• Casa Grande Locksmith

Contact Victor Aguilar for locksmith service and queries. Victor Aguilar is rated A+ by the Better Business Bureau. He has 25 years of experience as a commercial locksmith.

<<< Previous        Next >>>

A Proposal for a New Grade of Lock

Currently, ANSI Grade 1 and Grade 2 locks are supplied with the same cylinders, which are certainly better than the ungraded crap, but neither pick-proof nor bump-proof. So what we really need is a new grading system that specifically addresses the existence of the plethora of lock picks and bump keys being sold on the internet.

For example, the Medeco Maxum and the Schlage B600 series are both ANSI Grade 1, yet they offer very different levels of security. Both deadbolts resist a sledge hammer attack, but their stock cylinders are of completely different classes. In my proposed system, the former cylinder is Grade 1 and the latter cylinder is Grade 4. A B600 series Schlage is a brick shithouse; it really does not make sense to have some fifteen-year-old boy with arms like pipe cleaners opening it with an SC4 bump key in ten seconds, to the delight of his YouTube fans.

Basically, my Grade 1 is Medeco or ASSA, which already exist. There are some other brands of high-security cylinders that may also make the cut, but Medeco and ASSA are the only ones that I have personal experience with. In later columns I may review some of the other high-security locks and – after becoming familiar with them – decide if they really are Grade 1. For the most part, the four-tiered grading system that I will define in this column is based on the technology used and hard statistics like the difference between the shortest and longest pin. But there are also some locks, like Primus, that have features in common with several grades and are assigned a grade as a compromise between their strong and weak points.

My proposal for Grade 2 is something like ASSA, but without the sidebar. My proposal for Grade 3 is something like Sargent or Yale. But for both Grades 2 and 3 there is an added twist that makes them much more secure than they currently are – see below. None of the locks currently being sold in hardware stores (Schlage, Kwikset, Smart Key, Defiant, Master, etc.) reach the level of my Grade 3. But I will create a Grade 4 for the best of them, Schlage and Defiant. The owners of B600 series Schlage deadbolts will rend their clothes to learn that they are in the same class as Defiant, but I remind them that my grading system is focused entirely on pick resistance and bump resistance, not brute strength.

Grade 2 Requirements:

  1. 1) A six-pin 0.495” diameter cylinder machined to the same tolerances as ASSA.
  2. 2) A difference between the shortest and longest pin of at least 4.8 mm.
  3. 3) At least four different sizes of top pins matched to the sizes of bottom pins.
  4. 4) All locks should have one pin chamber with a shortest possible bottom pin and no master pin, and one pin chamber with a longest possible bottom pin.
  5. 5) At least one pin chamber, but not all of them, must have a spool top pin.
  6. 6) A hardened steel insert to protect the shear line from being drilled.

Justification:

  1. 1) The closer the tolerances the better, in spite of what the bullshit artists on the internet are saying. (Burglary forum discussants seem convinced that tightly machines locks are easier to bump than loosely machined locks.)
  2. 2) Bumping a short pin all the way up to the shear line requires a Babe Ruth bump while bumping a long pin without lifting it into the cylinder requires a granny bump; it is just not possible to do both at the same time. The same is true of picking; it is easy to lift all the pins to roughly the same height; but lifting some high and others low, not so much.
  3. 3) Having different sized top pins keeps the pin stack roughly the same length and thus puts about the same pressure on every spring. Too long of a pin stack crushes the spring and prevents the key from sliding in and out. Thus, a lock that has only one size of top pin must use a short one to avoid this problem when it is matched with a long bottom pin. But matching this short top pin with a short bottom pin results in too little spring tension, which makes that pin chamber insecure. The Babe Ruth bump on a short bottom pin only works if there is also a short top pin and a loosely fitting spring; if the top pin is twice as heavy as the bottom pin and the spring has the correct tension, the two pins are not going to fly upwards and then spread apart.
  4. 4) Always cutting keys with shallow cuts reduces wear on one’s key machine and reduces time spent making keys. This practice is pure laziness, but a lot of locksmiths are this lazy. Laziness is also why they use only the short top pin; it is just so onerous having to think about the length of the pin stack in the rare occasions when they do use a long bottom pin. The same laziness motivates them to just dump the sixth pin chamber and use stubby five-cut keys. A five-pin lock of any manufacture with all very shallow cuts on the key and too little spring tension in all the cylinders is easy to pick and bump, yet this is exactly what a lazy locksmith supplies to every customer.
  5. 5) The presence of a spool top pin has no effect on bumping, but makes the lock significantly more difficult to pick. In combination with rules (3) and (4), this rule is easily implemented by having the longest of the several available top pins be of the spool design and the others standard. By (4), the pin chamber with the shortest possible bottom pin and no master pin will get a spool pin, but they cannot all have such short bottom pins because, by (4), at least one must have the longest possible bottom pin.
  6. 6) Locks cannot be made out of steel because they would rust. But it is possible to have steel inserts to protect the vulnerable parts from being drilled. This adds considerably to their expense and is not a complete solution; if a burglar drills enough, eventually any lock will come apart. But it will stop burglars with a low-power drill and no extra batteries.

