 Frage vorweg, bevor wir starten. Wer von euch war denn letztes Jahr auf dem CCC-Camp und hatte einen von diesen coolen Raketenfirming-Radio-Badges? Es war nicht Raketenfirms. Es war nicht Raketenfirms. Nicht Raketenfirms. Nein, das Radio-Badges war recht eckig. Rechteckig. Okay, schlecht recherchiert. Gut, sind doch ein paar mit dabei. Wir haben einen der Hauptverantwortlichen für diese Radio-Badges heute hier und hat sogar auch noch Unterstützung mitgebracht. Kleiner Plaus, sagt er. Welcome to the translation for this upcoming talk about home-made high-security master keys by Michael Weiner and RF-Guy. Your translators tonight are Flo, Hexor and Waffle and we'd be very grateful for your feedback on Twitter using the hashtag C3T or tweeting it at C3Lingo. We also have an e-mail address which is hello at C3Lingo.org and we'll be learning about how you can produce master keys for locks using mathematical processes and how we can use CNC-Systems to create these keys. Please give a warm welcome to RF-Guy and Michael Weiner. Welcome from me. We're going to be talking about home-made high-security master keys. We're going to show you conventional locking systems and many people have talked about those before and we will show you two ways of building a master keys system logically. Therefore we're going to have the KISO-System, which is a very common system. Ray has also talked about this before. We're going to have that for your comparison and then there's the 3KS-Systems, the three-curve system, which is used in many buildings. It's actually quite a sensible system and we're going to show you how you can analyze one of these systems and use mathematical and logical procedures to create the master keys for these systems. This is our agenda. We're going to give you a short introduction. Then we're going to show you the KISO-2000-System. There are several derivations of these, like Omega and many of these, all based on the same principle. Then we're going to switch und Michael is going to speak about the FR-3KS and we're going to show you our workflow, so how you can use a normal CNC, a very common device that you can buy for 1.500 Euros. How you can use one of them to create a master key so that it actually fits a given lock. There have been many things in the past. People started, yeah, I can use a tele lens to take a photo of a key. It's pretty straightforward. I mean, those, you know, have a key lying about. This is just a common key. And if I take a higher resolution photo of that, it's very simple. That can give me the locking code. The media talked quite a bit about the TSA keys, those, you know, that are used in suitcases. The first mention of them was in 2004, when Tobias wrote this short paper. I had them with me on the 28th Chaos Communication Congress and built master keys for some of those locks. And a TSA person had themselves photographed with a set of their master keys earlier this year. And there are also the American Fireman keys, where the New York Times published an article about those keys alongside pictures of them, which was really nice because that allowed people to recreate them themselves. We're going to tell you how to... No, people have created rows from photos and then 3D printed them. So you take a photo of the locking cylinder. So the part where you insert the key. And this allows you to build a 3D model and then you can 3D print the matching key. That works pretty well. Another bit of research was the FA MCS, which has been analysed by the Munich CCC a couple of years ago. And the advantage of a system, because it's magnetic, is that a photo doesn't allow you to derive the locking key. There are of course also some commercial variants, for instance the easy entry profile device. Where they actually have quite a few security features because the services that get them need a locking, need a certain key for this. And it's not altogether cheap. But they can make a tiny profit on these depending on the service that comes to open your door when you've locked yourself out. There's YouTube videos of how these things work. You use a certain blank for it. And then the blank is turned into a key, based on a model. There are also milling machines for these. There's one made in China. And you simply enter the locking code and then that's milled into a given blank. You can spend up to 20.000 Euros for these. Then not altogether cheap, these devices. Another large database is Instacode, which is a software that you can rent from 7 Euros per month. There's even an iPhone, an Android app for it. And you simply enter the maker of the key of the lock probably. And then it lists the profiles and lists all the commercially available blanks. There are several vendors who produce blanks independently of people with various keys. And there's also a database of the keys, of the key codes. You might have noticed that many keys have a certain code on them. And you enter that number into the app and then that gives you the key code for the key itself. So this is a nice database that you can rent pretty cheaply. You might even find the decentral security copy if you go looking for it. So this is a really powerful tool and a commercial milling device can use this tool. So you just attach it via USB, you enter the code and it gives you very detailed instructions. You insert the key into the machine and then from that code it mills the proper key. That's all available, but unfortunately it's pretty expensive. Many of you will have had this problem but you didn't get as many keys from your landlord as you needed and it's really annoying. You want more keys. So we wondered what can we do to