In the morning and evenings, there will be talks about various lock topics. The afternoon is reserved for the competitions. Starting Friday with Impressioning, Saturday with Lockpicking, and Sunday with the Pentathlon competition. Please see https://blackbag.toool.nl/?p=4228 for the competition rules.
We will have flip overs with the program at the event. You are allowed to fill the gaps in the schedule and take the stage with your own last minute talk or workshop. Swapping time slots isn’t an issue either, just discuss this first.
Thursday
15:00
Room check-in is open
18:00 – 01:00
Socializing
21:00
Conference room open
Friday
07:30 – 10:00
Breakfast
10:00 – 10:30
LockCon Opening
10:30 – 11:30
Evva Elus & Anker 3800 update – Walter Belgers
11:30 – 12:30
TBD – Zeefeene
13:00 – 14:00
Lunch (sandwiches in the conference room)
14:00 – 19:00
Impressioning competition
19:00 – 20:30
Dinner
20:30- 21:30
Locksport journey with Abloy disc detainer locks – Petri Maksimainen (Idanhurja)
21:30
Start of disk detainer competition
21:30- 23:00
Abloy disc detainer workshop by Idanhurja and DaMage
21:30- 23:00
F3D workshop by Nitiflor
Saturday
07:30 – 10:00
Breakfast
10:30 – 11:30
Electronic safe locks – Jan-Willem Markus
11:30 – 12:00
Short speak about history of lock cylinders in Czech country – Lubos Cech (catalocks.eu)
12:30 – 13:00
Group photo – Dennis van Zuijlekom
13:00 – 14:00
Lunch (sandwiches in the conference room)
14:00 – 19:00
Lockpicking competition
19:00 – 20:30
Dinner
20:30- 21:30
Physical Vulnerability Research – Matt Smith (huxleypick)
21:30- 23:00
Locksport – Walter, Jos, Matt, Nigel
Sunday
07:30 – 10:00
Breakfast
11:00 – 11:30
Aubin’s trophy – Eric scaillet
12:00
End of disk detainer competition
12:00 – 16:00
“PENTATHLON” COMPETITION – Parmakey
13:00 – 15:30
15:30 – 16:00
Closing Ceremony
If someone wants to make a calendar file (ICS) and sends it to us, we will add it to this post.
Dulimex kindly sent us the new PRO-LINE padlocks as a lockpicking challenge. Picking these won’t be easy, as the padlock features a Tokoz Pro core with eight disks and a disk blocking system similar to Abloy Protec.
While it’s fun to spend days picking the lock, picking isn’t necessarily a realistic threat for your normal security needs. This Dulimex padlock achieved a SKG** rating. While it’ll not be indestructible, you have the assurance it’ll be at least a few minutes with a selection of power tools.
We received five locks from Dulimex for the challenge. The locks will be available at LockCon, and we will borrow them to pickers thereafter. If you are up for it, please send us a message.
At first glance, the core looks similar to the Abloy Protec. But there are quite a few notable differences. The Tokoz very cleverly uses the spacers to build up the core. The construction makes it difficult to reassemble the lock, so please keep them together.
Thanks everyone for giving me tips on picking these locks. The tips can be summarized as, to use dimple picks instead of a 2-in-1, unless one is custom-made for the Tokoz. Furthermore, the key guide can be twisted, which bricks the lock. When the lock is picked, then use a modified key to rotate the key guide, instead of forcing it from the front.
This story is based on the work from Reinder Stegen, in which the Protec2 was reverse engineered and scripts for parametric key generation are written. Reinder worked with James Wah for the parametric webblification. As in, a free to use online webgenerator for all your Protec2 key needs. To get the keys to the real world, one just needs a good 3D printer.
3D printing keys has been around for at least a decade, from 3D printing scrips like AutoKey3D by Christian Holler to printing many high security keys. Modeling and printing keys gives unique understanding of the underlying principles of the locking mechanisms. I, myself, wouldn’t have understood Kromer protector, Bowley Rorasera, and Fichet F3D as well without modeling the keys.
While 3D printing keys can be a strong attack, the bitting of the key needs to become known to an attacker beforehand. If this attack is within your threat model, please invest into key control. I.e. to keep track of the locks and keys in your system.
The challenge
A set of nine Abloy PL340 locks caught my attention as it was sold as a lockpicking challenge. As in, the seller didn’t have the correct keys, but included keys from the same series. Where the challenge is to open the locks. I chose to work with Reinder to decode one, and 3D print the keys for the rest of the set.
The PL340 are beefy padlocks of around 55*50*25mm, very much excess for any normal consumer applications. While we like them for securing Peli cases, they’ll work fine on your motorcycle or shipping container as well.