The manufacturers can make their locks fool proof; but they cannot make them damned fool proof. Defeating the plethora of lock picks and bump keys being sold on the internet does not require any fancy new technology; it just requires using the technology we have to its full potential. The security gap that the burglars buying these lock picks and bump keys prey on is not stupid engineers who design locks poorly, but lazy technicians who install them wrong.

Thus, my next and probably most controversial proposal is that manufacturers of Grade 2 locks employ secret shoppers, similar to those employed by restaurants, to test locksmiths. Basically, the secret shopper takes a lock cylinder to the dealer of a Grade 2 lock and asks to have it rekeyed. If the locksmith does not follow the practices described above, he gets his dealership revoked.

At the time of this writing (2014), the only manufacturer who can meet these requirements is ASSA. Note that ASSA top pins have two grooves near each end, unlike Lab pins (the aftermarket pins that locksmiths use unless OEM pins are required) that have a large groove in the middle like a miniature spool for sewing thread. If Lab spool pins are put in every chamber, then the plug can turn slightly and will prevent the key from being inserted if one is already starting to apply turning pressure before the key is fully inserted. This is why (5) insists that not all of the chambers can have a spool pin. But ASSA is fine with their top pins in every chamber, and actually considerably more secure than manufacturers with two or three conventional spool pins in a six-pin lock.

The existing ASSA locks are already Grade 1. To introduce a less expensive Grade 2, they can just sell their cylinders without the sidebar, with no sidebar pins and with a generic key that does not have sidebar grooves in the side of it. The sidebar grooves do not prevent a Grade 1 key from entering and operating a Grade 2 lock, so businessmen can put Grade 2 cylinders everywhere except the cash office and the server room, which get Grade 1. This is a huge cost savings and may make ASSA affordable to companies who had previously rejected it on grounds of expense.

Schlage is already doing this with their Primus and standard-security cylinders. Customers put Primus in their important locks and standard-security cylinders everywhere else; the owner’s Primus key operates everything while the middle manager and custodial keys will not even enter the Primus cylinder. The difference is that ASSA and ASSA-without-sidebar are Grade 1 and 2 while Primus and Primus-without-sidebar (e.g. standard-security Schlage) are Grade 3 and 4. Medeco, however, cannot do this, because the sidebar is not independent of the pins blocking the shear line, as it is in ASSA and Primus; it is operated by pins that simultaneously rotate to open a slot for the sidebar and also move up and down to leave a gap at the shear line. The sidebar and sidebar pins cannot simply be removed from a Medeco the way they can be from an ASSA or Primus.

A Grade 2 ASSA, which does not exist at this time, would reduce the cost considerably below that of their Grade 1 locks and allow lots of locksmiths to become Grade 2 dealers without the cost of becoming an exclusive dealer of a particular sidebar, like I am.

ASSA has nine depths and can use a single-step masterkey system because there is no danger of a change key that is only one depth-increment different from the master key operating as the master. This allows for about six thousand possible change keys when only four pin chambers are used for the masterkey system and the other two are set aside for the #1 and #9 bottom pins with no master pins, as required by (4) above. Considering the cost of an ASSA cylinder, even in the reduced-cost Grade 2 version, I am sure nobody is installing a tenth that many locks. So the fact that one is implementing a masterkey system is no excuse to ignore the rules.

