Impressioning: Difference between revisions
m (→History) |
|||
(9 intermediate revisions by 3 users not shown) | |||
Line 11: | Line 11: | ||
==History== | ==History== | ||
Entire books have been written about impressioning locks, most notably “Keys to the Kingdom: Impressioning, Privilege Escalation, Bumping, and other Key-Based Attacks Against Physical Locks”, by Deviant Ollam. Impressioning is possible because of the pin’s “binding effect” when the core is rotated – the same principle that makes lock picking possible. When impressioning you’ll need to prepare a blank key by lightly sanding flat the top surface with 600 grit sand paper. This grit will leave slight sanding marks on the surface, which is precisely what you want. Insert the prepared key into the lock and turn it back and forth several times. When you remove the key expose the prepared surface to a bright light and you’ll see rub marks, indicating the location each of the pins. Use a six inch, #4 Swiss cut round file to put a small groove at each mark. Make only 2-3 light swipes to locate the pins and leave a slightly textured finish in the grooves. Repeat. At some point only the binding pin will leave a rub mark, that’s what you are looking for. Make 2-3 light swipes with the file only on the binding pin’s location. Repeat. If you see a mark at the same location, give it another couple of swipes with your file – go slow. Repeat. At some point that pin will no longer leave a mark, but ANOTHER pin will. That’s the new binding pin, so give it a couple of swipes with your file. Continue doing this until the lock opens. Congratulations! You have just impressioned your first lock. The biggest mistake noobs make is filing away too much material because they get in a hurry. Once you’ve done that the game is over – and you’ve failed. Be SURE of your marks before filing and take your time. You may not get a mark every time. If that happens simply put the key back in and turn it some more. Try to not be too vigorous with the turning though or the key will weaken and break. If you see that happening, stop and cut a new key to the same depths then continue where you left off. For a LOT more detail on how to do this, check out Impressioning Manual for Amateur Locksmiths. | |||
==Key-based (copying) Impressioning== | ==Key-based (copying) Impressioning== | ||
Line 100: | Line 100: | ||
===Blank Preparation=== | ===Blank Preparation=== | ||
Preparing the blank key is meant to enhance the marks left by components. To begin, the blank may be lightly filed to produce a smooth, uniform surface. Care is taken to ensure that filing does not exceed the first depth of the key at any point before the impressioning process begins. The bitting surface may be filed to a knife edge to thin the bitting material, making it easier to produce impressions. | Preparing the blank key is meant to enhance the marks left by components. To begin, the blank may be lightly filed to produce a smooth, uniform surface. Care is taken to ensure that filing does not exceed the first depth of the key at any point before the impressioning process begins. The [[Key#Parts of a Key|bitting]] surface may be filed to a knife edge to thin the bitting material, making it easier to produce impressions. | ||
With [[Lever|lever]] or [[Warded|warded]] locks, the blank may be coated with something to make identifying marks easier. Traditionally wax or carbon was used to coat the bitting surface. This is still popular in modern use, but other materials, such as paint, are acceptable. The practice of using carbon is known as smoking the key blank. | With [[Lever|lever]] or [[Warded|warded]] locks, the blank may be coated with something to make identifying marks easier. Traditionally wax or carbon was used to coat the bitting surface. This is still popular in modern use, but other materials, such as paint, are acceptable. The practice of using carbon is known as smoking the key blank. | ||
The key blank may also be modified to allow for enhanced movement within the lock, such as thinning of the blade or removal of material from the shoulder or tip. | The key blank may also be modified to allow for enhanced movement within the lock, such as thinning of the blade or removal of material from the shoulder or tip. | ||
===Obtaining Marks=== | ===Obtaining Marks=== | ||
The key is inserted into the lock. A gripping tool may be used hold the blank to increase control, feedback, and decrease discomfort to the user. Proprietary clamping tools are available, but 4"/6" vice grips are | The key is inserted into the lock. A gripping tool may be used hold the blank to increase control, feedback, and decrease discomfort to the user. Proprietary clamping tools are available, but 4"/6" vice grips are commonly used. Once inserted, torque is applied to bind components. Technically, too much torque is impossible provided the key blank withstands it and can be moved to produce marks. | ||