solve this problem. And today we're going to solve it with this 3KS. The first of these systems is the KISO 2000. There have been extensions to this, for instance this one, there's a spring-loaded element in some keys. You can't see it in this picture and it has to move. For instance there's a little ball inserted into your key and some there's a magnet. That serves two purposes. The first of them is that it's easy to patent. So it's legal copy protection. So if I build something into my key and I have a patent on it, nobody else is allowed to copy them. Some of these patents, sometimes patents expire and then of course blanks can be produced. So what you do is you create a new system that has two spring-loaded elements and you get a new patent and that prolongs the copy protection by 20 years. What you do is that you integrate a trademark into your key. For instance BKS or CES, which are the makers' names, you somehow integrate them into your key and then you can build that into your key. You can copy-protect that. Of course it's silly, it just means that nobody is allowed to produce blanks. Nobody is allowed to produce blanks for these keys. So, we have with this system, it consists of a core, which you see at the top here. This is this little bar and on top of that is a pinstack. This system comes from Switzerland, where these locks have a slightly larger diameter. In Germany we have Europe profile cylinders and they have this very characteristic shape. This system has proliferated pretty widely and therefore we don't have a lot of space. This bar here on top is where all the pins need to fit into. And you can see that there's a smaller, the size of the pins varies fairly widely. And the spring is on top of the pin and it has to fit into that bar. There's a reason why you use these bars. This system has two rows of five pins, they're on the edge of the key. There are drill holes on the side of the key as well. So as a permutation I have 15 pins, which isn't that much for a locking system. Because if I have a locking system I need to have several codes because I'm going to have several keys and several keys have to fit into the same lock. For instance, if you have an apartment building you can have 15 keys that need to fit into the same lock and I need to somehow build that into my lock. What you do with this system is here you see the element on the side and you see where the pins fit in. So a locking cylinder will check five of these dimple pins of these drilled recesses. And it's asymmetric. So there are several variations of this element. So I don't have 15 possible positions. I have 45 because I have three different key pin possibilities per Pin. I can't just use the positions for these. I have to use the positions for these, sorry. Another thing that they try to do is there are different kinds of drillings. Here we have a usual kind of pin. In Kieser, the key is just a simply rectangular and I have a standard key with a standard dimple and there's my layer of separation between the green and the blue part. And at that point we get back to the legal copy protection. We have different depths of drilling dimples we can put in there that we cannot create with a standard 45-degree angle. On one side we have a pin that touches and that didn't work but the manufacturers pretty soon just started building drills that work in different layers to make sure they can catch up and the manufacturers of the keys again tried to evade that and now it seems to be pretty much impossible to not drill that correctly with a drill. One other permutation they have introduced is having a straight pin that doesn't fall into the key and depending on the depth of the drill hole in the key I cannot turn the key anymore. Another case is we have again that stacked, that layered drilling holes where the pin again falls too deep. Here is another case of a layered drilling the pin in this case doesn't fall deeply enough in the pin and for this special shape of the pin I need a matching shape of the drill hole in the key so the pin correctly fits within the key. In many cases we also for houses where different keys have to fit in a house door for example not all of the drill holes are actually used. There may be a blind pin and independent of which key is inserted into the lock that pin doesn't affect the lock operation in order to have the same core of the lock and have different keys able to access it. At this point we usually have a locking system in an apartment building but in big buildings we might have one general locking key with a master locking key which can open everything or there could be different groups for example in a school teachers might have one set of keys and there could be other rooms where only pupils are allowed and other rooms where facility managers could get in but teachers could not so we have the difficulty of finding out how can we get to that general master key pattern or code and to do that we have to develop a method of determining how to find the locking code and the possibilities we can take into account to get there. In principle we have two information bits we have keys let's assume we have different keys I have one key for my office that only fits that door and because I would like to run some espionage or a new colleague we're just talking about possibilities here and how could we then continue the first problem is we need to take into account the method how the locking system is built because I cannot build different permutations into the locking mechanism in that system I only ever have the information of one key within the lock the superior key one of that gets closer to the