The key making process started by decoding the several non-working keys in the package keys. While five cuts were shared between the keys, it wasn’t enough to determine what the keys should be. One lock was disassembled and the disks were decoded according to the pictures in the Protec2 white paper by Han Fey. (Reinder has published a better chart on 22nd of September 2023)
The Protec2 has eleven disks, of which the fourth and eleven are zero disks. All code disks have two true gates, except for a six with one true gate. We see four disks with more than two true gates, which means they are mastered and accept a key with either cuts on it.
I’ve opted to use Python to create a list of all possible keys in this system instead of using pen and paper. After I had a working solution with many nested loops, I found the function product in the itertools package to generate a list of solutions in fewer lines of code. The code below generates and prints the valid keys from a list of lists with possible bittings.
# bitting_mks.py
# Quick script to get all possible keys from a single master keyed lock.
# 20230730 Jan-Willem CCBY4.0 Toool NL
import itertools
# The key codes is a list of list of ascii characters.
key_code = [['0'],['5'],['4'],['6'],['3','5'],['1','6'],['1','3'],['0'],['5','6'],['6'],['1']]
keys = list(itertools.product(*key_code))
for key in keys:
print("".join(key))
This script should work for most key systems. For me, it generated the sixteen valid keys of this master keyed system. With Reinder’s online generator, I’ve generated the files. As I lack a printer capable of printing these, I used the 3D printing service from JLCPCB. Reinder had good experience with Imagine Black, so that was my starting point as well.
Reinder’s tool for generating the keys isn’t widely shared, yet. He has shared a video in which several more 3D printed keys are showcased, including a few which work better than the online generated keys. Several other scripts (By NVX, and bgrydon) are available online, but they don’t work as well as this work.
Uploading the models it to the service was quite tedious. Not only does the material, finish, and customs description need to be filled in for each print, QA was quite picky, and rejected the files several times. After some touch ups in Meshmixer, the keys are ordered. 3D printing keys was very affordable.
The prints came in after a couple of weeks and look great. As the print doesn’t have a captive ball bearing, I’ve removed one from a non-functioning key. Sadly, none of the keys worked of the first print run. After double-checking the data, I’ve found a translation mistake. One disk was flipped in the picture, where a disk five becomes a three.
After going through the process a second time, the keys opened the lock I decoded. Possibly a bit more surprising, two keys worked on all other locks as well. So these are the master keys of a system bigger than these nine locks.
While it’s a great success, and defeating this system with 3D printing, I think we can do much more with this locking system. I’ll likely revisit the work of Matt Smith, to attempt to pick it, or at least try to find a better way of decoding the locks.
To settle one curiosity, I’ve commissioned new prints generated by Reinder in several materials. These have a captive ball. From left to right, we have: Imagine black, 9000R Resin, 8228 Resin, 8001 Resin, 3201PA-F Nylon, 316L Stainless.
All the plastic keys were dimensionally correct and opened the lock. Of course, the engineering resins work much smoother and are generally stronger. The 8228 seems to be very good, except for the ugly color 🙂
So, what about the metal key? While it is amazing we can have these parts fabricated for €8 per key, the dimensions aren’t there yet. The key is slightly oversized and doesn’t fit the keyway. Of course, you can order keys with several different scaling factors, but it’ll be expensive, whereas the resin prints work well and are relatively cheap. In the end the resin keys are around €2 each, and I’ve spent about €200 on the whole project.
While it’s exciting to ‘defeat’ Protec2 locks with this attack, it’s more a showcase of skill and dedication of people in the locksport community. Thanks, Reinder and James, for allowing me to use this work.
This text and the pictures are CCBY4.0 Jan-Willem Markus, Toool Blackbag. The copyright of the key generator is with Reinder Stegen and James Wah.
Posted in Keys, General, Decoding | Comments Off on 3D printing keys for Protec2
In an effort to bring people up to speed on the Dutch Open Competitions at LockCon, we are publishing the competition rules. The PDF below are rules for the Lockpicking, Impressioning and Lever lockpicking competition, exported from the ‘How to run LockCon’ document written by Walter in 2016.
We have a lockpicking, impressioning, disk detainer, and Lockpicking Pentathlon. The Pentathlon has five opening techniques which includes picking, lever lockpicking, car locks and much more.
The organizers will put up flip overs, on which you can register yourself for the competition. Please be on time when the competition starts. We aim to have Impressioning on Friday afternoon, Lockpicking on Saturday afternoon, and the Pentathlon on Sunday.
Lockpicking
For LockCon 2023 we will run the lockpicking competition with locks commonly found in the Netherlands, in addition to locks kindly sponsored by Zeefeene and Nigel from Toool UK.