During the process of obtaining marks torque must be reset after each sample is taken. Failure to do so may leave components bound in incorrect locations and produce inconsistent markings. While obtaining marks, it is often helpful to perform the technique multiple times before releasing torque. | During the process of obtaining marks torque must be reset after each sample is taken. Failure to do so may leave components bound in incorrect locations and produce inconsistent markings. While obtaining marks, it is often helpful to perform the technique multiple times before releasing torque. | ||
Line 125: | Line 126: | ||
[[Image:Impressioning_UV_light.jpg|thumb|225px|A key being viewed through UV light to identify markings.]] | [[Image:Impressioning_UV_light.jpg|thumb|225px|A key being viewed through UV light to identify markings.]] | ||
After obtaining marks the key is inspected. Visual aids may be used, such as a magnifying glass, colored/UV lights, or a microscope. The marks left will be different based on the technique, lock type, and component | After obtaining marks the key is inspected. Visual aids may be used, such as a magnifying glass, colored/UV lights, or a microscope. The marks left will be different based on the technique, lock type, and component specifics. Pin tumbler locks usually leave small circular marks in the center of the bitting, whereas wafer locks leave rectangular marks at the edges of the bitting. <!-- remove specifics in favor of a list? --> | ||
Once a mark is identified it can be cut. If the key specifics are known the key may be cut to the next possible depth. More commonly, a hand file is used to remove material in small | Once a mark is identified it can be cut. If the key specifics are known the key may be cut to the next possible depth. More commonly, a hand file is used to remove material in small amounts. Care is taken to properly space and angle cuts. Once the cut is made the key surface may be dulled again to improve future markings. | ||
===Final Steps=== | ===Final Steps=== | ||
When a component reaches the correct height it will not bind | When a component reaches the correct height it will not bind against the plug, and no longer leave marks on the blank. Once all components are positioned correctly the lock will open. | ||
At this point, the key can be cleaned up by carefully | At this point, the key can be cleaned up by carefully sloping edges and taking off any sharp points. Sometimes a micrometer will be taken to the key and cuts will be rounded to the nearest known factory cut to produce a key by code. | ||
Keys which have been used in impressioning are typically not used long, because they become exceptionally weak from being bound in the cylinder repeatedly. | Keys which have been used in impressioning are typically not used long, because they become exceptionally weak from being bound in the cylinder repeatedly. | ||
===Tools Used=== | ===Tools Used=== | ||
<center><gallery> | |||
File:Grobet_4.png| A Grobet precision file, swiss cut #4, 6 inches long. | |||
File:Grobet_4_close.png| Close view of a Grobet swiss cut #4 file. | |||
File:Impressioning_handle-RubberBanned.jpg| The Foxhole Security impressioning handle. | |||
File:Framon handle IMMS001 back-GrainORice.png| The Framon Impressioning Tool. | |||
</gallery></center> | |||
:; Blank Key | :; Blank Key | ||
Line 152: | Line 159: | ||
== Pressure-responsive/"Self" Impressioning == | == Pressure-responsive/"Self" Impressioning == | ||
A key made of or prepared with a pressure-responsive material may be used to automate or aid in the process of manipulation-based impressioning. The main advantage of most pressure-responsive | A key made of or prepared with a pressure-responsive material may be used to automate or aid in the process of manipulation-based impressioning. The main advantage of most pressure-responsive materials is not requiring the key to be filed. Some pressure-responsive techniques eliminate the necessity of requiring a proper key blank, as well. The main disadvantage of pressure-responsive impressioning is that most materials have difficulty retaining the shape of the correct key once the lock is opened. Pressure-responsive materials are commonly wax, lead, foil, plastic, or elastic tape. | ||
=== Composite Keys === | === Composite Keys === | ||
Custom keys are available that replace the bitting surface with soft materials, such as lead. This makes the marks made by impressioning extremely easy to identify, but care must be taken not to distort the bitting when inserting or removing the | Custom keys are available that replace the bitting surface with soft materials, such as lead. This makes the marks made by impressioning extremely easy to identify, but care must be taken not to distort the bitting when inserting or removing the blank from the lock. Filing is still required using this type of material. | ||
=== Tapes === | === Tapes === | ||