master key has more drill holes one remark is with the case-solve-cylinder-system there's only ever one valid position for the pins in the cylinder between the pin of the case and the pin of the lock there's only one layer of separation as an example here we have one key and the information I can gather from this one key is exactly this one key and nothing more now I take a picture of the key of my colleague in this case I see different drill holes and I have now already moved that information to the key on the right now I get more information from the key of my colleague and this key will at least open and close two doors mechanically speaking my key space is limited so I have to check which of the dimples I can add and might not add all of them adding a third key I can add again the different holes in the key and that is by far those three keys are by far not all of the key space still I have achieved my target because I have a key that is superior to all of the keys I have before and what I don't know is how much more there could be what I see on the key on the right at this point there is no drill hole so there could be something there and there is a pin there that would like to have one given position on the edge again we also have drill holes but because the edge is so thin there can only be drill holes at different positions not different depths or different kinds of drill holes now to Michi who will tell you a bit about 3KS about the three curve system and as you can see on the picture of the key you can see three curves one double curve of the upper, the lower curve and one final curve a third one that is a bit lower on the right we have a closing cylinder that consists of a couple of movable pins and the side bars and there are three coding elements that hold in lengthwise grooves in the edge as well as the curves in the lock the key is quite rectangular and I don't have that many variations in the profile and on the side by adding different grooves I can change the profile but that is purely passive so if we just remove the edge to some point it just fits anywhere and then the side profile this side bar on the right side when I turn if I insert the key into the lock it tries to be pushed down to the right position and only if the grooves are in the right position that is done correctly but that works completely passively so if I removed the whole edge it would work perfectly but the interesting bit are the curves they move those sliders on the right side these six sliders to left and right and only if the sliders have the correct position then the side band can be depressed on the lower part you see the key in this example it only has one curve and that curve moves the slider if I insert the key into the lock the force is applied onto the sidebar that is pressed inside and only if there is space in the slider for the sidebar then I can turn the key and open the door you see a small cavity on the right it's a fake cavity so if someone tries to pick the lock if they turn it a little bit the sidebar would get jammed in there and the lock picker could not pick the lock now, if we look closer at the curves because we want to drill these curves there is six sensing positions 3.5mm with a distance of 0.5mm from one to the next valid position is 0.5mm and the width is 1.2mm of the curve now, each side contains six positions per curve within the lock only every second position is being sensed it's a single, double, single, double curve and on the other side it's exactly the opposite so we could construct a key and we have done so that works on two different locks now, let's look at that double curve there are seven valid positions a curve is 0.5mm deep and this is a global configuration this only changes if you have really big locking systems on higher hierarchies for example, if you have a company that has an R&D and a sales department and these two departments they could have different double curves for example a key service will receive for their area an exclusive own profile and they receive key blanks and have the exclusive license for that area that used to be their profile for that key service and they get a passive matching sidebar so that way they can only determine the single curve so, yeah Boxsmiths usually receive the fixed double curve and only have to change the single curve we have tried to propose a notation there we call that curve D and they have positions 1 to 7 1 is to the very left and 7 is to the very right 3KS plus has two successors now 3KS plus, that's about 10 years old that was just published on security conferences now and there's only a marginal difference and the reason for that for the successors is that the old patent for 3KS has expired and 3KS plus is valid for another 10 years and that way they try to keep up those legal copy protection and creating keys ourselves is marginal on 3KS plus the position is 6 is a bit wider so a standard 3KS key would not fit in there similarly a 3KS plus key would not fit into a 3KS lock another difference in 4KS the double curve does not continue to the last position to the top and starts only at the other the single curve there's only 9 possible positions and this is the local configuration it's 1mm deep 4KS differs in that double curve is not thicker so the slider is simply thicker the pin is thicker and if I want to insert an old key I can't because the groove on the side insert the key all the way into the lock it only goes in up to position 5 that's all there is and here we've taken apart some sliders and scanned them and because of the scan the mirrored but it's also easier to read them that way this is a slider