maximebeasse / keydecoder

KeyDecoder app lets you use your smartphone or tablet to decode your mechanical keys in seconds.

KeyDecoder

      

KeyDecoder is a mobile app created for pentesters and security enthusiasts. From the picture of a key, one can measure its bitting easily.

Developped by Maxime BEASSE and Quentin CLEMENT.

In partnership with FrenchKey and CNS from ESIEA.

Powered by Flutter (3.13.6) and OpenCV (4.3.0)

Summary

• KeyDecoder
• Summary
• Disclamer
• Installation
  • Build
    • Android
    • IOS
  • Releases
• Usage
  • Take Picture
  • Cropping
  • Back line
  • Shoulder line
  • Measurements
• FAQ
• License

Disclamer

Making keys without consent is illegal.

This Key Decoding application is only meant for legal use. If you have unlawful intentions, you're are not allowed to use this application. To limit the risk of illegal use, an ISO sized card is necessary to decode a mechanical key, and the key must be taken off from its keyring. We will provide no help nor assistance to any user that we believe is willing to commit a crime or a felony.

Educational and Consulting use only.

This Key Decoding app is meant to be used by Pentesters during their audits, to explain to their clients how easily a criminal can duplicate keys (from picture, by molding, or simply by asking a local locksmith to make a duplicate). Fair use is allowed if used by security enthusiasts, to assess their own security, and discover the difficulty of making keys only using a picture. The authors DO NOT ALLOW any users to sell keys created with the help of this app. Rulebreakers are subject to lawsuit.

Security advice.

If you want to protect yourself from having your keys duplicated without your consent (with a picture, or by molding, or more simply by someone asking a locksmith to make a copy), you are invited to apply the same best practices to your keys as you do with your Credit Card or your Password. Just like credit cards and passwords, you must not lend your keys, or leave them unattended.

Have Fun, Stay Legal, Hide your keys.

---

Installation

Build

• To install Flutter, it is recommended to use fvm, a Flutter Version Management tool. But you can also use the official Flutter installation guide.
  • The project is built using Flutter v3.13.6

Android

• Download OpenCV-Android-SDK v4.3.0 and extract it to a directory of your choice. (eg. C:\SDK\OpenCV-android-sdk)
• Create the local.properties file under android/, providing the following settings :

flutter.sdk=<Flutter SDK path>
flutter.buildMode=release
flutter.versionName=1.0.0
flutter.versionCode=1
opencv.sdk=<OpenCV Android SDK path>

• Copy the subdirectories in C:\...\OpenCV-android-sdk\sdk\native\libs to the directory C:\...\keydecoder\android\app\src\main\jniLibs
• Build the project using fvm flutter build apk

IOS

IOS is not currently supported

Releases

The most recent builds can be found in the Play Store.

Usage

Take Picture

Take a picture of a key, removed from its key ring, and place in the middle of an ISO/CEI 7810 ID-1 sized card (credit card, business card...). It is very important that the card measures exactly 85,60 by 53,98 mm (3 3⁄8 in × 2 1⁄8 in).

A well lightened and high res picture will give better results.

Cropping

Use the green lines to crop the image to only retain the card. You can zoom to be more precise.

Back line

Align the red line to match the back of the key.

Shoulder line

Align the blue line to the shoulder of the key.

Measurements

Now, you can place points in the middle of each cuts of your key. Once done, you can validate and retrieve your measures on your project's page.

FAQ

What is the purpose of this application?

This application is a key decoder tool helping you getting the depths and spaces for a key you own or have legally access to. The decoded data can then be used with the help of a locksmith to obtain a duplicate of the pictured key.

What is the intended public for using this app?

The KeyDecoder app is built for security professionnals such as Pentesters and other security enthusiasts to be able to decode their own keys, or keys of the location they have a legal contract for.

What do you do with my pictures and decoded data?

Nothing. We do not transmit the pictures over the network, we do not retrieve any decoded data. Everything the user does with the app, is done locally on his/her phone. As a user, you are responsible for making sure that nobody else gets access to your pictures and decoded data.

Is this app helping criminals to copy my keys without my consent?

