Hi everyone and welcome to DEF CON 2022. My name is Dorinda and I'm the co-moderator for this workshop. Up next is Eric Disha Bo. He's speaking about designing your best architectural diagrams. So Eric is Red Hat's portfolio architectural director and he's renowned in the development community as a speaker, lecturer, auto and baseball expert. All workshop contents is freely available online. You can find it in the abstract for this workshop on the DEF CON schedule. While the workshop is ongoing, you can interact with Eric in the chat here and if you have any questions, please write your questions in the Q&A section or you can request to share your audio and video for your questions too. Thank you and I will play the prerecorded video. After that, the room is over here is Eric. I think I have the URL scrambled so I think you can go ahead Eric and can find the video. No problem. We were going to play a short introduction but let me share my screen here. So if you follow the link we put in the chat, you can also see it there. You see here we have designing your best architectural diagrams. This is a free online workshop. This is all around our architectural tooling. If you go back and look at the session we did this morning at 10.30, it shows you kind of the results of everything that we were using this for. What we've done is put this together and when you get in there, if you ever get lost inside here, just hit the M key and it gives you a nice table of contents on the left side that you can run around in and jump through. I won't do that now. What we're going to do is there's a couple of phases. The first part here, this is an introduction video. That's what I'm handling right now so you don't have to go watch that or you can look at it next time when you're at home continuing on with this. That kind of introduces what's going on and how this works. You're going to walk through several labs. The first one is just going to introduce you to the tooling. All the tooling is open source based on the original draw.io.net tooling. We've redeployed that with a configuration on top of it that includes all the icons and the templates for you to use to get started. So this is going to introduce you to that. So all you really need is a browser. As far as I know, it works on pretty much every browser I've messed around with. The only little point of worth noting sometimes it will, because of caching, recognize that you have something from before. So it will pop up and say, hey, I found something. You can either say go ahead and edit what you found or you can say disregard and it will go back to the beginning and let you pick a template and start all over. You're going to do three different templates. And then we're going to look at the asset library in the color palace. This is everything that's on the left side. That's the second lab and kind of walk through what those pieces and bits are. And then you're going to start creating the very first high level logical diagram. And this thing is going to walk you step by step through it. You're going to have screenshots going to show you what's going on. And you can do it in a tab right next to it or split screen your stuff. And then you have exporting and importing diagrams are kind of walking through how you can get what you create out either the entire diagram or getting a couple of the individual pieces. And then you can select an export. This is really handy if you want to put stuff into slides and things like that. We'll show an example using a Google slide. And you have creating a schematic diagram. So first the logical diagram very high level and then you're going to get down into pretty much like a physical diagram and we'll walk through the template and design something really simple for you. And then we're going to create a detail diagram, which is the final step. And that is if you want to zoom in even further on one individual element in the schematic, you can kind of enlarge it out and create its own example and look at that. So there's all three that we promised we were going to do. And then we're going to show you how to use some of the examples that are already existing. We have an examples repository with about 30 projects in it right now, which includes complete collections of schematics, details and all this kind of stuff. They're in all kinds of different verticals. They're in financial, they're in healthcare, they're in edge cases. It's in telco. There's all kinds of good stuff. So those are really nice to be able to import and get started with and get you kind of jump started on creating some stuff.  And then there's a few other tips that are involved in here and how to submit an issue if you have any issues around that kind of stuff. And that's the complete workshop there. I will jump in and show you really quickly the first chapter and then kind of let you go and I'll hang out on the chat. Probably not going to finish this whole thing in the half hour we have or 30, 40 minutes that we got. But you can take all this home, right? This is all available online. So feel free to continue on and reach out to me at a later time. You see here that you have a link down here for the tooling. If you click on that, it should open a new tab. And here what it's done is detected something I'm doing. So if I want to go edit that, that's fine or I can disregard it and you get the actual what we're looking for, what you will find in the workshop is going to say, hey, this is what you should see. You see here it's got the thing there. So what do we do next? We're going to select from the template red hat template here on the left. We're going to select the logical diagram. Let's go ahead and do that and create it. And the tooling comes up exactly like it says here. So we've just completed the first lab. So that was super quick. That wasn't that hard, was it? You'll find every single lab includes a reference at the end where you can find the workshops, the diagram, tooling link, examples for the diagram repository. So might be worth jumping over to that really quickly. Let's go take a look at that so you can see what we got. This comes back later, but you see here there's an overview of all the different stuff that's available. And if we picked something like a healthcare one, it's a collection. You'll find it has this one here and it has the ability to load stuff straight into the tooling or you can download the diagram file. And you see some of the images have increased. It's some pretty complex stuff so you can get started really quickly by importing one of these things. You'll get that in a lab in a minute, but it's worth exploring that stuff. So after you do all that, you get every time they say if you have a question because you might be at the end of the lab and have a question, you can reach out to me or Eshoo is the other guy that did this. And then it goes on to the lab too. You can just jump right to it. And you can see where you're at. This is where you should be. Then you move on and start following what's going on. So I'll go ahead and leave you guys to that. And I will go stop sharing right now so we can hang out and stare at each other. And if anybody has any questions, you can throw it here into the chat. I'll go ahead and do that. Or is it in Q&A? Hold on, someone's got something in Q&A I think. No. In the chat. I'm just going to hang out over here on the chat. So any issues or questions? Let's get here. And since I can't see what you guys are doing, normally when it works out I'd be walking around and looking over your shoulder and having the chat and all that kind of stuff. So feel free to share your camera and jump on here. If you want to share what you're doing, or if you want to just chat with all of us. See if I recognize anybody in here. Hey, Linca, you're out there. You should share and come chat. I know her. Who else we got? Hi, Ricardo. That's cheating because he's part of the team that developed the tooling. So I'll just go ahead and I'm going to go back and share my screen again and I'll show some more of the asset library we have and a lot of the stuff that we got going on here. So where was that? So you see here, when you open up the tooling, for that first thing here you have an example view here and you have a second tab here at the bottom. That is showing you the actual template. And this template is what you're going to be using to develop your logical diagram. And when you do a schematic you're going to get a different template. They always come with the kit apart. It gives you an idea of what's all available in labels and stuff like that. That's cute. But you have the started care of Canvas here and you'll be able to use different things here. You see here you have that application icons. You have service icons. You have infrastructure icons. All kinds of stuff. And then down here at the bottom you have detail diagrams. If you hover on these you'll see these. These are for the details. We're not going to do that in this one. These things here are all different kinds of services. It depends upon what you're going to do. So if I'm going to do one of these application service icons and I want to go down here and use the application service here. Drag it over here and you can deselect it. Grab it. Drag it over here until you see that it matches the template. Drop it on there. And then you can, I think it's control shift down or to be back, yeah. It goes to the back and then you can select this thing at the front and we can delete that. I think we can delete that. It might be locked. So you have to use command L to unlock it. There we go. There we go. Well, I dragged the whole thing away. That wasn't the idea. It didn't work that way. But the fun part about this is, it doesn't matter where you are, it already got rid of it. So there we go. And you would drop in a few different things as you're designing and you see how they get all kind of caddy-wampus using a complicated word. And these are, for example, some of the things you're going to use. And you're going to put this right here. And if you notice when I select that, you see this red around it. That