Against [[Dimple|dimple]] locks, various types of tape along with a [[Bumping|bump]] key are used. The key is cut to the lowest depth positions (potentially lower, depending on tape thickness) and tape placed across the | Against [[Dimple|dimple]] locks, various types of tape along with a [[Bumping|bump]] key are used. The key is cut to the lowest depth positions (potentially lower, depending on tape thickness) and tape placed across the bitting surface. When placed in the lock, torque is applied and the key is gently rocked against the pins. The tape conforms to the position of components as binding pushes the tape deeper. Eventually, all components are in the correct position and the lock opens. | ||
=== Foils/Metals === | === Foils/Metals === | ||
Foil and metal tape may also be used for other types of locks, namely [[Pin_tumbler|pin-tumblers]]. Kits are available that include custom tools that have gaps with proper spacing and depth requirements for the lock. The | Foil and metal tape may also be used for other types of locks, namely [[Pin_tumbler|pin-tumblers]]. Kits are available that include custom tools that have gaps with proper spacing and depth requirements for the lock. The foil is wrapped around the tool and the tool is gently rocked against components. Like the dimple method, the foil conforms to the proper alignment as binding components align themselves. | ||
=== Plastics === | === Plastics === | ||
Line 175: | Line 182: | ||
* [[Lockpicking]] | * [[Lockpicking]] | ||
[[Category:Lockpicking]][[Category:Covert Entry]][[Category:Impressioning]] | [[Category:Lockpicking]][[Category:Covert Entry]][[Category:Impressioning]][[Category:Locksmithing]][[Category:Methods of entry]] |
Latest revision as of 03:01, 15 June 2023
Impressioning
Impressioning is a non-destructive, covert method of creating a working key for a lock without picking or disassembly. Impressioning is one of the most useful skills in locksmithing, and is divided between copying and manipulation techniques. Copying focuses on making negative-image molds of a source key, while manipulation uses various techniques to determine the proper heights of internal components. Impressioning via manipulation is closely related to decoding.
Impressioning has been long used to obtain a working key for a lock by locksmiths, locksport enthusiasts, and criminals. Many high profile crimes have been accomplished through the use of impressioning techniques. Techniques of impressioning have been applied to forensic investigations to aid in serial number recovery and tool mark identification.
History
Entire books have been written about impressioning locks, most notably “Keys to the Kingdom: Impressioning, Privilege Escalation, Bumping, and other Key-Based Attacks Against Physical Locks”, by Deviant Ollam. Impressioning is possible because of the pin’s “binding effect” when the core is rotated – the same principle that makes lock picking possible. When impressioning you’ll need to prepare a blank key by lightly sanding flat the top surface with 600 grit sand paper. This grit will leave slight sanding marks on the surface, which is precisely what you want. Insert the prepared key into the lock and turn it back and forth several times. When you remove the key expose the prepared surface to a bright light and you’ll see rub marks, indicating the location each of the pins. Use a six inch, #4 Swiss cut round file to put a small groove at each mark. Make only 2-3 light swipes to locate the pins and leave a slightly textured finish in the grooves. Repeat. At some point only the binding pin will leave a rub mark, that’s what you are looking for. Make 2-3 light swipes with the file only on the binding pin’s location. Repeat. If you see a mark at the same location, give it another couple of swipes with your file – go slow. Repeat. At some point that pin will no longer leave a mark, but ANOTHER pin will. That’s the new binding pin, so give it a couple of swipes with your file. Continue doing this until the lock opens. Congratulations! You have just impressioned your first lock. The biggest mistake noobs make is filing away too much material because they get in a hurry. Once you’ve done that the game is over – and you’ve failed. Be SURE of your marks before filing and take your time. You may not get a mark every time. If that happens simply put the key back in and turn it some more. Try to not be too vigorous with the turning though or the key will weaken and break. If you see that happening, stop and cut a new key to the same depths then continue where you left off. For a LOT more detail on how to do this, check out Impressioning Manual for Amateur Locksmiths.
Key-based (copying) Impressioning
Key-based (copying) impressioning focuses on obtaining a key for a lock to duplicate it. First, a negative-image of the key is created in a soft material, usually clay or silicone. Second, a duplicate key is cast using the negative-image. The casted key can be used to open the lock or duplicated further into a stronger material.
Time required for key-based impressioning depends on the material used to create both negative-image and casted key. Silicone impressioning generally takes longer, but has the ability to duplicate complex keys and re-use the negative-image for multiple castings.
