverse.com and I'll try to make sure the links are available. They're definitely available in the slides which I'll also make available to everybody. So we have the main clamshell in the base. The base is pretty much so you don't have to hold this as you're pouring molten metal into it. It just lets you freehand it. Speaking of pouring molten metal the next thing we have here is a ladle. And this is a lead ladle. You could use this for pouring lead but it works perfectly for what we're doing. So we'll be pouring the metal in to the clamshell like that. The next thing we're gonna need is some sculpting clay. This is sculpty. It's like a few bucks on Amazon for this package. This package is pre-split into four different bars and you just need one bar is exactly perfect. To fill this mold you rip that one bar in half and you fill each half of the mold. It works perfect. You're gonna need some baby powder, some talcum powder. I buy this nice little jar or nice little bottle from Walmart and it's like a buck something just because it's small and convenient. And I travel with all of this stuff and it's like pencil bag I found one time at Walmart during school shopping time. It's like a dollar or two dollars for this zipper bag and it holds everything I need. You're gonna need a lighter. I suggest a torturous cigar lighter. This is a cigar lighter. You can't really see the flame on camera. I'm guessing, but that's what that is. And then I also have the metal. So there's different kinds of metals you can use for this. A very common popular one is called Woods metal. The problem with Woods metal is that it contains lead. So it's toxic. The fumes it puts off are toxic. So I would highly suggest against it if you're gonna be doing this around kids or in the public for your own use. That's up to you. You decide if that's okay with you. This is Fields metal. Fields metal is non-toxic. I get mine off Amazon and it's like $35 for a brick. And one brick makes pretty much enough to fill this little sleeve here. So about 16 little cubes, which you saw in the previous video that I made, melting it into a pan and then pouring it in this mini ice cube tray. So let's get into molding an actual key. So I have this lock. It's a quick set lock. And here's the key for that lock. Works perfect. So this is the key we're gonna mold. So to get started, I'm gonna move some stuff out of the way here. First thing I'm gonna do is get my clamshell opened up and laid flat in front of me. And I'm gonna open my clay. Now I try to open this nicely so that I can kind of wrap it back in the clay later. That's only because I'm doing it for demo purposes. This doesn't really matter. I've actually 3D printed a holder for this clay just because I like to be organized with my stuff, especially in 3D printing. So if you look at this again, you can see that there's, it's hard, maybe hard to see, but you can see that there's these lines that pre-cuts it into these bars. And this one bar is exactly the right shape. So if I take this bar and break it in half or relatively in half, like so, this is exactly perfect for each side. So just take one and mash it up just like Play-Doh, soften it up just a little bit. And then what you're gonna do, and it's up to you. Some people like to take talcum powder and put the sense that the clay comes out easier for demo, I don't really care. If you needed to do multiple back-to-back, maybe that would make sense. Otherwise, it doesn't matter. Anyways, I get it into about a shape like that and then I just push it down into the clamshell and try to get as flat as possible. So I'm pushing it down in, backfilling this big gap at the top, the big void at the top. And you want it to be as level with the top of this as possible. You don't want a big bulge of clay sticking up because it won't give you a good mold. It'll wrap around the key, which you do not want. So get this as flat as you can. Again, it doesn't have to be absolutely perfect. When you squish these two together, you're probably gonna get some leak out. That's fine. Just get it as best as you can. So you can see I have it. It's pretty level. It's hard to see on camera, but it's pretty level. Now this part, you're gonna wanna depress this down in like so to create a well because you need someplace to pour the molten up metal into. So I'm creating like this lip that I can bend backwards. And it's just this well because the top of the key doesn't need to be molded. That's not important. So pretty much you do this again and just repeat it on the other side. So I'm gonna take the clay and again, soften it up by squishing it. And you wanna make sure that you go above the border here, you want that lump and then you wanna press it down to flatten it out. Otherwise, if you try to like skim it in, you might get an air pocket below and when you squish the key and all the clay moves down and you won't get a good impression. So I've pushed it all down in and I still have a bulge. So now I'm gonna work on getting that bulge down so it's not above the plane of the top of the clamshell. And again, I'm gonna fill this void in and on top. People have asked me if the color of clay matters. It doesn't. Literally if you go on Amazon one day, one color's cheaper than the other color. So sometimes you'll see this in yellow. Sometimes you'll see it in green, black, red, blue. It doesn't matter. It is literally just whatever's the cheapest I buy because why pay $8 or $5 for red when green is $1.99? So, okay. So I have that pretty well in there. I'm gonna check to make sure I don't have it too low. And I think I'm good. Now I'm just gonna, again, create that well on the top of my thumb, squishing it back. So I create a lip and when I put these two together, it'll create a pore spout, kind of like this that the metal can go down in. So now the next important part is to cover these two pieces or these two sides in talcum powder so that