that only fits in position 1 here's a slider that fits so one would be here, two would be in the middle and three on the right this is one that would fit into two positions two and six and if you don't want to open an area but just two positions they have to be spaced apart so in larger Ks that would fit into two, six, seven and eight and with the double curves we have we struggle to find sliders that fit into more than one position but we found one that fits into four, five and six at the bottom this is because our space is limited we only have seven positions instead of nine it's in the single curve so in three Ks plus where these grooves are slightly different that affords you a patent, hooray this part here is supposed to be the same width but it's shifted slightly to the right or to the left and that grants you a patent and the question is if we have several keys and several cylinders how can you decode this system take several locks and several keys and derive one key from this that fits into all the locks that we can already access and possibly even more if the key is your source of information then you can take two keys put them next to each other, compare them and you see the two keys at the tops and they differ in the middle positions what do we get from this if they match then we know that they are at least in the same layer but because there can be several valid positions in the same lock we can't say if there might not be another valid position that's where it differs from the previous system where it could only have one valid position and I varied the position of the key but in this system I have nine different positions and there are sliders where all nine positions fit and it's even worse when the positions differ because we can't learn anything from that it doesn't limit our search space so all positions could still be valid we simply don't learn anything either way we don't learn a lot from it we don't gain a lot of information so let's have a look at the cylinder each cylinder delivers all valid locking codes so that can be quite a few sometimes more than 70 but if you take several cylinders apart and you take the intersection of the valid codes then that gives you the master code a master key here's an example we bought a system from ebay and decoded it we took out one cylinder and here we try to decode it this is d for double curve which is sensed alternately 3, 2, 7, 7, 3, 2 double curve is already fully determined the single curve gives us the possibilities 1, 2, 3, 2, 6, 7, 8, 3, 4, 5 4, 8, 5 this is obvious and 7 which is also determined this gives us 72 remaining combinations if we do the same for the next cylinder we already know the double curve but the single curve gives us different possible combinations and that excludes quite a lot of combinations we only have 6 possible combinations left and we do the same thing again with the third cylinder and we're in luck because the intersection of 3 cylinders is already enough to derive the master key the last remaining combinations the last remaining uncertainties have already been excluded so we're done we have the master locking code that you can see on this slide I'm not going to tell you that this key but if you were to rebuild this you could open certain locking systems and so we scanned the master key and decoded it and the single code is 3, 6, 5, 4, 5, 7 which is exactly the same code we just derived so we've decoded the 3ks system how do we get keys in our club we have a CNC an engraving machine it's pretty cheap it's bought from China it costs us about 1.500€ it's 50 micro meters reliability which isn't quite and the area isn't quite enough for milling a key but it's more than enough for milling a key but it's all we had so how do we go about this so software do we use how do we position the keys these were new questions for me as well and what we did is we used OpenSCAD and Inkscape OpenSCAD is something that allows you to build text based 3d models and there are quite a few export formats but we used STL or DXF Inkscape is a 2D vector graphics program and it's very versatile and we used it to scan the keys and redraw the curves and measure the curves and check the distances scanning is a very good approach for characterising keys because it gives you size information and this was a funny event because the instant code is you can only look at 3KS if you have an authorization from the vendor because it's secret so we just went about and measured it which isn't too hard really the CAD software describes the model of an object and now we have to convert it into milling data that's what CAM software is for and I eventually set it on CAMBAM which is commercial they have free licences for hacker spaces and it's pretty good for what it costs us and what it can do you load the data from Inkscape and it exports to GCode and as a second step we automated the most difficult step this is CAMBAM this is the entire key the chaos knot in Inkscape imported into CAMBAM and initially we also drew the curves in Inkscape imported them so you use a grid to align your template curves we already have the right distances for the double curve here you import that into CAMBAM and then you can mill your key but this takes a lot of time so if you do it manually it takes you 10 minutes per keys 5-10 minutes per key just to have the milling data and the most time consuming thing was the export of a new geometrical curve and the import into CAMBAM and then setting all the data the diameter, the depth and all of this so we thought could we maybe automate that our actual approach was using scripts to automate Inkscape and CAMBAM but we