Clay
The general process for clay impressioning:
- Obtain source key
- Place clay in a mold
- Lubricate the clay
- Source key is placed flat against the clay and pushed in halfway
- Mold is closed firmly, impressioning the second half of the key
- Mold is opened, and key is removed
- Air funnels are created; allows heat to escape during casting
- Lubricate the clay again (allows duplicate key to be easily removed)
- Casting material is prepared
- Mold is firmly closed, casting material poured into the mold
- Mold is opened, cast key removed
- Excess material is removed from duplicate key
Removal of the source key is the most problematic step. Removal is done with a straight-up movement of the hand. Twisting or wiggling can deform the negative-image enough to prevent the key from being inserted into the lock or correctly aligning components. Once the key is removed the negative image should be inspected for any deformation or air bubbles that may affect the duplicate key.
Once the duplicate key is created it will need to have excess material removed, and possibly filed to properly align components. Visual comparison with the source key can be used for this, though micrometers are common.
Silicone
The general process for silicone impressioning:
- Lubricate the source key
- Place source key into mold, suspended via wire
- Pour silicone into the mold
- Remove source key once silicone has solidified
- Casting material is prepared
- Casting material is poured into mold
- Cast key is removed
- Excess material is removed from duplicate key
Silicone impressioning is slower but more efficient than clay. Removal of the source key is simplified and the duplicate key usually does not need to be modified.
Tools Used
- Casting Material
- The material used to cast a working key once the negative-image is produced. Usually a low melting point metal, epoxy, or silicone.
- Impressioning Material
- The material that the negative-image is produced on or in. Usually wax, clay, or silicone.
- Knife
- Used to remove excess material displaced by the source key. Also used to provide a heat escape in the impressioning agent once the negative-image is produced.
- Lubricant
- Used to prevent the source key from sticking to the material and deforming the negative-image when the key is removed. Talcum powder, WD-40, cooking spray (e.g. Pam, Crisco), or silicon spray are most common.
- Mold
- A container used to hold the impressioning agent, generally a square or rectangular box with one side removed. Often referred to as a "clam shell" or "clam kit." With silicone impressioning, the mold is a small tube, such as a film container.
- Paintbrush
- Used to apply lubricant to the material.
- Source Key
- The original key that we are duplicating.
Manipulation-based Impressioning
All non-copying impressioning techniques rely on the ability to bind internal components until they are in the correct position. In modern use, components are bound and impressioned against a blank key to produce marks that indicate their positions are incorrect. Once the component is properly aligned it should no longer bind or produce marks. The process varies slightly depending on the lock design and included high-security mechanisms.
In warded locks, an impression is taken of the wards directly.
The general process is:
- A proper key blank is obtained.
- The blank is prepared to enhance markings.
- The key is inserted, components are bound, and key manipulated to produce markings on the blank.
- Markings are interpretted and material removed from the key where binding is suspected.
- The process repeats until all components are in the proper positions and the lock opens.
Blank Key Selection
The blank key selected for impressioning must match the lock specifications exactly. This includes the keyway, component count and spacing, and any additional security features. Failure to select the proper blank may prevent it from being inserted, able to receive markings, or able to open the lock due to additional security features.
The material of the key selected is important; stronger metals, such as nickel-silver or steel, should be dismissed in favor of softer brass, aluminum, or lead based keys. The softer material makes it easier to produce and analyze markings, but the material must be strong enough to withstand torque applied during the impressioning process. Various proprietary key designs exist to enhance markings while maintaining strength.
Blank Preparation
Preparing the blank key is meant to enhance the marks left by components. To begin, the blank may be lightly filed to produce a smooth, uniform surface. Care is taken to ensure that filing does not exceed the first depth of the key at any point before the impressioning process begins. The bitting surface may be filed to a knife edge to thin the bitting material, making it easier to produce impressions.
With lever or warded locks, the blank may be coated with something to make identifying marks easier. Traditionally wax or carbon was used to coat the bitting surface. This is still popular in modern use, but other materials, such as paint, are acceptable. The practice of using carbon is known as smoking the key blank.
The key blank may also be modified to allow for enhanced movement within the lock, such as thinning of the blade or removal of material from the shoulder or tip.
Obtaining Marks
The key is inserted into the lock. A gripping tool may be used hold the blank to increase control, feedback, and decrease discomfort to the user. Proprietary clamping tools are available, but 4"/6" vice grips are commonly used. Once inserted, torque is applied to bind components. Technically, too much torque is impossible provided the key blank withstands it and can be moved to produce marks.