The locks are pickable with normal lockpicks, of which we do not have a restriction for custom or commercial.
We aim to have locks without a secondary locking system, I.e. sidebar.
Applying torque on the tailpiece instead of using a tension wrench is allowed.
The time per round is adjusted for the difficulty of the lock, usually 5/10/15 minutes per round.
Impressioning
The Impressioning competition will be on Abus C83 locks, kindly sponsored by Abus. The first round will be an hour, and the A and B finals are planned to be six rounds of 15 minutes each.
In addition to the rules below, we added several small nuances to the rules:
The tailpiece of the lock needs to be unobstructed. As in, no torque can be applied from the tailpiece. Please take care to mount the lock properly, and not pinch the tailpiece.
Any newly invented tool or technique can only be used in the competition after explicit permission of the Judges.
Please see the Dutch Open Impressioning Championship 2022 report for more information on the competition. https://blackbag.toool.nl/?p=4222
Disk detainer competition
We will have a disk detainer lockpicking competition for the first time. For which, Sparrows kindly sponsored five of their disk detainer lockpicks. The competition will run throughout the event as a self timed competition.
There will be three to five locks, from easy to fairly difficult.
Locks are not guaranteed to be front tensioning, but can all be opened with the tools provided.
Please keep the combinations a secret for others competing.
The tools are not fragile, but shouldn’t be abused either. We have some spares, and come to the organizers if the tools are defective.
For people that are either new to disk detainers or don’t like competing, there will be tools and locks available to learn the technique, as well as workshops in picking high security disk detainers. We will also bring locks with much higher difficulty, starting at Abus plus with butterfly disks, to Tokoz Pro. Picking these high-end locks is left as an exercise to the attendees. (Maybe bring your own tools for these.)
Jan-Willem wrote a report in the Dutch Open championship in Impressioning, held at LockCon 2022. The report talks about the parts of the competition which are rarely discussed, like the bitting of the locks and the opening count of each lock. Hopefully this report is of use for anyone into competitive impressioning.
Our appreciation go to Abus for their generosity of sponsoring the competition locks and blanks. Abus has sent us the locks for LockCon 2023, as well. Which is on Friday 13th of October.
When we teach lockpicking we usually revert to schematics of locks, and different models for demonstrating the functionality of locks. Usually required as the core functionality is well hidden, and not often observable in action. Multiple skilled machinists have made cutaway locks for the purpose of demonstrating the inner workings of real locks.
At one cutaway themed evening, we had over 50 unique cutaways on the table. From all brands and mechanisms. Some of which even the pins themselves were cutaway.
On an evening with impressioning, a member asked for some blanks to practice with. The call was answered by the keys below. Sadly, it’ll be very hard to find a corresponding lock for the key blanks, as in Europe we have thousands of unique keyways. Even though they all look a-like.
On another evening, we delved deep in lever locks, from your classic Chubb locks to high-end safes. A boroscope was brought as to try to decode some locks by belly reading the levers. E.g. to observe the scratches on the levers and determining the length of the butting making the scratches.
The WE30C also made its appearance, one night. The lock was used on pay phones, and is remarkably hard to lockpick due to the lever blocking system, shown in the top right. As torque is applied, the blocking system engages with the levers, making all levers bind up before the lever tests the gate.
We are delighted to announce that registration for LockCon 2023 is open! The conference will be held from the 12th of October to the 15th of October at the WestCord Hotel de Veluwe in Garderen, The Netherlands.
The Event
We will welcome registered attendees from Thursday afternoon (check-in 15:00 hr) with a meet and greet in the bar. On Friday, Saturday, and Sunday, we will have talks, workshops, competitions, and social events. And, of course, there will be plenty of opportunities to pick locks. We will have to vacate the hotel again on Sunday evening.
Invitation
LockCon is an event for the locksport community. Everyone with a passion for locksport is welcome, no matter the locksport group you are with. We work with the principle of friends, and friends of friends. If your friends are going to LockCon, ask them to vouch for you.
We have also reserved seats for people we have never met before. If you think you have something to contribute, or just are a very enthusiastic lockpicker who does not have the right connections yet, please contact us through the usual channels.
Hotel
As you may have seen, this year we will reside in a Hotel. This means there will be no dorm rooms, the maximum number of people sharing a room will be 4, and you will be able to suggest preferred roommates. As always, we have a limited amount of beds, so please complete the registration process early. The price for the entire weekend will be €360 per person, and will include LockCon 2023, breakfast and lunch on Friday, Saturday, and Sunday, dinner on Friday and Saturday, and lots of fun!