didn't get very far with that and then the idea was let's just write our own G-Code Generator and I'm going to give you a short demo what you see here is the template that contains the data except for the curves we always have this groove in the middle which makes sure that the key stays in the lock when the key is being turned and there's the sidebar that is being inserted from the type and if the key is correct it has two grooves that block the key which prevents you from pulling the key at the wrong position and we have these longitudinal grooves that are passive so in each side and then it will fit any lock so the sides are passive as well so if you don't want to bother decoding them you can just mill a groove at each position and it will fit but the most important thing and it's still missing is the curve so so we bought a demo system that's also used for locksmiths we decoded it and this is what we got the single and double curves we wrote a simple gcode generator in python it wasn't that difficult it was just refreshing some geometry but not too difficult we just copy the data we paste the data into that export it and it generates the gcode and we have the new file where is it I also created a backup in case it didn't work but I can now import it and there's my curve and that saves me the trouble of having to export and import that through every program in the toolchain now moving on if I were to type in another code that would work just as well so if you need a key now, having the software there were some open questions left and we moved on to the hardware the question was how can we position the key more precisely enough and how can we mill on both sides the precision is enough but because the key is being sensed from both sides we need to position it exactly the same milling the other side that question was solved pretty quickly we just used brass for the keys the mill is strong enough for that in the first couple of attempts the sensing was a bit difficult we killed some drill bits for that but now we've arrived at a point where we can pay about 10 euros for a blank and have a working key we usually use brass or steel for locking systems usually manufacturers might use a new silver that is a bit harder we could do that as well but that would take us about twice the milling time but our keys are a bit softer they still are work in practice so we thought well positioning blanks the simplest process would have been to just create a jig we build a jig and with a goal of having the key position correctly in order to sense the position of the drill bit between the electrical contact between the drill and the blank and in order not to have the material for the jig should not be electrically conductive and we wanted to have the jig to be able to fix the jig in the mill regardless of whether there is a blank in it or not I'm going to now show you the 3D model of that jig what you see here at the bottom is a nose that fits exactly into the recess on the mill and the holes on top are there the millt it and we will place bits in it to fix the blank to the bit and here you can see that jig in detail or you can see a blank on top of the jig and there we have a triangle the key needs to be fixed well so so wir haben noch dieses Loch vor diesem Dreieck und man sieht wenn ich es umdrehe man sieht hier hinten diese zwei 6-Kanten die Gewindelhüssen sind von hinten reingesteckt und ich das Holz isoliert wir wollten erst ein Pommaterial nehmen aber das hier ist ausreichend stabil und funktioniert problemlos von Kunststoff hatten wir nicht so viel daran wir machen erst mal Modelle aus Holz und hat eigentlich ausgereicht ganz normal das Multiplex Material und das Spezielles wir benutzen das jetzt finally how does the hardware workflow look like first we need the blanks we can either drill the mill these or print them laser cut them and we will come to that in the end we had someone laser them and if we were to produce keys in a larger number we could have them punched the original keys are 2.1mm thick we we used material with a thickness of 2mm and that works as well as a second step we mill the key, the curves and the edge grooves and finally the mechanical fine precision work removing the leftover bits and we have a little demo prepared here of course you can see the model here that is an entirely normal lock from the locking system we bought and I will show that to you in a second on the scanner those are two different systems here I have the key I got with the lock as well as a key from the demo and because the single and double curves alternate I can create a key that has two different sides and if I turn it one way it doesn't work in the lock and if I turn it the other way 180° it works so we can really have two completely different locking systems with a completely different profile this key has grooves on both sides that one on the side I have a pick here here on that side and here on the other side drilled in as well that is the Passport 2 that works with any 3KS lock for any system now I hope you can see this the lock now closes and in here you can see the U from the sidebar where that needs to move and if you look exactly you see that they are exactly aligned now if I turn the key you cannot see that perfectly but there is a spot where both of the holes are misaligned because I did that in an asymmetrical fashion I have different locking codes it works that way and doesn't work the other back to the dock one point da haben wir hier saved us some work the side grooves on the edge are only checked in one position and if we had wanted to do this correctly we would have had one of the edges