During the process of obtaining marks torque must be reset after each sample is taken. Failure to do so may leave components bound in incorrect locations and produce inconsistent markings. While obtaining marks, it is often helpful to perform the technique multiple times before releasing torque.
Techniques include:
- Pulling
- The blank is withdrawn slightly to cause components to drag across the bitting surface. Care must be taken to withdraw the blank minimally (about 1/16") as components may mark at incorrect positions or affect the depths of other components. Failure to release torque before removing the blank may cause extreme drags across the blank, rendering it useless. Special gripping tools are available to withdraw the key slightly, but can be done with vice grips and a screwdriver.
- Rocking
- The key is lifted at both the tip and shoulder in various orientations to obtain marks. Rocking encompasses clockwise and counterclockwise torque, as well as different orientations of the tip (up-left, up-right) and shoulder (down-left, down-right). Failure to reset torque between orientations will often cause erratic markings.
- Striking
- A light strike from a rubber mallet to top and bottom of the bow, causing it to lightly bounce up or down against binding components. A screwdriver or allen wrench to provide torque through the bow of the key is recommended because holding it tends to inhibit movement.
Interpreting and Filing Marks
After obtaining marks the key is inspected. Visual aids may be used, such as a magnifying glass, colored/UV lights, or a microscope. The marks left will be different based on the technique, lock type, and component specifics. Pin tumbler locks usually leave small circular marks in the center of the bitting, whereas wafer locks leave rectangular marks at the edges of the bitting.
Once a mark is identified it can be cut. If the key specifics are known the key may be cut to the next possible depth. More commonly, a hand file is used to remove material in small amounts. Care is taken to properly space and angle cuts. Once the cut is made the key surface may be dulled again to improve future markings.
Final Steps
When a component reaches the correct height it will not bind against the plug, and no longer leave marks on the blank. Once all components are positioned correctly the lock will open.
At this point, the key can be cleaned up by carefully sloping edges and taking off any sharp points. Sometimes a micrometer will be taken to the key and cuts will be rounded to the nearest known factory cut to produce a key by code.
Keys which have been used in impressioning are typically not used long, because they become exceptionally weak from being bound in the cylinder repeatedly.
Tools Used
- Blank Key
- Used to receive markings from binding components, eventually becoming a working key for the lock.
- Files
- Used to remove bitting material from the blank where marks are identified. Most commonly used are 6" Pippin #4 file, 6" Round file, and various warding files.
- Gripping Aid
- Used to increase control and feedback of the blank as well as decrease discomfort to the user. Vice grips are common, and many commercial tools are available.
- Visual Aid
- Used to help identify and analyze marks on the blank. Commonly a microscope, loupe, flashlight, UV or full-frequency light source.
Pressure-responsive/"Self" Impressioning
A key made of or prepared with a pressure-responsive material may be used to automate or aid in the process of manipulation-based impressioning. The main advantage of most pressure-responsive materials is not requiring the key to be filed. Some pressure-responsive techniques eliminate the necessity of requiring a proper key blank, as well. The main disadvantage of pressure-responsive impressioning is that most materials have difficulty retaining the shape of the correct key once the lock is opened. Pressure-responsive materials are commonly wax, lead, foil, plastic, or elastic tape.
Composite Keys
Custom keys are available that replace the bitting surface with soft materials, such as lead. This makes the marks made by impressioning extremely easy to identify, but care must be taken not to distort the bitting when inserting or removing the blank from the lock. Filing is still required using this type of material.
Tapes
Against dimple locks, various types of tape along with a bump key are used. The key is cut to the lowest depth positions (potentially lower, depending on tape thickness) and tape placed across the bitting surface. When placed in the lock, torque is applied and the key is gently rocked against the pins. The tape conforms to the position of components as binding pushes the tape deeper. Eventually, all components are in the correct position and the lock opens.
Foils/Metals
Foil and metal tape may also be used for other types of locks, namely pin-tumblers. Kits are available that include custom tools that have gaps with proper spacing and depth requirements for the lock. The foil is wrapped around the tool and the tool is gently rocked against components. Like the dimple method, the foil conforms to the proper alignment as binding components align themselves.
Plastics
Against axial/tubular or disc-detainer locks, various types of plastics (commonly flexible pen tubing) may be used.