Grade 3 Requirements:

  1. 1) A six-pin 0.495” diameter cylinder machined to the same tolerances as Sargent or Yale.
  2. 2) A difference between the shortest and longest pin of at least 4.35 mm.
  3. 3) At least three different sizes of top pins matched to the sizes of bottom pins.
  4. 4) All locks should have one pin chamber with a shortest possible bottom pin and no master pin, and one pin chamber with a longest possible bottom pin.
  5. 5) At least one pin chamber, but not all of them, must have a spool top pin.

Note that I am here referring to Yale’s commercial-grade lock with the Y2 keyway. Their residential-grade locks have a Kwikset keyway and are comparable to Defiant. Yale probably shopped them out, because they do not even look like they are made by the same company. Residential-grade Yale with a KW1 keyway is Grade 4; I did not mention them in my Review of Inexpensive House Locks because I was only reviewing locks sold through Home Depot

Precisely defining machining tolerances is beyond the scope of this paper, but I think Sargent and Yale are very close, so the only thing these companies would have to do is program their key-cutting machine to always have a shallowest and a deepest cut. There is no secret shopper program for Grade 3 but, if a locksmith is a dealer for Grade 1 or 2, he may be tested by the secret shopper program with a Grade 3 cylinder. For instance, if a locksmith is an ASSA dealer and also sells Grade 3 Sargent cylinders, ASSA may send him a secret shopper with a Sargent cylinder on the assumption that, if he does not take Grade 3 seriously, then he is probably not taking Grades 1 and 2 seriously either.

Because a Best cylinder is smaller than the 0.495” diameter cylinders specified above, the 4.35 mm difference between the shortest and longest pin cannot apply to Best. But Best has a proportionate difference and is machined to close enough tolerances that it is Grade 3 as long as all the rules are applied. Note that Best top pins of certain sizes are available with a spool design and the locksmith must purchase and use these to maintain Grade 3 status. At this time, very few locksmiths purchase spool pins. Best also makes drill-resistant cylinders that may qualify as Grade 2, though I have no personal experience with them; precisely defining machining tolerances and drill resistance is beyond the scope of this paper

However, Best is intended to be used in large masterkey systems. Abiding by rule (4) with two pin chambers and using the other five for the masterkey system gives one 3125 possible change keys, which is a large system even by Best standards. But institutional locksmiths implementing really humungous grand-masterkey systems may not be able to maintain Grade 3 status because they need to put master pins in all six chambers. Thus, Best kind of dances between Grades 2, 3 and 4, depending on how it is implemented.

I will later address the Matt Blaze problem but, even with the solution that I offer, it is still not a good idea to have one grand master key that opens thousands and thousands of locks. The reality is that there is no individual in the company who actually needs such a grand master key – the upper management have authority over all the people in those offices but are not personally walking around opening all those doors – and the security guards who do need to be able to open any door can just carry a separate master key for each building. If a masterkey system is compromised, either through a Blaze attack or because the key is taken from someone who is not guarding it closely or who can be corrupted, the cost of rekeying is much less if it is restricted to just one building. Also, it is a lot easier to identify the corrupt or negligent manager who lost his master key.

So, basically, maintaining Grade 3 status with Best cylinders is fairly easy provided one avoids really humungous masterkey systems and follows the rules listed above. Acquiring Grade 2 status requires special high-security cylinders that have yet to be tested for compliance. But, whether Grade 2 or 3, this is not a recommendation to market Best as high security to customers who are buying just two locks, one for their front door and one for their back door. I have observed that locksmiths who cannot afford to become a Medeco or ASSA dealer, but who are maintaining a Best masterkey system, will fob a Best lock off on homeowners or storefront business owners who ask about high security. But these locksmiths do not give the purchaser the control key nor even explain to him what a control key is. This is an attempt to lock the customer in, which is unethical. Also some locksmiths puts all of those two- or three-lock orders on the same control key for their own convenience when maintaining them. This practice really flies in the face of calling the locks high security because, if the customer hires another locksmith to decode one of his cylinders for the control key to remove the cylinder from the other ones, he has inadvertently been given a control key for locks all over town.