means that it's locked. And that's also in this stuff. But here's control L or command L if you're using a macOS. And you can delete that background thing. You can use this here to size up. And then control shift B to go to the back. Or you can just right mouse it and say, I think I unlocked it, didn't I? Yep, unlock it. So you notice if something's locked when you select it, you see there on the right? Unlock it. Now it's available to be changing the color, the style, the lines, the text, the words, the range, the different stuff. We're not really going to do much of that. I never really do. So that's a hint. So if it's locked, you can't get it. And if it is unlocked, you can. And you can right mouse it and go to the back. So now we have all these things here. We're giving it a label. We're calling this my dad of cooling or whatever. I don't care. Now select and you shift and select all these. And there's a really handy thing up here says a range. And we can distribute these things vertically. So it'll separate them with the same amount of distance. And we can align them to the left edge. So they're all aligned to the left. Kind of nice. What gets nice is when you have one over here and one down here. You have a couple of these that you've made and you want to get them all lined up so they're all matching nice and neat to this one down here. So it's kind of nicely centered and happy. And I don't want to mess around. Select them all and say a range, align to the bottom. Those are handy. When you get to the point where you're going to drop something in here we have some kind of services. This is going to be my cloud service. You see that? That's a locking. So you're going to drop it in there by locking that. So if I go over here like this, it's not going to work anymore. Now I got deleted. And now it's been locked. Unlock, delete. You have to drop it straight on there by holding the mouse down. And now it resizes and locks into that spot there. Select this and double click and you can start doing whatever you want in there. Cloud service.  Go over here to the palette and you can make it green there. And we can make this a containerized service again. But you don't want to lock that in here, do you? Then you end up with that. That's not what we want. You got to make sure you lock this with the right part. So if I select that, you see it's red and I'm not getting anything here on the right. So it's locked. I need to unlock it first. Then I'm allowed to change this over into the cloud service now. So that's how you're going to be working with this one. Somewhere along the lines, you're also going to see if I just hit reload, this thing is very capable of keeping track of what you're doing. And you see the save button up here in the right corner. But if I just reload it without saving, he's been doing bookmarking for me. He pops up with this and he says, I remember I go back to the basic templates again and I lose my work. But if I do edit diagram, I'm going to look at my canvas, everything's there. It's pretty hard to make a mistake even though you're in the browser. Hit the save here. You can give it a title and it'll actually save a file locally. But let's reset this thing. And let's say I'm going on to lab two. And now we're working with the schematic diagram. You see here again, you have the kit of parts and all the stuff that you recognize. Starting canvas is a little different here. Got placement guides. I'm not using the detailed stuff. You can close that. I'm not using the scratch pad. I'm not using the logicals anymore. I'm using schematics. One of these things is what we need. Drag these on here somewhere. Put it right over the placement spot. And what's nice about this is he has a lot of things going on. So these are for the networks. You can draw network things on here. You can learn how to do that. Same story here.  Make sure you do the right lock button. Select this here. Not the text. And go over here and give it the right color. And you can call what kind of technology this is. I don't know. Fun times. Node. JS. This is right here. We have as many as we want because it's in a container platform. And if we have a second one over here this one might be an event stream. Where was that thing at? Where's our bedstree? Here it is. Lock it in. Give it the right color. Give it the right color. And that's a wrong color. That one. There we go. And we can also zoom in on this stuff. 200%. Makes it much easier to see what's going on. You can see if we take this and go to the back. Oops, not that. Select the whole thing. So here you see a little bit better that when you hover on these you're going to get a line. And if you push down and pull now I got a line. The black one we don't really like that. That's a data line. But you also have down here various colored ones. So let's say we want to use the blue one. So you can select one. You see here on the side you can set it as a default style. You can just delete this. We can say okay this thing now needs to talk to this one. Right? And you can drag these things around a bit. It's proper. Whatever's going on here. You notice these three are used for networking. These are used for input data and output data. So now maybe I want to change to a data. So I will set that as the default. And I will say this one you're going to send some data over to this one. You're going to lock these in. And I don't really like a lot of jump in lines, right? I don't know how you are about that, but I hate that. So over here you have these little arcs. So you can see it if you want to leave it like that. But a little bit of magic, a little bit of thinking, a little bit of triggering and jiggling. You can make stuff look really nice. You'll notice now here if we go back to reset view, it will give you the big overview. If I just say go to 50%, it will go like that. If I say go to 150, it goes in like that. So you can imagine if I'm at the normal view and I'm over here trying to say hey, there's an event stream that's going to send something over to wherever to something else. Or out here we have our nice user. Let's get rid of this. Unlock it. Get rid of it. Unlock it. Get rid of it. Give him a device to talk to us. And we're going to say that he does a straight call into here. Which would be a bit odd. And we're going to bring this to the front. So it kind of hides it in there. You see now we're missing the arrow on that side. So we can go over here and say okay, we want the same kind of arrow. And what happened to our arrow? It's really hard to line this up. I see, right? So let's go down to like 300%. And we can see what's happening. So if I start playing with this bit. See that there's something messing around there. So let's bring this down to here. It should straighten that all out. There you go. And that's really small that arrow. We can make it a little bigger. Let's make this one bigger. It's all pretty. And as you can see, there's a lot you can do with this. I'm just kind of playing around right now. But if you follow the diagramming, you'll see what's going on. So there's your schematic stuff. And we have another option if we just re-do this and say reload and say don't save it. So you really quick the detail diagram. Our placement guide and the detail diagrams. We can do our cloud service application. Call this thing. Occasion is going to be a container one. Again, it has all these lockable things. You see here there's some network details and stuff around this. Let's use this one over here. Use a purple one over here. If you don't need one, you can just select it and delete it. And say you do something wrong like that. Then use command Z or controls it or whatever and it'll, whatever it happens to say up here for undo. And you can get it all back. So it's not much you can really do wrong here, right? And then we can say what kind of technology this was. Java. Maybe using some node S. And you see that it's talking about virtual with these dashes so we can change that to money. There we go. You see here that the line was dashed. Now let's just make it a solid line. And over here what we like to use these for is, for example, this is taking use. User request is coming in and it might be sending an event stream out. Right? So it's going in my example that I just created coming to an event stream and maybe that's all it's doing. It's just an inbound application which is kind of not probably what it's going to be. You see we can delete all stuff we're not using. And then you can talk about how this is my Java and node. We don't want to do that. We want to say something like this is application to the systems. And then we say one, two, and because it's on a container platform, right, we can give it a nice name. There you go. And for example if you want to select this whole thing you can go up here and this comes later and one of these things you can export it as a PNG. Any other thing you like and only my selected item I don't want this whole diagram and then export and what you're going to see is what I'm going to get as a file.  