WIP: How to clone high-security Medeco keys from a photo

This all starts when I get a text one evening from a friend of mine asking for help copying their house key. They recently moved into a new place and their landlord only gave them a single key.

The landlord wouldn’t respond to emails about getting a spare key, and they couldn’t get it copied at a locksmith becase its a Medeco key.

Medeco’s whole selling point is having hard to copy keys. A quick google search on “how to copy medeco key” leads to reddit threads of people writing paragraphs about how its hard to get Medeco keys copied.

I figured I’d take on the challenge. I had recently been experimenting with metal 3D printing services and the tolerances were good enough that I could probably pull this off.

<insert some joke about being nerdsniped successfully>

An additional challenge is that my friend lives a few hundred kilometers from me so taking a quick stop over to measure their key wasn’t practical. I’d have to decode this from photos.

What the fuck is a kilometer Key Control

Key control is an attempt by a manufacturer to prevent “unauthorized” replication of a key.

It’s basically meant to stop you from going to the hardware store and getting a copy of the key to bank vault before you get fired or something.

Medeco M3 implements a few measures to prevent against key copying:

1. They restrict who can buy blank keys to authorized locksmiths and those locksmiths may only cut keys to the terms of their contract. ²
2. They use special angle cuts on their keys that require a more advanced expensive key cutting machine to produce.
3. They add a side bitting component to the key which is pre-cut from the factory and unique to a locksmith within a given region to prevent one locksmith from cutting keys issued by another locksmith.
4. They hold a patent on parts of the key design making it difficult for a legitimate manufacturer such as Ilco to make. ³

None of these are measures strong enough to protect against autistic women as you will soon see.

Components of a Medeco key

There are 4 components we’ll need to decode to copy a key

1. Angles
2. Spacing
3. Side Bitting
4. Depths

Angles

Angle cuts are Medeco’s “special sauce”. In a normal lock, pins will have a conular shape towards the center of a cut position. Medeco locks have Chisel shaped pins that rotate to fit into the angular cuts on the key.

// possible meme showcasing the pin shapes
// virgin conular pins

• boring and round
• smooth, just like my brain
• fits clumsily into any shape of cut
• bare brass surface

// chad chisel pins

• sharp like a knife
• false gates? i heard lock picking lawyer talk about those
• cleverly falls into angle cuts
• purely cosmetic shiny nickel plating

Bitting Notation Table

Spacing

Medeco Biaxial, The 2nd generation of Medeco locks, introduced cut spacing variation. Cuts are offset from the centerline, and the chisel point of the pins are offset from the center to fit in the holes.

Fore (notated here as F) cuts are those closer to the shoulder and aft (notated A) cuts are those further away from the shoulder.

Bitting Notation Table

Side Bitting

Medeco M3 is biaxial but with a new side bitting component. You may think that this side bitting component Adds The Security. If so you have been Fooled by the security through obscurity demons! // unfunny

It’s basically a little button in the lock gets pressed to a certain depth by the side cut on the key.

(insert some kind of meme about shitty security being easily defeated)

My hypothesis is the side bitting was introduced as just another feature for Medeco to patent and as such have key blank exclusivity for another 20 years.

There are 6 possible depths for the side bitting, and two levels it can be cut in, a Master and Change level.

The side bitting is milled from the factory.

Depths

Depths are the cuts you see on your normal key. Just like in a normal lock the depths align pins to a sheer-line. Medeco keys have 6 possible depths⁵ and up to 6 cuts on a key.

Decoder

Normally, to decode the bitting of a lock locksmith would have a decoder card that looks like so:

I am neither a locksmith, nor do I have a decoder card; and regardless, my friend lives a whole plane ticket away.

With a detailed enough photo I could decode the key using a photo decoder. So ya know how they say dont post pictures of your key on the internet? this is why.

To my knowledge, nobody has made a photo decoder for Medeco yet, so I went ahead and made my own in inkscape using measurements found in the various service manuals I found on the internet.

I love it when documents I’m not supposed to have are Just On Google. You can find copies of Medeco’s service manuals on DuckDuckGo with the following search terms:

• Medeco 3 Technical Service Manual filetype:pdf
• Medeco "Biaxial" Technical Service Manual filetype:pdf

Teach the reader how to use the decoder!!!

You can Download the photo decoder I made in either SVG or PNG formats.

Keyway

The last thing we’ll need to make our own key is the profile of the key hole (the keyway).

Medeco has multiple keyways for their different locksmith, distributor and end-user contracts, and even multiple keyways for different clients under the same contract. This is to prevent one locksmith from going rogue and cutting keys on a keyway belonging to a different locksmith.²

I got lucky and happen to have an old key with the same keyway as my friend.

I ground the key flat on a bench grinder and then placed it cut side down on a flatbed scanner. I took a scan at 1200 DPI, then cropped that image and imported it into inkscape where I traced the shape of the keyway.

I was careful to include a little bit of tolerance when tracing the outline as there could be distortions in scanning, and I want to make sure there’s room for error in the 3D printing process.

3D Modeling

Somebody has already made an OpenSCAD project for generating a variety of key 3D models. https://github.com/ervanalb/keygen. It also includes a tool (SVG2SCAD) to convert an SVG path to OpenSCAD points

The majority of the hard work here was done by Eric Van Albert! I will not be an infosec person who takes credit of other peoples work!!!!

The OpenSCAD model lacked support for the stupid M3 button thing, so I got to write my first terrible scad code that simulates the side milling.

if (m3_service_depth != 0 || m3_master_depth != 0) {
    m3_master_depth_mm=m3_depth_table[m3_master_depth];
    m3_service_depth_mm=m3_depth_table[m3_service_depth];

    translate([-0.25,(0-m3_service_depth_mm)-0.65,1.8]) 
        rotate([0,-90,0]) 
            cylinder(h=2, r=0.65, $fn=15);
    translate([-0.25-2,(0-m3_service_depth_mm)-100,0])
        cube([2,100,1.8]);
    translate([-0.95-2,(0-m3_master_depth_mm)-100,0])
        cube([2,100,1.8]);
}

3D Printing

I 3D printed the Medeco keys at an unnamed chinese PCB and 3D printing shop.

(photo of finished key)

Glossary

I should’ve explained all this already

• bow — the top or handle of the key. the part that you hold and turn.
• shoulder — the alignment mechanism for a key. When you insert a key fully into a lock, this is the part that stops it from going in further.
• blade — the part of the key that’s inserted into the lock.
• bitting — the depth and position of the cuts into the key’s blade.
• depths — the depth of the cuts into the key’s blade. Usually measured from the bottom of the key to the point of the cut.

• keyway — the shape of the key hole.
• key control — an attempt by a manufacturer to make it so that only “authorized individuals” can copy a key.
• Medeco Classic — the first generation of medeco’s key/lock systems. This employs rotations of pins to make keys hard to copy and locks harder to pick.
• Medeco Biaxial — the second generation of medeco’s key/lock systems. Has rotational cuts like Medeco classic, but introduces different horizontal positions that key cuts could be in.
• Medeco M3 — the third generation of medeco’s key/lock systems. The key is cut in the same way as with Medeco Biaxial, but with side bittings to give them something to patent again.
• meow — the sound a cat makes; in case you forgot.

Further Reading

Ah, so you’re a nerd and think this stuff is cool. If this sort of thing captivates your interest, you can read more about Medeco keys on LockWiki //playfully insult the reader for being a nerd

• https://www.lockwiki.com/index.php/Medeco_M3
• https://www.lockwiki.com/index.php/Medeco_Biaxial

My emotional support laywer told me to put this here:

nt on Fake letter on letterhead