Decoding the Kwikset SmartKey™ Shmoocon 2009 Shane Lawson Fraternal Order of LockSport (FOOLS)‏

FOOLS? FOOLS is a locksport group primarily from Bloomington, Indiana We run the lockpicking attractions at Notacon Also helped with the lockpicking village at DC16

About the SmartKey ANSI Grade 1 Deadbolts Resists bump attacks Re-Keyable on demand Anti-drill bearings in cylinder

Operation The mechanics of the key do not function like standard pin tumbler locks Pins have a ledge The ledge interfaces with sawtooth wafers The wafers engage the sidebar

Cylinder Dissection Side view shows pins, springs, and wafer ledges which hold the wafers during the re-keying process

Pin Ledges

Wafer Ledges

Wafers Right-hand notch is for the sidebar Left-hand notches fit on the pin ledges

Wafer Housing Fits to the pin housing Completes the cylinder inside the lock Also houses the sidebar What makes the re- key function work

ReKeying Turn the key 90 degrees Insert the 'learning tool' Pull the tool and key out Insert new key Turn back to normal Remove key The new key works, old one doesn't

The 'Learning Tool' Can be replaced by: Paperclip Toothpick Plastic Anything that fits in the hole and can push the wafer housing back.

How it Works When the lock is turned and the tool pushes in, the wafers are pushed off of the pin ledges The new key goes in setting new pin depths Turning the lock back snaps the wafers back, and the teeth engage at the new depths.

Supplies KW1 Blank Sewing Needle Anti-Theft tag Alligator Clip Super Glue JB Kwik/JB Weld

Tools Dremel Cutting wheel Shaping tip Vice Scissors (for shim)‏

Decoder Prototype

Decoder Operation The pennant on the needle acts as a feeler By shifting the angle of the needle, the pennant can easily move past the housing Once free, the pennant will touch against any free saw teeth By counting the teeth, the key depth is discovered

Concept of Operation

Extended Operation Note the anti-drill bearing in the cylinder

Highlighted

Decoder Chart

Cost Summary KW1 Blank = 1.50 Sewing Needles = 1.50 Aluminum Shims = free Superglue/Epoxy = free if you have it, if not $2 at a dollar store Total cost = 5.00

What that $5 buys This works on all of the smartseries locks Each one has the same cylinder design Subdermal fingerprint readers and numbered keypads make no difference if you can decode the manual override.

(Demos available)‏ bloomingtonfools.org Thanks (Demos available)‏ bloomingtonfools.org