with a code from one of the systems and the other edge with the other but because in der Union of the grooves and milled both of them as you can see here the profile cylinder the key only ever sits on the lower side and the I can use the control groove to see which side of the key I should be using so if you know a facility manager who has to manage two buildings you can now build a key for him and if if you can sense that using the groove if someone asks you do you have a key for that building you can just check the groove and insert the key in the correct fashion for it not to work in the building and say well no it doesn't work I don't have a key now handing back to Jan we are going to carry on with this nearly done with this we still need the perfect name for it maybe all keys are beautiful we'll think about it we're going to carry on anyhow the first step is going to be the milling device I think we're going to publish some code on github and we're going to publish the link so you can find it we can optimize the whole thing we can build a tool that automatically turns around the key we've also proved the system to automatically calibrate itself and of course we could mill other systems as well I just need to change it into my gcode generator I just need to add a setting and of course a conventional serated key insert it horizontally into the mill and then you can just mill the code into the side of it and all this too could be automated 3ks is not an insecure system it's still very good it can be manipulated I'd say this building contains at most 10 people who could do that though and there's a very simple way to do that if I have a mechanical key like this it's my password this is my password and if I show it to you I give you my secret there's a very simple method of protecting my secret I have one of these one of these key pockets and wherever I go I keep my keys in this pocket the system is not bad but it can be manipulated with a simple method you can just you can just use liquid metal to cast a new key and of course the locking code is on the key itself you need to protect that I can buy one of these pockets for 5€ anywhere I put my keys in that when I open my door and that maintains my security my one aside we have the milling device with us and would like to show it to people who are interested we found an empty space next to the knock out desk we'll be there in 10 minutes time and we're gonna have the milling device there we'll show you all the parts that we have you can look at them we can also mill some keys to show you how it works and we're here to answer your questions so ask them and we'll be happy to answer them vielen vielen Dank ihr beiden wir haben jetzt auch ein paar Minuten Zeit für Fragen und Antworten wenn ihr mir Fragen macht geht zu einem der vier Mikrokone und der Sprech bitte laut und deutlich sein wir fangen mal an mit einer Frage von den Online-Zuschauer Ja, aber okay und die Frage ist Nein, nein, das war nicht dies Okay, so, jemand im Internet sagt, er war mal ein Muselhersteller vermutlich in der Schweiz bei einem Vorstellungsgespräch hat dann eine kritische berechtig kritische Frage gestellt und da ist dann wohl Ratspanz wieder vor der Tür für die große jetzt ist die Frage, ob es Fälle gibt wo z.B. eine Bohrloch-Datenbank mal abhanden gekommen ist also jetzt wollen wir den Internet kurz ich will die Hersteller geben, die Daten frei, bin ich ja auch many vendors actually give you that data voluntarily for instance, MasterLock has zero numbers on the back of the device and if you enter it into their tool it gives you the opening code some are found out by reverse engineering simple mathematical methods of where you can you just where it's derived from the serial number I haven't heard of leaks of these databases of leaks of data of locking systems many vendors simply have a random number and then they attach that to the system number and it's system number 17 of course if there were a mathematical system behind it that would be troublesome databases are actually secure if they kept safely I haven't heard of any mechanical systems where that would have happened einmal hinten links thank you I wanted to ask if you try to mill the first variant of the key the first 3KS variant no the one with the single markings no I just did it on my drilling device you can buy them on ebay it's usually used by locksmiths I inserted a single key the one with a different drill holes on the other side made it mechanically it just cost you 300€ to buy one of these machines from China thanks how realistic is it to build this giving cylinder for example for the trash building it would be simple to install a camera next to where the key is inserted I have all the information on the same side so if I had a very high resolution camera and I could recognize when the victim inserts the key into the lock because I usually don't hide the key I take it in my hand and insert it like this that works mechanically sensing the key that won't work there's not enough space but with a camera it would be very simple the resolution is enough next question I have two questions first how many attempts did you have to to get a first working prototype key and the second question is in the current state how long do you need to mill one key I think it took us three or four attempts until the first key fit we had some trouble with thickness we tried with a three millimeter blank but that didn't work the calibration was a bit difficult the problem is that I never really learned metal processing so I learned it by doing generating the curve itself was no trouble at all how long does it take I think