I'm not going to do it now. You see a lot of possible connections to Google Drive, GitHub, and stuff like that. As long as there's not any crazy authentication involved you can go directly into your home things and go to your device and just download the file. I'm not going to do that. Let's say we wanted to go to an example repository and we wanted to import that healthcare thing I showed you really quick and this one is called iDAS here. What we do is we take this URL and copy it because I happen to know that's the file and I can go up here and I can say import from URL. This will be the last thing I think I'll show you. I think we're going to run out of time. Look what happened down here at the bottom. You have the kit apart to the thing we're working on but now you also have all the different things that we were using for that. You can go right in here and say I'm going to start editing some of this stuff and get rid of this. I don't want this thing. I want this. I'm going to connect this straight through to something else. You can do whatever you want with this stuff. Export it, save it, do whatever you want. We're more than happy if you're doing something interesting to have you submitted here. Feel free to reach out to us here and you can use this as your centralized collection. We're happy to take almost anything. We have product demo stuff in here. We have lots of different things in here. Telco, all kinds of good stuff. Lots of lots of information and projects are in here. It gives you that get lifecycle, right? Okay. See if I can stop sharing again. See if we're doing in the chat here any questions. Yeah. Differences between a logical versus schematic diagram. Best time to use each. Well, basically we try to use all three. The logical diagram is where you're doing the functional collections. So you do know this, for example, this has absolutely nothing to do with Toga for any of these certifiable standards in the architectural space. We wanted something that is conversational, intuitive and very flexible to do a generic architecture based on multiple customers that we research. So taking individual specific things, comparing them to each other and then up-leveling that to something like that. What you see in the logicals if you explore our examples is they happen to be non-technology specific. Each block, each element is talking about what that group of components would eventually do. So you see a little bit more generic terminology and you see collecting, like one's going to have to be a container platform. And the idea is that we're presenting these to architects and people that have their own infrastructure, their own architectural choices, their own legacy issues or whatever they have and to be able to map a logical diagram to what they have to make sure that they have the right components in the right spot for success at scale because we've taken these off of people that have done it at scale. And then a schematic diagram tends to be when we drop down the end and we show a specific case worked out and you'll find the logical diagram elements named again in there and then you notice inside that schematic diagram, when I drew that, there's a place to put the technology, somebody put Java and Node.js in there, for example. You can indicate what's possible. Most of the ones you're going to find that we've done, we try to map open source technologies and our products if possible. That's if you're doing a green field. If you're not, I mean, if you need mainstreaming, there's a lot of options for mainstreaming if you need to use application and development tooling. There's a lot of choices out there. It's up to you to be smart enough to figure out by looking at that. So you also see the schematic tends to look a little bit like a workflow in the sense of this is how the architecture is tied together and we like to do two different ones. You saw me do the network and the data together. We really like to do one network in one day to just keep the lines simple. So only with network lines and only with data. So I hope that answers your question, Stefan. It's too much of a tight bite away. Okay, there we go. So I hope you guys are progressing with this and doing something with it or it's awful quiet. Kind of the bummer of these virtual sessions, right? Quick example of the export. Sure. Let me get back to sharing my screen again. Okay, so we have if you guys can see my screen we have all this stuff in here again. Let's pick a different one. I'll show you what happens here. So if I selected nothing at all it's basically we're going to try to export this whole diagram, right? So we're going to put it in as a complete slide and so I just do PNG. I zoom into 300 and we found this gets the best results, right? It gets it's not dependent upon what you're viewing it's just zooming the diagram out a little bit so it's a little bit more detail and so 3001 diagram and you see what you're going to see and then we're going to give it a name. I'm just going to download it. See downloaded here if I open it there you go and you see it's a pretty high quality image and this you can import into anything and use as you see fit. Now I can imagine when you do this into a slide that's kind of crappy. What's nice is what we do with our slides and we do that we'll put this in as a complete slide and then in the speaker notes we'll put a link to opening this up in the tooling. So from the slides you just click on it it opens a tab and you're sitting right where I'm at now so you can go in here and start editing stuff. Let's say we want to do the API management one. See I moved it a little bit but I did undo and it's back. So I select you see the line around it let's see what happens when I go to export this one is a PNG only when I select it not the entire diagram export you see there and I will download it and if I open it there you go and you see it's a pretty big clear thing so I'm able to resize that inside my so when you import that it's just the image so I can resize that as I like so we take any image or any piece or whatever so maybe I want to do this this this and this so I've selected all those using shift and I can do export as PNG and there's lots of other formats in there I'm just doing an image file so I can show you easy download and get another download here open there you go I have a subset example of mug use so stop sharing and see if that does that work this tool is pretty nice it's pretty well put together pretty easy to use we're actually hosting it what you're looking at our configuration is in GitLab and we have a build pipeline that then pulls in the base open source project, runs our configuration to include those oh that's something I can share a little bit but it includes the palette and all the templates and stuff let me share my screen again so over here I don't know if you noticed or not but if you look closely there's these X's right and scratch pad and stuff so let's say you wanted to do your own little thing it's kind of fun to drop something over here and now I have the ability to well that wasn't a good idea see what I just did so I had all those things selected and dropped them on here so I have a subset now that I can use everywhere but let's say you wanted to add out a reporting services so you can you can select that and drop it on here and watch what happens you know how reporting services that I can use multiple times so you can do your own thing you can give it its own name you can export it you have your own list and then you can add it into anything you want so if you have this export it's going to give you a file and you're able to import it into here sometimes what happens is you'll get excited and click on the wrong things let's say I do this you're like ooh now what so you think oh let's reload this and that's not going to fix it is it because he remembers what I was doing right so what we're looking to do now is reload it and this should get us back to clean version but it doesn't right so this is a caching issue it's still gone so what you also can do is open an incognito window or whatever you call your private windows where there's no caching and you get this back so depending upon your browser behavior you're going to find out whether or not you need to clear your cache this occasionally happens with stuff like that you can try to close so I tend to often work just from the incognito stuff just to avoid getting crazy stuff like that right and funny enough I mean like we start doing stuff like this and whatever and giving it names and colors and things like that and then we do that and you think oh this is never going to work right but he still knows what's going on in my my little thing here so he's good at that right incognito is nice because when I throw it away then I can just open another incognito window and I have all that back so this can be an issue I mean that's something that you want to be a little bit more careful about oh another thing that's interesting down here at the bottom is add more shapes they also provide all kinds of good stuff here so if you like AWS stuff if you're into the IBM stuff the IBM architects use this also this is all part of their garage stuff you name it there's so much stuff in here so if you want to get really funky you can do that all I'm showing you is our little subset of stuff to keep it consistent and our starting canvases are based on these things so if you use something different I'm not sure exactly what you're going to do but whatever you say you pick one of these things and you say you want to use Azure stuff and you say okay apply it what it does is it adds another should add another thing in here somewhere where is it oh I didn't check it hold on Azure check it apply and then I see down here I did it twice I guess I did it right so you see I have the Azure stuff which just means that I can now make a service like that I should be able to drop something in here and then lock in there so no guarantees what that's going to do as far as our templates it's going to look kind of bad for that kind of stuff so maybe you'd have to come up with something different I don't know do white only or something but anyway just to be just to have some fun okay I'm going to stop sharing again any more questions out there from anybody Ricardo are you done yet you completed the workshop one of the other things you will find I can show you also here we go another question so the session data that's stored during editing is that stored locally in the browser yes it's using browser cache quite extensively so that's usually what's happening when you open it back up and once you've done an actual saved file I can show you that but if you save a file you get a draw.io file in your whatever your download directory when you restart back up he'll say I found a draw.io file so I open that so he's smart enough to figure that out by looking at your local directory that's based on your browser wherever your browser does it's downloads it used to be in the beginning when we first started this four years ago it was a rather new tool and caching was quite an issue so most of the answers were clearly cached so I got tired of doing that if you