Note that Schlage standard-security cylinders are excluded from Grade 3, as well they should be, since I and a lot of people have found them possible, if not easy, to pick or bump open. In spite of the fact that I have bumped open a Primus but never a Sargent or Yale, I will grant Primus Grade 3 status; after all, it took me hours even after having crippled the cylinder with a flat key. Also, while I have never picked open a Sargent or Yale, it is theoretically possible, but not so with the Primus. Primus has the same technology as ASSA, but lacks the key control of the ASSA dealership program and its machining is as loose as Grade 4 Schlage and has the same 3.43 mm difference between the shortest and longest pin, less than the 4.35 mm requirement of Grade 3 cylinders. Primus does not have the steel inserts of ASSA, though it is more difficult to drill than Sargent or Yale because it has two drill points, not one. Basically, Primus is skating all over the grading structure, but it has to be assigned some grade, so Grade 3 is its new home.

The problem with Schlage, and thus also with Primus, is that they have reduced their quality standards over the years so they are no longer as tight as Sargent or Yale, who were once their peers. Also, the design of their keyway has the land too high, leaving too little room for a large difference between the shortest and longest pin. Here I am using the word “land” with the same meaning that it has in the rifled bore of a gun; the inverse of a groove. The difference between the shortest and longest bottom pin is the most important characteristic, assuming that one makes use of this feature and does not cut the key all shallow. These differences are as follows:

Manufacturer Difference
ASSA 4.80 mm
Sargent 4.59 mm
Yale 4.35 mm
Corbin-Russwin 3.56 mm
Schlage/Primus 3.43 mm
. . . .

Corbin-Russwin is easier to bump open than Schlage and, thus, is also Grade 4. While I am not 100% – only beginners boast of having never failed – neither brand is much of an obstacle for me. If I cannot bump open a Schlage, I can pull a knob or lever off, which is not possible with either Sargent or Yale. I do not recall having ever picked open or bumped open a Sargent or a Yale. Of course, having said that, I am sure all the internet gurus will be jumping up and down shouting, “I have! I have!” Maybe. But, if so, I bet they also crippled the lock by rekeying it to a shallow flat key and using too small of top pins to reduce the spring tension. I am sure that such lock-picking feats are not possible if all of my rules are followed.

Incidentally, Kwikset is easy to pick not only because they are loosely machined and their OEM bottom pins have rounded tops, but also because the difference between the shortest and longest pin is only 2.92 mm; no Kwikset compatible lock will ever make Grade 3, no matter how carefully it is machined. But Defiant, with the recommended modifications has a difference of 3.51 mm because we are using the #7 bottom pin. The reason that stock Defiant locks do not use the seventh depth is because they have only one size of top pins and this would cause the spring to get crushed, but my recommended modifications also demand two sizes of top pins. With these modifications, Defiant is a solid Grade 4 lock. None of the locks with differences near 3.5 mm – Schlage, Defiant, Corbin-Russwin – have any hope of becoming Grade 3, with the exception of Primus, because it has a sidebar.

Failure to comply with the Grade 2 and 3 rules will drop the lock a grade level. The important point that I am trying to make here is that accurate machining and a low land that allows for a large difference between the shortest and longest bottom pin only give the cylinder the potential to be secure. If the locksmith is lazy and uses only flat, shallow keys and never a spool pin nor a long top pin, resulting in all the springs having too little tension, then the engineers and machinists have wasted their time. Security against picking and bumping has not been achieved.

Let us summarize where the several manufacturers fall in the proposed grading system, assuming that they are not crippled by lazy locksmiths.

Grade 1 ASSA, Medeco
Grade 2 ASSA without sidebar
Grade 3 Primus, Sargent, Yale
Grade 4 Corbin-Russwin, Defiant, Schlage

Note that this proposal is only for the cylinders, not the entire lock. The ANSI grading system mostly addresses the strength of a lock against physical attack and this system can exist alongside the new one. Sledge hammers and crow bars work the same way today as they did in pre-WWII days. It is only the picking and bumping of locks that has changed, and not because of any new techniques, but because the internet is making information about these once obscure topics available to everybody. Thus, while ANSI is derided by internet gurus wielding bump keys, from the point of view of the Neanderthal with his sledge hammer, there is a big difference between a B600 series Schlage and a Defiant; as well there should be, considering that the former costs six times more than the latter.