when you push the two clays together and you separate them that they separate and they don't just stick into one big glob of clay. So you just take a little talcum powder and sprinkle it on the sides here. And then just take your finger and rub that talcum powder across the top of all the clay. Just like that. Check this, this seems a little bulgy. Now that I've pressed it down, I'm gonna put a little more powder on. Okay. So we have these both sides coated. They're good to go. So I'm done with the talcum powder. I'm done with the clay. So the next thing we're gonna need here is we're gonna need the key. Now it's important that when you press this down that you think about this key as having two halves. Have one and have two over here. You don't wanna shove the whole key down 100% into one side. You wanna push it down about halfway on one side so that when you put the other clamshell on top, half the keys on one clamshell and half the keys on the other side of the clamshell. So to start with, I'm just gonna place this in here so that the bow of the key, which is right here is make sure that that's in thick clay, not in the well. So I wanna down far enough that we're good there. Okay. And then I'm gonna press down and rock it back and forth just trying to get it down about halfway in and just lean in and check on it. Make sure you're about halfway in all the way around. So now you can see the key stuck in halfway there. Now the next thing to do is take this clamshell, place it on top and then squeeze these two pieces together. Now it's suggested that you stand on this, which I'm not gonna do because you're not gonna see it anyways. So I'm just gonna place my hands on the table and press. You wanna get a nice firm pressure on this and just stand on it and put some weight on it a second, give it a second for the clay to move out of the way for the key to come in. Because remember, you have the warding and all the parts of the key that you need to get up in. Okay. That should be good. Now you wanna carefully open this, separate them apart. Don't rock it back and forth because you're gonna mess up the clay. Just try to get it apart as clean as possible. Like so. And we have a pretty decent impression over here. It looks like the key sunk in a lot on this side. So I'm hoping this all turns out well. But you saw how the clay came apart without sticking. That's because we used the talcum powder. So I'm gonna bend this lip back and I'm gonna use the true method of flicking the key out. The reason we do this is we wanna get it out as fast as possible because if you lift it up, it can cause the tip of the key to dig into it. So we wanna get it out as fast as possible. So there, it's out. It shot across the room, but that's fine. So where do we go from here? So the next step to do is we're gonna go ahead and take these two pieces of clay I'm showing, we're gonna put them back together. And now we have a void. Now I'm gonna open up these lips on the top to make sure that I can see down into where we're about to pour, which I can see fine. So I'm gonna place that into this holder and this does two things. One, it keeps these two pieces tight together. And two, it makes it so I don't have to hold this in my hands as I pour molten metal over it. And if I bump it or miss, I'm not gonna end up with melted metal all over my hands. So the next step I'm gonna do is I'm gonna take out one cube of my fields metal. And again, this metal is meant to melt at very low melting points. So a candle or a lighter works fine. And one cube is almost absolutely perfect for your average key. So like a standard Schlaghe key or Kwikseh key. So I'm gonna drop this in the end of the ladle, like so. And I'm gonna try to do my best here to let you see this melt and how fast it goes, but it's gonna be kind of hard to do. So we'll do our best here. So I can already see it moving. So it's already starting to melt. And as soon as the metal below it starts melting and you get a little bit of liquid metal, that metal heats up the rest of the cube and it melts really quickly. So there it goes. So now I gotta kind of look at it here to verify. So adjust it completely liquid. I'm gonna go a little bit longer to make sure it doesn't start solidifying on me quite yet. There we go, we're good to go. And now we just pour this metal down in. And I'm kind of doing this because I want it to get down in and I want any air bubbles to get out. But that should be good. And now we just let it sit. Now, depending on how long you heat this for, bring this in, this is silicone. So I can put something hot on it and it won't melt. Depending on how long you heat the metal for it's gonna take longer to cool. Now this takes quite a bit longer to cool because it's such a little melting point. If you use woods metal, the toxic stuff, it doesn't take as long to do. If you watch any deviance videos, you'll see that he uses, his clamshell is actually, I think it's milled out of aluminum, which if you think about what aluminum is, it's a heat sink. So that would help awesome to cool the key faster where this is plastic. This isn't gonna act as a heat sink. So if you can get a metal clamshell, great. Again, it's not needed. This is super simple to make. It's probably like a few dollars worth of plastic in this. So it works really well. You don't have to have metal if you've ever seen it. When I first started, that's what I, again, that's what I thought. I thought, oh, I didn't have a metal clamshell. How am I supposed to try this? And when I saw the 3D printed one, it was fantastic. So I'm watching the top. I'm kind of shaking it. And I can see that the center is starting to solidify, but the sides are still jiggly. And I wish I could tip this to show you, but if I do that metal might run out. So it doesn't have to be cooled down to take it out, but it does need to be solidified. So we're gonna finish letting this go here. I'm