want to be safe about it I just use incognito or the private browser or the non-history one and every time I open it back up or open one of those links from the example repository just do a right mouse and open it in something without the caching I prefer that because funny enough if you happen to close it and open it back up it seems to find the file he just won't find your your cache stuff in the browser anymore so you won't be able to find back when I do a reload he has it in that cache for that private window but he doesn't have it if you close it and open it back up that's the only difference between the two ways we're working I really don't get caught up in it too much it's pretty good a lot of things with this it's not out there on the internet as far as I know but you saw that there's a possibility to connect your github or to connect to whatever those things were a quick look at the tooling here we go you can do google drive github, gitlab all kinds of stuff you can import from a URL just like we did or you can import from a file all kinds of stuff should be able to make some pretty interesting diagrams I wouldn't put confidential information but there's also a desktop version you can download I don't do a lot with that I don't really know what this quality or what that is for your particular OS something you just have to try I have none of those connections set up, no gitlab no google drive, none of that so I want to be really honest I don't know how you would deal with all the versioning inside of google drive inside of github, gitlab it's not like you're forking, branching all that kind of stuff merge request I've just stayed away from it it's just too much of a management issue so what we do is the work cycle would be that I have in that example's repository I have something I've checked out it's a dry old file once I save it it's been modified so then you use the git tooling in the background to push that up and merge request and merge it in we tend to export the images you saw and those get put into a directory so that they can be shown on that readme when you get down into the adoc stuff gives a little bit of an overview of what's in that without having to actually open up the tooling and that kind of stuff and some people out there in the field that are trying to do sales stuff and they might just want to grab a whole image there's no need for them to do export stuff that's more for us nerdy guys and girls that like to do that for their software development or for their architectural descriptions and their projects and stuff it's quite flexible so we've got about 8 minutes and again anytime you want to stop while you're working on the workshop like that with the tooling just save the file and come back to it later and pick it up it's not going anywhere we occasionally do updates to add new icons and stuff like that and our pallets on the left side there if I do that then I go through the workshop and update that so it all reflects if you find something that doesn't please reach out happy to do it well I see we have okay can you wrap it up? I'm good so can we wrap it up now or should we wait so the guy coming in sure no problem thanks everybody okay thank you very much Eric and thanks to everyone for participating in the workshop if you want to continue the discussion you can meet Eric in the Walk Adventure platform okay


So welcome everybody for the talk replication prohibited this talk covers the subject of 3d printing and the state of physical lock security Our lovely speaker today is Eric Westrow. He just flew in from the States four days ago. He told me and he's still jet-legging He's a student of computer science engineering in Michigan USA and please give him a warm round of applause and enjoy the talk Thank you very much Thanks, thanks everyone for coming so early on the last day I'm Eric Westrow. I'm presenting a research on replication prohibited, which is our research on three printed keys and It's impact on high-security locks This is joint work with my co-authors Ben Burgess and J. Alex Halderman from the University of Michigan so We're talking about pin tumbler locks, which I think is appropriate for this Congress given that the the theme is gated communities so Take take that what you will but I see locks as sort of the the gatekeepers for the sneaker net of things If firewalls are the gatekeepers for the Internet of things and that's what these are for for this so Just a brief overview for those that don't know pin tumbler locks have You know these pins in them that? Only open the lock if the correct key is inserted if the wrong key is inserted then The the cuts on that key only lift the pins to different heights and one or more of the pins will block the inner plug from rotating And the lock will not open, but if you put it in the correct corresponding key Then you will be able to open the lock The the pins will be lined up along the shear line and broken along the shear line and this allows the inner plug to turn Now of course, it's important to remember that that keys the secret information is encoded in these cuts if you can Ever, you know take a picture or or absorb someone having these these cuts on a key Then you can figure out how to open the lock that that goes to and there was an attack in 2008 that sort of Generalized this and went a bit further and said that you know You don't have to just worry about people next to you and very close to you that can see your locks You have to worry about sometimes people very far away that have telephoto lenses and cameras that can take pictures of high resolution From across whoops from across entire courtyards Where you know you can sort of see from from some roof level There's some keys sitting on a book that's barely visible by the naked eye But you can actually make out the cuts on this key from this image There's some you know tricks to transform the image so that you can actually see it straight on rather than at this Weird angle, but nonetheless this is possible to do and they demonstrated this in this work Of course, there's also bump keys, which is a common attack against pentumber locks that have You cut a key to the lowest level and then put it in the lock You give it a sharp tap and this bounces many of the pins up And if you turn the key at just the right time, then maybe the plug will rotate as the upper pins clear the shear line just for a split moment and And finally, I think one of the most interesting attacks For pentumber locks comes out of master keyed systems as unique to master keyed systems and in a master keyed system You have multiple keys that can open a single lock So say I have my key that opens my office door at the University of Michigan And it only opens that one, but the building manager has a key that opens every door in in the building and How this is accomplished is there are actually multiple pins more than two pins in each stack And and eat and you have different pins that correspond to each of the different keys So my low-level change key that opens just my office door Can can have cuts that correspond to the red and the green pins Whereas the master key that opens all the doors has cuts that correspond to just the red pins And in 2002 Matt blaze published this this privilege escalation or this right amplification attack That's unique to master keyed systems Which I call the blaze attack. This is an attack that allows a An attacker to that has just a change key just a low-level change key to query their lock and Learn what the master key to the entire system is And to give you a sense of how this works Walk through this this illustration So again, I have my low-level change key that opens just my office door and it operates these the red and green pins at the shear line And so what the attacker does is it takes this key and makes a Similar copy to it that has all of the same cuts except for one pin one pin is different It raises it to the to the highest level and the attacker puts this in the lock and tries to open it And if and sees if it opens it in this case It wouldn't open the lock because this red pin is blocking the plug from rotating So the attacker removes it files it down and tries it again and continues doing this until the lock opens And because all of the other pins are still kept at their old position that would normally open the lock Once the attacker is able to open the lock. They have learned what the master cut is for that pin position So they can repeat this for each then iteratively of the pins in this lock with different blanks and different different key cuts ultimately Revealing what the master key is to this entire system so One more thing to note about all of these attacks Is that you have to find some piece of metal or some piece of material that can fit into the keyway of this lock keyways of locks are Designed to be a little bit difficult to get into both for to prevent lock-picking make it harder to get tools into it And also to make it a little bit more difficult to to get blanks that can actually fit in these locks So for a lot of these attacks for bumping for making unauthorized duplications and for privileged escalation attackers really want to have key blanks that can fit into these locks and For most of the locks that that we we encounter this is very easy You can just go to say a hardware store And and buy one of these blanks and actually get it copied from from the dealer And there's no control or anything like that that's going on and in these open key systems One layer above that there is duplication Prohibited keys where you can still buy them online things like best keys and so forth And there are manufacturers that sell them But you may have a little bit harder time finding locksmiths that will duplicate to them or cut to them But nonetheless, it's still possible to find them. They're just more rare But finally there is a step above duplication prohibited which is restricted keyways where the Keyway itself is often patented or controlled or somehow specifically and custom designed for each system by the lock manufacturer and this can be system specific in a way that The lock manufacturer and the locksmith that deploys it have some kind of contract where only that locksmith can buy Blanks that fit that particular keyway and they have some key card that authenticates it to to buying that And so you wouldn't be able to buy these blanks online, even if you you know knew what they were To to further make this more more difficult for attackers to find these blanks these key designs are often patented So that if someone actually was able to manufacture some of these keyway keyways for popular restricted Keyways then they wouldn't be able to legally sell them without infringing on the patent so if you're an attacker and you want to Still get access to these blanks you have a couple of options at your disposal you could try to custom manufacture it yourself right you could go to a CNC mill and you know measure out the the key that you're trying to copy and You know just drill this down from from some stock metal or something like that And that certainly is possible for most keyways although some keyways try to make this more difficult by having crazy undercuts and things like that that are difficult to replicate on CNC mills But in general this is going to cost you know some amount of money and take a fair amount of skill to do in practice There's actually a machine that will do this for you called the keymax easy entry And this is a pretty cool device You just put in a key that you want to copy at the top It has a little probe that comes out and measures different parts of the of the keys thickness And then has a second part that has a CNC mill that cuts this smiley face key blank into whatever key that you put in in the top Now this machine is not cheap. Last I checked. I think it's about 7,000 euro But it's you know something that could be useful for attackers if they were you know breaking into banks, I guess So finally there's 3d printing. This is something that's becoming much more consumer available I've seen several 3d printers here at Congress and and and 3d printers are really sort of a fast You know innovating thing that's going on and and rapidly improving The state and the strength of the materials that they can print 3d printing still requires some amount of skill But the tools there are also improving that you can find these these free tools to model things in That makes it much easier than than it used to be so One question is if we print keys in plastic or in whatever material are these printed keys actually strong enough to use in practice To answer this question our group performed an experiment on a number of different keyways we modeled several different keyways of keys in plastic in Acrylic in nylon and in several different materials including metal and We took them all and put them into locks and tried to break them off with the most expensive screwdriver that I have ever purchased in my life It has it has a USB output and it tells you how many inch pounds of torque is being applied to the screwdriver And the one redeeming quality of this screwdriver Besides its price is it had a generous return policy. So So we use this tool to measure how how how much torque each key could take before it snapped off in the lock And the results surprised us we printed keys on a maker bot using PLA and this you know It would cost pretty cheap for for each key now the maker bot itself is not 8 cents But it's a couple thousand dollars But nonetheless each individual key that you print off of that is going to be fairly cheap and to our surprise This key was strong enough to open most of the applications that you would come across if you were using these keys in practice So we rank these four things opening a door latch, which is just a very sort of light spring at a couple inch pounds of torque all the way down to a crash bar where you're actually physically pulling in one of those Sort of massive crash bars from the outside with just the key And to our surprise the PLA was actually able to do most of these We mark pass if all of the keys were stronger than the torque it took to open one of these So all of the all of the keys that we tested were stronger than say the torque it takes to open various padlocks We marked it fail if none of them were strong enough to open any of the tests of opening them And we marked it may fail if some of them passed and some of them didn't so we also tested nylon and acrylic And these are two different materials, but they had basically the same results despite being sort of having different failure modes and properties nylon is a very stretchy material and acrylic sort of just snaps off and lock and Despite being more expensive and coming from actually a 3d printing service These were much weaker than the PLA originally And these this probably would not be used in any kind of attack that you would want to do We tried alumide, which is a slightly stronger plastic that has some sort of aluminum filings mixed into it and And this was a little bit better. It's you know, three dollars per key So it's still pretty cheap and it's able to open some of the weaker Components, but it won't open a crash bar or some of the padlocks that we had testing on this But alumide also had this this bad property that it had the very rough surface to it It almost had a sandpaper like feel to it So when you were putting it in and out of a lock it felt like you were grinding down the brass of the lock So you might you might actually damage it ultimately if you use lots of these and in locks and then it might also break off Finally we tested a couple of metals several metals actually stainless steel and brass And and bronze as well, but it was the same as brass Which is something that you can surprisingly Print in three dimensions with with these services You can go to these services and and give them a CAD model and they'll ship you that same object printed in whatever metal you want You can even print it in gold I guess if you want to match your Apple watch or something So When we tested this in practice the metal does cost a little bit more of it's about ten dollars for the stainless steel or $30 or so 25 dollars for the brass of that amount of metal in in in brass And this works flawlessly this opened everything that we had access to and then some it was about half as strong as the Real blanks that you would buy from say a hardware store But that's still in order of magnitude stronger than you need to to open many of these locks in practice And as an anecdote I've actually been using a brass printed key For all of my opening my office door for the last few years and haven't had really any problems with the brass one Though I will note that the stainless steel one is a little bit rough on the lock in part because it's actually stronger than the lock Which is made out of brass so if it's not quite perfectly aligned you may actually You know break some of the lock in some ways and I believe all the locks that had regular stainless steel key use Had to be replaced ultimately so But what happens when these keys break off in a lock is is kind of important and how these keys fail So I will just you know note that the things like acrylic or things that are very brittle have these really bad failure cases that you're Turning it you're turning it and then all of a sudden it breaks And now you have this piece of plastic stuck in this lock and it can be very difficult to get out if it's PLA I'll note the best thing to do is to remove the lock from the door Soak it in acetone for about 12 hours then take some roving alcohol mix it out Put it back in the door and hope that no one notices your door smells like paint stripper anymore and move on with your life But things like brass fail much more gracefully They you can actually turn this and feel as it's as it's bending and You know in many cases we were able to turn these brass keys more than about 90 degrees before they failed completely So it's very obvious that this thing is is is breaking and not going to open this lock And you can feel much before you would you know need to get out your broken key extractors If this were to snap off in the lock So how do you make these models in the first place? I mean have we just punted the the skill to making these models at all well in some ways? Yes, but the the modeling tools are fairly good Autodesk inventor is is one of the the software packages we use It has a very fast learning curve. It took us about a night to learn and and print Working keys despite not having any background in in this kind of in this area Solidworks is another tool for this but those both cost money Autodesk has this nice feature that you can actually put visual basic scripts in it So you can just put the key cuts that you want to do and it will you know This program will execute and cut the key down to whatever combination you want Which is handy for testing On the free side of things there is a 3d modeling tool called open scad which is pretty cool It's entirely sort of scripting base you write out a program that essentially describes the object that you're trying to build So you build you know spheres and Rectangular solids and you take differences and unions of these until you get the desired shape that you want And so this is pretty cool for for people that are used to programming But it does take some skill to you know write out this code in the first place So what we did to sort of demonstrate that this is even easier than using those tools is we made an automatically Generating 3d model program this program takes a single picture of the key way that you're trying to make a model model for and produces that model in in in cad basically from this image You can then take that blank and print it on a 3d printer or ship it off to shapeways or I materialize or whatever your 3d printing service that you want to use is and Have it made for you pretty cheap. So how this tool works First you take an image that can just be taken from a smartphone That's straight on of the lock that has a good view of the keyway itself. That's you know, sort of the darkest part of this image and the next thing that the tool does is it tries to threshold