Just a wild guess: Schlage is not happy to have their Primus be Grade 3 and their standard-security locks be Grade 4. How can they move up to Grades 2 and 3? First, for the sake of backwards compatibility, the B600 series should be left unchanged and remain Grade 4 in my system. Then take these steps:

  1. 1) For the B700 series to be Grade 3, it must have a keyway with a lower land. Sargent’s LA keyway is not patented, so just swallow your pride and use it instead. Admittedly, almost every commercial-grade lock in America is now supplied with an SC4 keyway cylinder, so this advice is a bit like telling Shirley Temple to straighten her curls. But it has to be done.
  2. 2) For the B800 series to be Grade 2, it must have steel inserts in the cylinder to resist drilling. The Primus XP that now comes with B800 series locks has such inserts, so just give it an LA keyway. In this way, the Primus XP keys can operate both B700 and B800 locks while standard LA keys can only operate B700 locks. Relegate the non-XP Primus cylinders – whose keys will enter a SC4 keyway – to a B650 series.
  3. 3) I and a lot of locksmiths have noticed that vintage Schlage cylinders from decades ago are a lot harder to pick open than modern Schlage cylinders. Even with an LA keyway, Primus XP is not going to make Grade 2 and the standard-security version is not going to make Grade 3 unless you tighten up your machining tolerances.
  4. 4) All of this work is for naught as long as it is possible to pull a knob or lever off for the purpose of decoding the cylinder to obtain a key to open the deadbolt. Sargent and Yale use similar spring-loaded clips to hold their knobs and levers on; the difference is that they are stronger. So make yours stronger.
  5. 5) Institute a secret shopper program to test locksmiths’ conformance to the rules listed above. Be ruthless about ejecting the lazy sluggards who always use flat, shallow keys and never a spool pin nor a long top pin, resulting in all the springs having too little tension. Today, “certified” is just a happy feel-good word that every Tom, Dick and Harry pastes onto the home page of his website, vaguely referring to some training course he took a decade ago, probably in something irrelevant like opening cars. But, if my advice is followed ruthlessly, “Schlage Certified” will come to be recognized by the consumers as the brightest feather in the locksmith’s cap.

And as for you, Defiant, eventually I am going to insist that Grade 4 cylinders have the following characteristics. So I would get busy meeting these standards now, if not in your entire line, then at least in a primo lock that costs a bit more.

Eventual Grade 4 Requirements:

  1. 1) A six-pin 0.495” diameter cylinder machined to the same tolerances that ANSI Grade 1 and 2 cylinders currently are.
  2. 2) A difference between the shortest and longest pin of at least 3.43 mm.
  3. 3) At least two different sizes of top pins matched to the sizes of bottom pins.
  4. 4) All locks should have one pin chamber with a shortest possible bottom pin and no master pin, and one pin chamber with a longest possible bottom pin.
  5. 5) At least one pin chamber, but not all of them, must have a spool top pin.

This is basically the SC4 keyway cylinder that is stock on all commercial-grade locks, but with the modifications that I suggest in my How to Modify an Inexpensive Lock already implemented at the factory. These cylinders already exist and Defiant could just buy them from LSDA or Cal-Royal; alternatively they could machine a KW10 keyway, which is a six-pin version of the KW1. To meet (2) above, the KW10 cylinder would require seven depths, not six. Defiant’s extant knobs and deadbolts are only big enough for a five-pin cylinder and will thus have to be redesigned. While in transition, perhaps Defiant could continue to sell their low-priced five-pin locks but also offer a more secure and more expensive version with six-pin cylinders as described above. Since they have to redesign the lock body to accept the six-pin cylinder anyway, they should give the lock body and bolt a beefier construction to meet ANSI Grade 2.

Bottom Line: Defeating the plethora of lock picks and bump keys being sold on the internet does not require any fancy new technology; it just requires using the technology we have to its full potential. The security gap that the burglars buying these lock picks and bump keys prey on is not stupid engineers who design locks poorly, but lazy technicians who install them wrong. My big innovation is not some new whiz-bang technology, but a secret shopper program to keep locksmiths on their mettle.

Sneak Peek! In the following column, I will discuss how to secure a business. Then I will take up the next big security challenge: Defeating Matt Blaze.

  <<< Previous        Next >>>  


Leave a comment

Comment: