Effective attack against Total Position Progression (TPP) master keys

A lot of businesses and institutions rely upon master key systems, in which most keys can only open one lock, but one key can open all of them. The latter sort of keys are usually held by security personnel, superintendents, etc. One common approach to achieving this with pin tumbler locks is to put two cuts in each pin stack, instead of the usual one. That allows several different possible keys to align the cuts along a shear line, allowing the lock to be opened.

A paper by Matt Blaze, from AT&T Labs – Research, describes a relatively simple attack that foils such master key systems, allowing anyone with an ordinary key, some blanks, and a file to copy the master key without ever seeing it. Basically, the approach is to start with the non-master key, then test each pin for another value that still produces a working key. Working through pin-by-pin, you can identify where the second break lies for each pin. From that, you can file or cut yourself a key that will open all the locks in the system. Using a bit of basic math, this process can be optimized and the number of blanks and key modifications required reduced.

It’s a neat attack for a number of reasons. It doesn’t require any exotic equipment or exceptional technical skill. Nor does it require breaking into anywhere, or compromising or tricking anyone. What it does do is provide a skilled attacker with a cheap means to render a much more expensive security system ineffective, requiring the replacement of all the master locks to correct for the failure (and not just with new master locks of the same kind, which would be vulnerable again). It is also neat insofar as it demonstrates what is effectively a mathematical attack against a physical system.

It is quite possible that this attack could allow somebody with legitimate access to one unit in a group (an office, a self-storage locker, a university residence room, etc) to gain access to all others, in a way that would be hard to detect and expensive to counteract.

Author: Milan

In the spring of 2005, I graduated from the University of British Columbia with a degree in International Relations and a general focus in the area of environmental politics. In the fall of 2005, I began reading for an M.Phil in IR at Wadham College, Oxford. Outside school, I am very interested in photography, writing, and the outdoors. I am writing this blog to keep in touch with friends and family around the world, provide a more personal view of graduate student life in Oxford, and pass on some lessons I've learned here. View all posts by Milan