Master keying

Why does giving a caretaker one key that opens every door make every one of those locks easier to defeat?

A caretaker needs to get into every room, so the locksmith sets up a master system: each tenant keeps their own key, and one extra key opens the lot. It sounds like an addition — one more key in the world, and the locks otherwise the ones you already had.

Locksmiths will tell you it is not an addition. Every door in the system becomes easier to open by someone holding neither key. What could be different inside a lock because of a key kept in an office?

Start with what a pin tumbler lock actually decides. A plug turns inside a fixed shell, and the boundary between them is the shear line. Above each cut on the key sits a chamber holding a key pin resting on the key and a spring-loaded driver pin above it. With no key in, a driver pin straddles the shear line and the plug is locked. The right key lifts each stack until the gap between the two pins sits level with the shear line, in every chamber at once.

Notice the structure of that decision. Each chamber judges alone, knowing nothing of its neighbours; it asks only whether its gap is at the shear line. The lock is a set of independent tests that one key happens to pass together.

Now ask how a second, different key could open the same lock. Each chamber needs a second lift height that also puts a gap at the shear line, and there is only one way to arrange that mechanically: cut the stack again. A third pin — a master wafer — is added, so the stack has two gaps at two heights. That chamber now accepts two key depths instead of one.

Everything follows. Suppose a six-chamber lock is mastered by splitting five chambers. Each split chamber accepts either of two depths, and the chambers are independent, so the number of cut patterns that open the lock is 2 x 2 x 2 x 2 x 2 = 32. Two are keys anyone meant to exist: the tenant's and the master's. The other thirty are real key cuts that open this door and that nobody issued or recorded — incidental, or phantom, keys. They are not harmless for being uncut, because the change keys for the other doors are drawn from the same space of depths; whether some neighbour's key falls inside your door's thirty is a question about how the system was laid out, not luck.

That is the first loss. The second is manipulation. A picker works one chamber at a time, feeling for the moment a driver pin catches on the plug's edge and stays up. In an unmastered lock exactly one height per chamber gives that feedback; with a master wafer there are two, so at every chamber the picker is twice as likely to stumble into a setting position.

The third makes the arrangement different in kind. Because chambers decide independently, the master's cuts can be recovered one chamber at a time. Take one legitimate change key, cut blanks matching it in every position but one, and try each available depth in that position; the depth that also turns the lock is the master's cut there. Repeat per chamber. For six chambers and ten depths that is at most 6 x 9 = 54 trials, against a million patterns if you had to guess the whole key. Matt Blaze described this formally in 2003, though the trade knew the trick; I am recalling the paper rather than quoting it. The vulnerability is simply the independence of the chambers — the same property that made the lock cheap and reliable.

Is this superstition, or a locksmith talking up a job? Neither: it is arithmetic, and the trade sells master systems anyway, knowingly. But note who pays. The convenience accrues to whoever owns the building; the widened attack surface sits behind each tenant's door. And rekeying after a lost master means touching every lock at once, so the cost of correction grows with the system — a good reason these arrangements outlive their justification.

The misconception to retire is that a master key is a key. It is a modification to every lock in the system, and the key is only the part you can put in your pocket.

Two refinements. The cost is not fixed: it scales with how many chambers are split. Master one chamber and the lock accepts two patterns and picks almost like an ordinary one; master five and you have thirty-two. A careful locksmith spends that budget deliberately, which is why "is it mastered" is a poorer question than "how deeply". And this is a property of the shear-line trick, not of locks in general — a cylinder that grants the master through a sidebar or a separate control feature, leaving the pin stacks single-cut, does not multiply openings the same way. The weakness is traceable to one design choice and can be bought out with a costlier cylinder.

That gives a clean test. If extra shear points are the mechanism, picking difficulty and the count of unintended keys should track the number of split chambers and be largely indifferent to brand, keyway or machining quality. Find master-keyed cylinders that resist manipulation as well as their unmastered twins, or a large system in which no change key ever opens a door it was not meant to, and this account is wrong — the losses would come from elsewhere, and mastering would be free.

• How sidebar cylinders provide a master without splitting the pin stacks, and what that costs instead.
• Why electronic access control changes the calculus by making revocation cheap.

Every term the collection defines is gathered in the glossary.