No. If you make sure to handle your keys with the care they deserve, no criminal will be able to use this application to copy your keys. Same as a Password or a Credit Card, a mechanical Key is a sensitive data that you should not share with anybody, and that you should not leave unattended. Otherwise, someone can easily go to a nearby locksmith, or make a molding duplicate in seconds. Additionnaly, the need for an ISO sized card as a dimensionnal reference prevents any decoding using a picture taken "on the fly". A criminal could copy your keys with this app only if you let them do it.

---

LIMITED WARRANTY

THE PROGRAM IS PROVIDED TO YOU "AS IS," WITHOUT WARRANTY. THERE IS NO WARRANTY FOR THE PROGRAM, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

License

TL;DR :

You ARE NOT ALLOWED to make money (directly or indirectly) by distributing this application, its source code or a modification of them, or selling keys made with the help of this app. Of course, you ARE NOT ALLOWED to perform any illegal activity using this application.

You ARE ALLOWED to install, use, read, modify and distribute this application and its source code at no fee. You ARE ALLOWED to produce keys for your own use or to perform a pentest audits, both at your own risks.

You MUST give credit to original authors and copyright holders when you share this software or a modification of this software, and share it under the same conditions.

If you don't agree, delete it from your device.

The logo is under copyright and shall not be used without prior written consent of the copyright holder. The only use of the logo authorised is the use for this application and its derivatives as long as they respect the law and ethics.

keydecoder's Issues

Shouldn't it be named "Encoder"?

And how do I do the final "decode" step? Who makes keys based on dimensions. I'm not in the USA

Feature Request: F-Droid releases

Hello,

this is an excellent open source project, and one that would be made more accessible by listing it on F-Droid. Do you think this would be possible?

Incompatible with newest android version?

Get "this app isn't available for your device because it was made for an older version of Android" message on play store

Implement command substitution

Implement subshell parsing

Inclusion in fdroid

Hi,

do you have any issue with the app being inlcuded in fdroid?

Unenforceable license terms

When you state "The authors DO NOT ALLOW any users to sell keys created with the help of this app.", that's unenforceable.

For one thing, the output put is physical data (measurements) that can't be copyrighted. It possibly gets turned into bitting codes that again can't be copyrighted.

When you say "the authors DO NOT ALLOW", it's irrelevant whether or not you do, because you have no legal means to stop people from doing so. With copyright law, it's copyright that takes people's ability to copy, and licenses that give them more rights than they had. You can't take more privileges than what your technical ability and the law give you.

You say "fair use is allowed if used by security enthusiasts". The whole point of "fair use" is that it doesn't require a license, because fair use is a limitations on the privileges of the copyright holder.. In other words, fair use stops you from limiting anyone who copies your media, it's not a limitation on them.

In the US, a relevant case would be "Design Data Corporation v. Unigate Enterprise, Inc.", in which the courts ruled that the output of a computer program was essentially not copyrightable by the authors of the computer program. If you make a word document (for example), the output belongs to you, and microsoft has no IP in the final document. With this software, the "output" would be the key. There are similar cases worldwide.

If this weren't an android app, you could try to get users to agree to terms before you distribute it to them. Since this is an android app, it's distributed through the Google Play Store, and is distributed by Google users under the Google Play terms.

You are trying to amend the terms after the sale essentially (which you can't do), and don't provide the consideration necessary to have some sort of contract. They already have the right to have the software and use it from google, so your "Education and Consulting Use Only" disclaimer is meaningless.

In general, the Google Play terms don't allow redistribution, so your distribution license itself accomplishes the goal of limiting who can distribute the app and under what purposes. It keeps companies from rebranding and charging for it. That's all the control you get.

If you want another bite at the apple (a chance to renegotiate terms), then you will need to do something like add a web service into the app. If you do that, then you can offer them something (access to the online service) in exchange for something (the agreement from them not to do certain things).

[Feature Request] Add support for symetric keys

Some keys (e.g. mailboxes) are symmetric and don't have a "Back Line". Instead For those keys it would make sense to determine the center line of the key first and measure the distances from there.
The distances on both sides should be the same.

Crop doesn't work.

It seems the crop selects the wrong area every time. Samsung Galaxy A33

STL for 3D printers

How about automatically generating an STL file (ASCII..) for 3D printing the key?