The bump key, or the thirty-year secret the locksmiths kept
The key that opened the door looked identical to one that wasn’t supposed to work. A common key blank with every cut filed to the lowest possible depth — locksmiths called it a 999 key. It wasn’t cut for this particular cylinder. The locksmith inserted it, withdrew it by a single tooth, applied light pressure to the plug, and struck the key handle once with a rubber mallet. The cylinder turned.
Locksmiths in Denmark had been doing this since the 1970s. They called it bumping. They did not explain it to outsiders.
On January 26, 2005, Barry Wels and Rop Gonggrijp uploaded a PDF to toool.nl and that arrangement ended. The paper was titled “Bumping Locks.” Its subtitle listed how to open Mul-T-Lock, Assa, DOM, and a dozen other high-security mechanical locks “without substantial damage, usually in under 30 seconds, with little training and using only inexpensive tools.”
Wels was a member of TOOOL — The Open Organisation Of Lockpickers, based in the Netherlands, whose name was not subtle about its views on security through obscurity. Gonggrijp had co-founded XS4ALL in 1993, one of the first public internet providers in the Netherlands. Neither was a locksmith. Neither stood to profit from the technique. They published it anyway.
The physics is straightforward. A pin-tumbler lock has six pin stacks sitting at the shear line — the gap between the cylinder’s plug and its housing. Each stack holds a key pin below and a driver pin above. The correct key lifts every stack to exactly the right height, aligning all six gaps so the plug rotates. A 999 key raises them all to the same wrong height — but when the key is struck sharply, the driver pins bounce upward, briefly clearing the shear line. The window lasts milliseconds. With light rotational pressure already applied, the cylinder turns before the pins fall back. No picking skill required; only timing.
Bruce Schneier linked to the paper on March 7, 2005, noting it could “open a wide range of high-security locks in little time, without damaging them.” The Dutch television program Nova had already aired a live demonstration to a national audience. By 2006, TOOOL and the consumer organization Consumentenbond had tested seventy lock models with both trained and untrained volunteers; nearly every one yielded. Later that year, American attorney and security researcher Marc Weber Tobias published two white papers on the legal ramifications.
The disclosure provoked the argument that computer security had been having since the 1980s: does publishing a vulnerability protect the public by forcing manufacturers to respond, or does it arm criminals? TOOOL’s answer was embedded in its founding principle. The Danish locksmiths had kept the secret for thirty years, and the result was that every pin-tumbler front door in the world had been quietly vulnerable for thirty years. The secret had protected the secret, not the door.
The industry responded: spool pins, serrated driver pins, and secondary locking bars that could not be bounced out of position. The UK introduced the TS007 Kitemark, grading cylinders by how many minutes they could resist sustained bumping. In 2008, Tobias demonstrated that Medeco’s m3 — marketed as bump-resistant and specified for American embassies and federal buildings — was not immune.
Linus Yale Jr.'s pin-tumbler cylinder, patented in 1865, had survived a hundred and forty years of formal attack. The informal kind had been running the whole time — secured, until January 2005, by the silence of the people who knew.
Sources
- Lock bumping — Wikipedia — Danish origins 1970s; Wels/Gonggrijp white paper January 26, 2005; Consumentenbond 70-lock test 2006; Tobias Medeco m3 demonstration 2008; TS007 Kitemark standard.
- Flaw in Pin-Tumbler Locks — Schneier on Security — Schneier’s March 7, 2005 post; his characterization of the technique and prediction of lock industry advance.
- Key Bumping — Lockwiki — 999 key definition; driver pin bounce mechanism; millisecond shear-line window; manufacturer countermeasures.
- Rop Gonggrijp — Wikipedia — XS4ALL co-founder 1993; Dutch hacker background; why publishing the technique was a deliberate act, not a professional one.