this this image into various Places, so it tries to threshold it into a black and white image entirely So if things are more than 25 in in magnitude out of 255 Then that pixel is black and otherwise it's white and same for all of the other ones And so you can see that depending on what threshold value we choose we get different sort of goodness of our Finding the keyway mask out of this image and 35 seems to be the optimal here And once we we find What the keyway Mask is then we that we actually once we find the optimal threshold rather We pull out this keyway by looking for the largest blob in this image So if we do that for all three of these we find that again in 35 We find the the best image here whereas in the other ones We find either not enough of the keyway or something that's actually not even related to the keyway at all But how do we determine that 35 value automatically? How do we make sure that that's not you know image dependent and so forth well one thing that we noticed that that was true across many different locks and pictures that we took was that if you looked at the area of The largest blob area that you pulled out from an image after thresholding There was this large jump in area right after you had sort of the optimal keyway mask And so you can see that here that if you look in the Normalized blob area it jumps right after 35, which is the optimal one for this value So that's how we determine What they what the keyway mask is we just go and look for that jump and say the value before that is the optimal value This allows us to pull out the keyway mask and we found this to be fairly robust we tried some more complicated things that I won't get into the detail of for for computer vision sake but We found that this was this was surprisingly effective in practice So once you have this this keyway mask We have a program that then takes this mask and generates some open scad code that will Essentially extrude this into a 3d model and places a bow on it that you can then you know put on a key chain and Carry around with you So finally you get your 3d model of your key And optionally you can provide cuts to this this program so that it can cut it down to whatever You know key that you want to open whatever door that you're trying to do And if you're trying to do say a privileged escalation attack Maybe you make you know seven copies of this with different cuts on each one so we released this tool as open source and It's available on on keys forage comm as a demonstration you can actually go and Try this out you just upload a picture and optionally provide the key cuts that you want on Whatever key you have and it will produce this stl file that you can download and then 3d print so What can you do with these 3d printed keys as we said before there's these these three main attacks? Teleduplication and bump keys and privilege escalation, but what have people been doing with 3d printed keys in practice? Well, there's a number of people that have printed keys We're not the only ones that do this and we're not even the first people to have publicly done this In 2013 there was a couple of MIT students at DEF CON that printed a slage primus key Which is a moderately high-security key that has actually two sort of cut? Sheer lines on it that they replicated using Open SCAT actually and and and and published this code so that other people could make Slage primus keys as well That was again a custom modeling of just that one key way and they printed it using iMaterialize Which after this this all went public iMaterialize released this statement that said that it did not support 3d printing of high-security keys in particular They said that iMaterialize rejects any use of its services to promote activities or to create products Which pose a safety or security risk to others had they known at the time they would not have printed these keys Which is funny given that if you look at iMaterialize's Website right now under their platinum or sorry their titanium page They actually use this image as on their marketing page to show you what you can print with with their service More recently there was this picture published of the TSA master keys in some article For some reason I guess the reporter or whoever was being interviewed thought it would be cool to flash some keys And this picture was published and then later taken down, but it's the internet so it's you know floating around and here it is here So there's that This this does allow you to you know it's high enough resolution that you can actually figure out the cuts of each of these keys and someone did this and actually modeled all of the keys and And modeled this and published this Now I will note that TSA master key it sounds pretty bad But at the end of the day the TSA locks were probably not that high security to begin with There were probably ways around them already You could probably pick them in a matter of seconds or just bypass the lock entirely by opening the zipper with a big pen or something But nonetheless, it's an interesting sort of experiment and lesson in win not to show your keys on camera And finally the most recent study here is a tool called photo bump Which is very similar to ours which from a single image is able to produce bump keys of that can be printed in plastic and This was done late last year and the tool was never actually published It was just talked about at lock con I believe and I don't think they've released any of the code or anything open source But nonetheless a very cool tool that could make bump keys that that worked on some of these pretty high security locks That were fairly difficult to bump even with metal keys, but sufficient to work with with plastic So how can we defend against these attacks besides just shoving superglue in our locks and giving up I? Think there's a number of different directions that we can go in with this With with trying to defend against 3d printed attacks one is to look at non mechanical locks So electronic locks are sort of growing in popularity these days Now naturally that does bring in other kinds of vulnerabilities And you know now you have now you have other problems to worry about like replay attacks or or any kind of software Vulnerabilities that might exist in whatever protocols you're using But this this will scale pretty well And it won't have the problem that a lot of the mechanical locks will have when it comes to 3d printing attacks Sort of slightly related but a little bit more on the mechanical side of things There are a number of high-security keys that use active keys and keyways to authenticate that the right key is in the lock So in addition to say having very high tolerances and and pin tumblers and things like that This these keys like the multi lock can have actual spring components in the key that sort of you know fold in and then come back out at different parts in the insertion process And this might be difficult to Replicate with 3d printing given that most most of 3d printing at this scale right now is limited to Entirely solid fills and can't have these very intricate fine features in them And finally, I think magnetic locks are kind of an interesting sort of cool gadget The Eva MCS is an example of this this has magnetic pucks inside of it that actually rotate Physical mechanical things inside the lock that have to line up in order for the lock to open This would again be a little bit tricky to replicate with with 3d printing alone Although you might be able to do some kind of inlay thing where you put Magnetic things and and be able to copy a key remotely If you had say, you know a 3d printer and a good compass or something, but I think one interesting idea that I haven't really seen proposed for for Defending against 3d printing is trap key ways. So trap key ways are a pretty Unknown sort of thing in the lock world, but they can be used to Essentially trap a key in the lock when it's inserted So if you have someone say a contractor or something that goes away and and takes their key with them or something And you don't want them to come back at some point and be able to access whatever Door that they used to have access to you can install a different key way That's essentially configured to trap that key when it's inserted and turned in the lock And if if that happens you won't be able to pull the lock or the key out of the lock And the the lock will actually have to be drilled, but nonetheless the person will be stopped from from entering that that facility And this is useful for for unauthorizing old keys like that but it could also prevent privilege escalation and other attacks that are enabled by 3d printing just by Being able to trap all of the different sort of iterations of the blaze attack that that might happen during that process So looking forward into the future. I think there's it's a pretty exciting time for 3d printing in locks We're really just starting to be able to make these keys that are viable in practice and 3d printing is only getting better It's only getting higher resolution and cheaper and more ubiquitous and there's more materials every day I think recently I saw that you can now 3d print in wood Which is pretty cool But all of this sort of improvement of technology is happening on the 3d printing side I don't see an analog happening in the lock innovation and to be fair locks are fairly old and and have you know Done fairly well in in recent years and in history for the most part But I am a little bit concerned because locks sort of have this intrinsic property That they're limited in sort of how small they can get because the humans that operate them aren't getting any smaller so on The other hand the 3d printing tools that we have are able to get smaller and smaller And so at some point I think we'll be able to do more of these active keyway attacks and things like that with 3d printing And moving even beyond that. I think that there's a lot of room for looking at Different ways that 3d printed materials could actually actively interact with the pins in the lock Maybe you could actually make a lock picking device that actually did a