just tapping it. And pretty much what I'm looking for is if the metal's still kind of jello-y on top or you can see liquid still. And as soon as I don't see that anymore, then I'm pretty sure we're good to go. So there's just a few little spots that are still like that in here. We're very close now. Some very, very small spots still jiggling, which means they're cooling off. And if you open this too early and it's not solidified down, you're gonna have molten metal just running out. So better to be safe than sorry. Okay, it looks pretty solidified. I'm gonna give a couple, like one more minute here just to cool off a little bit to guarantee it's good all the way down. And when we pull this out, you may or may not see some gaps, some air gaps. That's fine. The key can still work. The important part, obviously, is the bidding of the key and the warding. But if there's holes in the warding, we're fine. If there's holes in the bidding, then we have problems because there might make a dip where it won't lift the pins to the proper height. Okay, I think we're good. So I'm gonna go ahead and take the base off this. Okay, and then we're gonna split this open. And it looks like we have a good casting. So let's see, well, gotta keep it in light so you can see it here. So there's the key. And you can see, we don't have the entire top of the head. We have just enough, though, that we can grab onto it and turn it. And we can see all the key in here. We can see the warding. So let's go ahead and peel this out. So we got a little clay on the tip. That's not a big deal. Just pull it off. So you can see there's a lot of flashing around here and stuff like that. None of this matters. And if that bothers you, it's so thin and soft. Just bend it back, okay? Now we have a little bit of flashing it looks like around this bidding area. But again, I'm not overly concerned with that because of the way the cut is. I can just kind of bend that flashing out of the way. So I think we're completely good to go here. So now it's the moment of truth because, you know, demos fail. What's new? So let's place it into the lock. It goes into the lock. That's good news. Now we'll open the lock. There it goes. So there was that little bit of flashing. So when I first started turning it, it caught but as soon as I turned that flashing bent out of the way and we're good to go. So now we have a fully working duplicate of that key. So like when we talked about with 3D printing of this key, this key is very bendable. It's very soft. But I can take a pair of calipers or again, I can take the key depth measurement guide here, let's see, quick set. Where'd you go? There. And I can take this now. I can get the measurements from this on my own time because I have a duplicate of this key now. Take my own time to get my measurements. I could 3D print this key and take this to a key me or a key duplication, unmanned key duplication machine and have a permanent copy of this key forever. If you only need to get it once or twice, this will work. Again, this will last for a while. So I'm making a mess, but like that, it'll work perfectly. However, I wanna show that this key is soft. So I'm gonna bend it here just to show you. That doesn't take a lot of power to bend that. You can see that's completely bent key now. But if I lay it on a table and I flatten it back out, we should be good to go. Let me just test it. Yep, we still get it open. So that is duplicating key with casting a key and melting metal in casting it in clay. So let me flip back to my other screen here and we'll continue on. Okay, so time to give some credit here. So first of all, we have the keygen.co. There's the GitHub repository for that. And below that is the talk I specifically mentioned earlier where keygen.co came from. It was from DEF CON 21, key to coding and duplication attacks for the Schlage Promise High Security Lock. There's a link to the YouTube video of that talk. And that was done by David Lawrence, Eric Van Albert, and Robert Johnson. Big shout out to them. I believe the tool is also available as just a Python script. You can download and run locally so you don't need to rely on their website. The website's just super quick and easy. Obviously, I have to give a massive shout out to Deven Olaf. I didn't think I could do key duplication before I saw his video. After watching that video, he gave an in-depth, very, very detailed way of how to do key duplication. And the fact that he mentioned you could use three printed clamshells is what even sent me down this path. So check out his website and check out his Twitter. And then the link below that is the original key molding and casting video. And again, a big shout out to Boris for the 3D printed clamshell that he makes freely available to the world and thing averse. If you go back in the slides, you will definitely see the link to that. So I wanna thank you guys for letting me talk to you today about key duplication. If you have a 3D printer, please give this a try. It's super simple. Just enter a random bidding code, if you will, just to test it out and print a 3D key just so you can see how easy it is. If you have your own key, go ahead and duplicate your own key just to test it out and see how well it works. It's super simple using the keygen.co. If you have any questions, any comments or anything else you wanna talk about, again, hit me up at Twitter, at Varelli, it's the easiest way to find me. And then questions, if you have questions, obviously I'll be sticking around. You can find me in the Discord channel. I'll be available to answer any questions you might have, details about printing, molding and casting and things like that. So again, I wanna thank you for taking the time to watch this presentation. I hope you have a great DEF CON safe mode and stick around at the Lockpicking Village with Tool for all the other amazing talks that are coming up. Thanks a lot.