On: Rights Amplification in Master-Keyed Mechanical Locks (2003) [pdf]

[yccs27]

The difficulty of this attack is definitely in producing so many test keys. I imagine that it might not be much easier than disassembling the lock.

[aidenn0 → yccs27]

You need one test key per pin, so on the order of 7 keys; that's not so terrible.

[vgel → aidenn0]

Don't you need (up to) `N cut depths - 1` keys per pin? E.g. if there are 4 possible cut depths for a pin, and your key has depth 3 on pin 1, you need to (potentially) test depths 1, 2, and 4 -- and if none of them work, your key shares a depth with the master key.

[vgel → vgel]

Oh, you could re-use the same test key if you start at the higher depth, of course.