single pin picking inside of the device Using just something that was manufactured on a 3d printer That's probably a ways out But I think that that sort of you know combination of 3d printing and mems like devices Would would be a really interesting future for the combination of 3d printing and locks So with that I'll wrap up and be happy to answer any questions that you have. Thanks Well, thank you for this interesting talk Eric I'm fairly sure that this was the magic moment for all the lock pickers present and the highlight of their Congress So if you have any questions, please move to one of the microphones we have here in the room I was told that we're only using the four microphones that are down here with the numbers one two three and four If we have questions, please move to the mics Even the internet is not awake yet. We don't have any questions from the internet. All right, but we have a question at microphone Number one, please ask you a question That's the tool include taking a picture from a key and then make it or only The key way so is it able that I can photograph your key from here? It only does it from the lock so because it's using the outline of the the keyway If you were able to take a picture of the end on view of the key Then perhaps you could you know photoshop that to make that the darkest part of the image and then use that to upload and Maybe you have to mirror it at some point, but That would also work. Okay. Thank you. Next question for Mike number four, please. Yeah. Thank you for the American locks are notorious for having bad tolerances. Did you try your? Findings with European locks for example with econ locks, which are pretty much better Manufactured than Schlager or some other junk So we did not try it on on those particular locks we did try it on a number of different key ways but The slaged ones that we tried it on were not the you know SC ones or something like that They were Everest and high-security They were often as fix so small format interchangeable cores Which can be harder to pick because they have the controls here and everything but in general It's it's all in the a2 system. So any a2 system key the 3d printers have enough tolerance and resolution to print at that sort of 12.5 mils per per cut All right next question for Mike number two, please Okay, thank you for the interesting talk And I was noticing that the key ways of the commercial systems seem pretty over complicated Is it possible to actually simplify them by replicating the keys? So is the question can you can you print simpler key ways and not the entire the whole thing? Yeah, right? I mean it yeah, they have details that don't seem to be necessary. Yeah So the the short answer is yes, and and people have discovered this before especially with medco There's this surprising property that there's that actually a straight line fits through the key way just fine So you can just you know stamp out sheet metal or a credit card or something like that You don't have to actually replicate any of the the squiggles or anything like that But on most high-security locks, that's not true You will have to get at least you know some corner or something that that actually comes And the key mark is a great example of that it has this very wide sort of leg that comes off to the side But in general yes, you could make something that's smaller in for 3d printed things You might not want to because it's stronger if it's thicker in different areas And sometimes that's part of the the keyway design is to make sort of these these ridges and and runners that make the key stronger Thank you. All right. Thanks after I bashed it the internet woke up and decided that it actually does have a question Yes, thank you. How's trade-on does the the picture has to be of the of the keyway or sensitive is it?  You don't have to stand there with a protractor or anything or any kind of guide It's a little bit tolerant because it will actually make a key slightly smaller for tolerance reasons to fit in the lock So you have some leeway there to sort of if you're at if you're at some skew or something like that But in general, you know just taking it straight on and eyeballing it. It seems to be good enough Thank you next question from Mike number three Yeah, did you notice that any lock manufacturer is for traditional mechanical locks? So no active components trying to do something to prevent 3d printing of keys. I Haven't seen anything concrete from the manufacturers. I know they have mentioned That they're aware of these attacks that they're interested in looking into defenses, but I haven't seen anyone that made any specific changes that are locks yet, but Given that it probably takes some time to actually, you know make these changes in practice I don't really fault them for you know not coming out right away But nonetheless these these printed 3d printed keys have sort of been a long time coming I think in the last few years and they're just getting more popular So I think it would be kind of foolish for for manufacturers to ignore that, but I haven't seen anything yet All right, I see someone at Mike number seven. I'm not 100% sure it's open, but you can try All right Have you tried to make a negative form and fill this up with some kind of resin with carbon or fiber in it? Are you make a 3d printing of the negative form and then build the key as the positive while filling up with some fluids Yeah, so that's actually how the metal 3d printed keys are manufactured by the service that that makes them brass is done With essentially a lost wax casting where the wax is printed a plaster mold is put around it and then melted the wax melted out And then molten brass poured in stainless steel is is printed in a slightly different process with You have this sort of centered stainless steel and glue resin that you print the positive of and they say it has the consistency and structural integrity of a sandcastle at that point that they then put in an oven and Fill the rest with bronze which then replaces the glue so that you have an all-metal key at the end or object or whatever you're printing at the end of that process We haven't tried doing you know that ourselves, but that's certainly what the the services are doing for some of the more complicated materials And it seems to work quite well brass has a really high resolution as you can see here This is a 3d printed brass key and the replication prohibited is part of the 3d model and shows up when you print this All right, we have another question from the internet. Thank you. I have two brief questions first one is Have you also looked at rotating disc cylinder locks and have you ever used a bs's material? I Printed a key on an ABS commercial machine And it was I believe not as strong as the PLA, but it was sort of comparable As far as as that goes it was it was still open able to open many of the locks And what was the first question? Have you ever looked at rotating disc cylinder locks? Oh Detaining distiller. No, I haven't looked at that specifically for 3d printing I think a lot of these would extend to that But there's probably different tolerances in sort of the z-direction that you can get for some of these printers part of the tricks here can be sometimes to Figure out what angle or what orientation you want to print the key on Because some of these printers will have better resolution in the x y direction than the z-direction or vice versa So you have to sort of play around and find what the what the actual tolerance is there But I haven't I haven't personally played around with that kind of lock Another question from Mike number four. Ask away. Okay You've been trying you've been testing a few locks, right? So do you think that in the future? We'll we'll see more like locks that with hardening steel or that have challenge response Authentication systems because from an emergency services point of view. It's quite important to be able to just drill them open Yeah, I Mean a huge important part of of of of locks is that they have to always work, right? If you you know run out of a battery or something like that, then that's a problem a lot of Electronic locks have solved that by having the key provide the battery so that you know, you know You now have a battery that's external and you can replace that But still that's kind of finicky because maybe your battery runs out. You don't have an extra one and so forth I Think that it's likely in the short term that people will go more toward the active keyways for at least the high security locks It's still expensive to do that. It's expensive to manufacture that and expensive to make in practice So it will probably be reserved only for the high security locks and most of the home locks will sort of have the same Same problems that they always did it will be interesting to see which institutions Adopt these higher security locks if universities say for example that traditionally heavily used say master keyed systems Will move toward higher security locks or move completely away from master keyed systems to avoid some of these these problems But I don't know have what will happen in the future Another question from the internet as it possible to use a metallic core and print the key around it Sorry, what can you repeat to use a metallic core and print a plastic key around this core a Metallic core and a plastic key around the core It would be difficult to do that It is so I have seen people on 3d printers sort of print some base layer of plastic Then print then then place something else say even a PCB or some kind of electronic or a battery or something or a magnet Even and then print the rest of the the PLA or ABS on top of that I Don't know that you would be able to do that with the thickness of these keys. They're they're fairly thin I mean the actual especially with all the key ways sort of wiggles and And so forth that it's kind of hard to get an actual very thick part that you could put something metal in One thing that you can do however is you can sort of leave out a gap in the back of the key And then insert a tension wrench there instead And so now you have you know all the strength of a tension wrench and the plastic key is just Operating the the pin tumblers and and raising them to the right height All right the brave person waiting for quite some time at mic number eight How do you actually get the dimensions of the key from the picture? Yeah, so in the tool that we use The dimensions are assumed to be in sort of a standard small format interchangeable core. So From that most of those are standardized to a specific height So you can just sort of take the top to the bottom and you know what that height is for more complicated locks you might Try and something that we tried to do early on was detect the circle around the lock out of the mortise And then if you knew how big that was either by measure measuring it or entering it in or knowing You know the standard sizes of mortises then you would be able to scale the image based off of that All right mic number four, please I'm quite excited. I haven't been thinking that line That it's possible to do that with a 3d printing I'm I want to look from a different angle like the one who wants to protect himself against any threat with Reasonable means financially, what would you do in my case I Think you'd have to define reasonable, you know financial means but You know if you're if you're running a master keyed system, then I think you would probably want to Either upgrade to a higher security lock or a different kind of master keyed system I know a male a Yale has a I think biaxial lock that has actually two different keyways one that up one that's for The master key and one that's for the change key And so then these privilege escalation attacks are not a problem for that kind of system I don't know the relative cost of that offhand, but I know that MIT has moved to those locks almost exclusively I guess they maybe had a problem with students doing privilege escalation or something like that But I don't know many other universities that have done that in recent years I think that's a good compromise for that particular attack But again, it depends on your threat model right if you're concerned about people copying your keys Then maybe you want to go with something. That's just restricted and say has active components to it like a multi lock or something like that Or if you're concerned about bumping or picking then you can find bump resistant locks or something like that as well May I add one more question? I've seen some people using number locks This is all not so good or So number pads, I mean they're kind of an electronic lock, right? It's it has many of the problems, but it has a limited interface So it's a little bit better than say something that's you know talking to your smartphone or something like that As far as the attack surface goes But it still has the problems of you know, if it runs out of a battery There's no backup or something like that. It can be difficult to to get in And reliability problems there and can also be hard to weatherproof them in some locations and Number pads in particular have this problem But if you only ever enter correct combinations on the number pad the correct buttons wear down more than the incorrect ones And so you you know have this side channel for learning What the correct combination is so All right, the internet is curious and has many questions this morning. Yes. Yes Have you looked at ceramic or epoxy like materials for keys? Sorry ceramic or epoxy like materials I Have not I don't know that you can print in epoxy But maybe you could do some kind of you know mold based thing and use that instead PLA I think was fairly good in part because it has this sort of sweet spot between being flexible and rigid Nylon was was way too flexible and just sort of bent like a rubber rubber band inside the lock and acrylic was way too Brittle and sort of didn't have any give to it and just snapped off. So finding that sweet spot is I think pretty important All right, any other questions you have another 10 to 15 minutes to ask the hell out of the speaker now That is here and you can get your hands on him. So any other questions? It does not seem to be the case and even the internet is satisfied as least for now So, please give another warm round of applause to our speaker Eric. Thank you


Imagine you have nine balls, I wouldn't be able to walk, and one is a little heavier. Oh man, I'm in trouble, I gotta go to the doctor. Sorry, you have to say it. You have a beam scale and are allowed to wait three times to find the heavier ball. Let's check this out. Let's read the other one too. The two digit AB, we've got a couple of riddles going on.  Hey, quick question. Serious medical aid right there.  So you've got nine balls, let's do it. One, two, three, four, five, six, seven, eight, nine. I love Spider-Man, we'll read your thing after this one. Can you explain all the calculus to me? Sure, calculus is an introduction of time into mathematics, so it's the rate of change. So going into calculus, if you're studying calculus, just think of it as time, rate of change. And the only absolute in life is change, so calculus is pretty damn important, right? A little heavier. You have a beam scale and are allowed to wait three times to find the heavier ball. What would you do? So we have a scale, we've got three times we could weight things. What would you do?  I mean the ideal thing would be you would break it in. What would I do? I would do this. Let's see if this is going to work.  And you would calculate per unit ratio. So you would weigh this.   But three times doesn't work. And you get this number, right?  And then what do you got to do? If you could do it four times, you could do this easy. Break this in half again. Wham. And then you know you can do the next one and you're done, right? Like a seesaw. Moving around. Oh, like a seesaw. So it's like this. Oh my bad. So that one we could do with four weigh-ins. Pretty sure. When does calculus turn to physics? Mathematics is just language, base language of everything. It's a beam scale. That's not what you call it. So we got this guy. So we got nine balls. So what are we going to do? Nine balls. So what would we do? Do we have to have all nine balls on the beam scale at the same time? We have a left and a right side of that scale. How is that scale? How is that? I don't know what it's called. I don't know what it's called. Just pit it.   Always count two of them. Pit it up and weigh the heavier half each time. You're free to do what you want. You're free to do what you want.  Four balls here, right? If this thing is level, whatever ball that was left out is your big ball. I'm just cracking up saying that, right? Twice you get the answer until you have the last. So you weigh it once. Four here, four here. I'm just exercising. I don't know if this is the answer. So if these are totally level, then that one is the ball you're looking for. If this tilts, then obviously the heavier one is going to be on the side where it's tilting down, right? So if this thing goes down this way, you eliminate these guys. Then you put two here, oops, two here and two here. If this one tilts, then you put one here, one here, whichever one tilts is the big ball, right? Twice you got the answer until you have the last two. Same solution, best case check. Cool, cool.  And when it tilts, you know that seems like cheating. That's true, Dante, you could do that too.  If it tilts, then one of them is to have your contains the heavier. So you could actually theoretically do it in two measurements. This one, if you're lucky, you could do it in one on the first go. You just put one ball on either side. If they weigh the same, you discard them. Repeat three. The kicker is. So one ball, once, twice, you could only do it three times. You could only weigh three times, right? Because it would be multiple measurements, so to speak. Okay, I got it wrong. You're allowed to weigh two times only now. Hey, you're changing the rules of the game. No, I mean you could start with one each and keep adding. But that should count as multiple measurements. Yeah, that would count as multiple measurements. That's what I would think too, right? So if you added those guys, if it stays level, then you gotta add more. You add those ones, keep track of what you're adding. If it stays level, you gotta add more. But that's already passed the two measurements, right? I swear, there's a similar problem about weighing 13 people with identifying one person being heavier. Yeah, I mean to use two on one side and don't need four at one start. So if you use two, if one is heavier, you got on the second one. If you use two, one is not heavier. How would you do it with two weights? I don't know how you would do it with two weights. Split the ball into three groups, Yucho. Three groups. Oh, split the ball into three groups. That's not a bad idea. Let's check it out. But then how do you isolate the one that's the heaviest one? Oh, because it's three. So split them into three, right? One, two, three, one, two, three, one, two, three. Take this one and that one, put them here. Right? If it stays level, then you know the heavy one is in this one. Right? If it tilts, discard this one. And then take two of these guys, put them here. The one that tilts is the heavy ball. If it stays level is this guy. Great. Break them into threes. Nice. Good. Awesome. Right? Oh, logic takes place. Yeah, break them into threes. Awesome. That's better. With the other way, if you're lucky, you get it in one way. Victory. Victory. Awesome. That was great. What was Spider-Man's little riddle? Spider-Man's real or Spider-Man's question. Let's check it out. I love Spider-Man. I love Spider-Man. Let's check it out. The two digit number AB stands for 10A plus B. Since the first digit represents tens and the second represents units. I'm already confused. If 10A plus B equals 7A plus B, then 10A plus B equals 7A, 7B. And if 3A equals 6B or more simply A, that is, the second digit must be twice the first. The smallest such number is 21. I'm just going to write down the equations. That's what makes sense to me. 10A plus B. 10A plus B is equal to 7A plus B.