one side takes us about five minutes something like that yeah we perfected it up until the congress we filed the side by codes by hand but now we can just insert it into the jig it takes five minutes to mill we calibrate it automatically it's still a bit tricky to do it without calibration and it mills the side by code I need to cut off the tip it takes two more minutes to perfect it by hand so it takes less than 15 minutes thanks another question from the livestream the stream would like to know if and where one can get the t-shirts that you guys are wearing that was a spontaneous action last Wednesday at the lockpicking event in Hamburg the team made them for us the team that makes all the signs as well so just ask me the design is freely available we ordered them by express on Thursday and they arrived in time so no problem told us send an email and we will help you my was just coincidence I found it at a tourist shop in Barcelona and never afterwards but I don't know where it is so if you're interested I can tell you where to buy one of them in Barcelona thanks for the shopping tips speaking of the queso system if I have a lock where the pin always matches regardless how deep the hole is if I drill a hole and have different keys knowing I don't know how deep the hole in each key needs to be and I I cannot tell how deep it must be how do you have any tricks these blinds that we have in there the blind pins the one at the bottom I use these if I don't use the drill hole of course I have no way to know the key can still have a drill hole because it needs to open a different lock if I just use it for one lock I have no way to interpret anything it's simply an unused drill hole because I always need to have 15 drill holes but if I don't use it this blind has to be in there I can derive no information on whether the key has any hidden information some keys have fake information that still have a blind pin but at some point in the locking system there is a pin that has a different height that position if this could cause trouble otherwise is that being done yes absolutely this is being used as a trap as well in larger systems couple last questions one the curve system did you take into account in the cases where you didn't know if there is a 5, 6 or 7 did you take into account that some possibilities could be excluded because the state transition would not be possible that's a question of course the vendor can sort a slider that allows for anything those exist oh you mean the diagonal milling of the key it's always possible because we only check every other slider this is the first double slider but the next one is only checked here so it's always possible to move from 1 to 7 yeah always can because there's the other side as well i also receive the feedback the maximum angle should be below 45 degrees because otherwise it's no longer work as nicely the systems that we tried we were just in luck and they obeyed this rule but otherwise just try i don't know if it's specified by the vendor i think it would just be a bit trickier but still work okay go ahead i would like to know how illegal it is to mill a key myself or if it's only illegal to use it it's very straightforward if i am the rightful owner of the key which could be because i was handed it or because it's the key to my apartment that's fine a locksmith has gets in trouble if the key is patented but as long as i destroy the key at the end and hand it back the european court of justice had a ruling on this as well the key is simply regarded as a replacement part as long as i don't violate any patents i can have a key of course if i make a key that allows me to access rooms that i am not allowed to access then of course that's a different question and i can get into a lot of trouble there it's criminal i would think very carefully if i would want to create a master key for my company and just walk through their rooms that would have been a question if i create a master key of several keys that i own would it be illegal to create that key or would it be only illegal if i use the key if i use it as a proof of concept and i put it into my if i just keep it well locked away but if i give it to other people or give the locking code to other people then i open a security gap for the person who has the master key you can use it as a proof of concept we just used this locking system from ebay and also the key service and we used something that was gifted to us that's fine but you should think carefully about it we just wanted to show you what's possible i can take your keys i can take apart some of these locks without the key these are always simplifications the best system is that i have a separate key for each door which is of course uncomfortable but it's still this most secure method thank you the last question comes from the livestream someone is asking if i have n keys can i create an individual key or and that person has an old locking system with a couple of keys and a couple of locks if i buy used locking system and i did this before i didn't have the master key and i took it apart what you often do in conventional systems the keys that need to fit into many locks are quite slim and narrow the thing i see at the front is well there are keys that fit into any hole and some keys don't fit into that hole but i already see where i need to take away some material to make it fit so in most cases it's possible to create the master keys so i have enough information to do it if i have locks that are from all kinds of groups it's going to be difficult but it's possible in principle thank you very much big round of applause and this concludes our