We are looking forward to seeing you there!
LockCon Team
Thursday October 12th 15:00 until Sunday October 15th early evening.
WestCord Hotel de Veluwe | Oud Millingenseweg 62 | 3886MJ Garderen | The Netherlands
Locks don’t have to be hard to pick to be interesting, and a Lips lock Jos loaned me is a fine example of that.
Lately I’ve been drawn to picking lever locks, as they have that nice “Skyrim” vibe. You can get a long way with just some bent wires. Knowing that, Jos brought this nice Lips lock to a Toool meetup, and I got to play with it a little.
Picking it is pretty straightforward, as there are no false gates on the lever, and no curtain. The pin in the keyway does make navigation a bit awkward, but all in all it’s not hard to pick.
Things get more interesting when you take a closer look at the lock.
First of all, it’s a Lips lock. Lips is a Dutch lock manufacturer that was founded in Dordrecht in 1871 by Jacobus Lips. In 1971 it became part of Chubb, and since 2000 it’s part of the Assa Abloy group.
The second name on the lock is P.G.E.M. The P.G.E.M. (or Provinciale Gelderse Energie Maatschappij) was a utility company delivering electricity and gas to the whole province of Gelderland in The Netherlands. Every Dutch province used to have its own utility company. It was owned by the province, and the local municipalities.
In the 1990’s the Dutch government decided all the utility companies had to be privatized, and P.G.E.M. became part of Nuon (which is now a part of Vattenfall).
Below P.G.E.M. are the letters LS, that stand for Laagspanning or Low Voltage. PGEM used these locks to secure electrical substations, and LS indicates this particular lock was used on a low voltage substation. The other side of the lock tells us more about this.
Here we see “Onderstation Woudhuis” written in pencil. Onderstation Woudhuis is a substation located in the city of Apeldoorn.
The double keyway is a striking feature which reminds of dual custody locks, only this isn’t that. It’s shared access, where only one of both keys is required to open the lock. This becomes clear when the faceplate is removed.
This seems to be a form of master keying without having to need to add extra gates to the levers, which would compromise the security of the lock.
Every lever has two cuts at the bottom. A closer look at two of the levers shows how different cut heights make it possible to open the lock with two different keys.
Moral of the story: locks are fun in so many ways.
I recently acquired an EVVA cylinder stamped “ELUS”. Nothing could be found about it, so I decided to investigate it.
Looking at this picture, it looks pretty standard. It is a variation of the EVVA NL system, which is inself is a variation of the TSC system. The NL is a 5-pin cylinder with multiple possible key profiles and with master keying in the bitting.
But: this system has additional electronics attached to it:
The electronics implement a Temporary Access Function, similar to that in the EVVA ICS TAF cylinder, invented around 25 years later than this. It was an invention of EVVA Netherlands with one of their partners, but it never reached production.
In the current Tool rhythm, we have one meetup a week. Both the Amsterdam and Eindhoven meetups are Bi-weekly, where we planned to have one meetup a week. We come together to discuss lock topics, compete in the Toool competition, and generally have fun picking locks.
In this post, I’d like to share pictures topics and projects that have come across at Toool meetups.
A locked coin safe was brought to the meeting. Due to the construction of the box, the lock was a very difficult to put torque on with a turning tool. We succeeded in opening the lock several times, and had great fun picking the lock in literally seconds with an electronic pick.
Once in a while, we receive donations from community members. This Sparrows vault was donated to us with the request for an upgrade to the lock, as the original served not enough of a challenge. We complied, and mounted a Kaba Mas X0 Electronic lock on the Vault.
Everyone has a go-to pickset, one which is a mix of everything. We also bring Sunday’s best to dedicated sets. For example, Moki makes great picksets, which are even better with homemade handles. Or a shiny Multipick set, be it dimple or a dual-gauge set designed by Christina Palmer. Where the only part staged about the photo is to have all the sets neatly displayed.
We went to the Association des Crocheteurs de France conference in December 2022, and brought back a few tools and picks from France. We attempted to pick the Polox-5, and Fichet F3D. Both attempts made possible by the incredible work of Nitiflor, who designed and 3D printed these picks.
Jos brought a suitcase with Chinese locks, which was gifted to him for organizing LockCon 2016. At the time, these locks were unobtainable, and information sparse. The mechanisms are very intricate with 50-element wafer locks, and cores with continuous rotation similar to the Yuema 750, an implementation we have yet to see used in Europe.
If this blog sparked interest in lockpicking, or if you have been picking and would like to join a meetup, please contact us. We are always welcome to new people, be it to teach the basics or to share advanced tricks. https://toool.nl/Gatherings