Kwikset Smart Key

=Kwikset SmartKey=

The Smart Key (or SmartKey) is a user-rekeyable wafer lock made by Kwikset and Weiser (Canada). It uses five wafers that interact with a sidebar to provide protection against lockpicking and key bumping. The Smart Key was Kwikset's response to the media frenzy concerning key bumping, specifically to address the weaknesses of their traditional pin-tumbler cylinders. Though it has succeeded in providing resistance to bumping, vulnerabilities in the Smart Key design have shown it can be attacked in a variety of ways.

The SmartKey is easily identified by the small, rectangular hole to the left of the keyway.

Principles of Operation
The SmartKey uses five wafers that can be set to six positions each, giving it a total of 7,776 (65) key differs. This number is drastically reduced because of poor tolerances that accept half cuts at every position, reducing the number of real differs to 243 (35). Unlike traditional wafer locks, the SmartKey's user-rekeying ability heavily modifies the internals of the lock. Instead of the key directly interacting with the wafers, it interacts with a series of guide pins. The guide pins hook into the wafers at different levels (depending on the bitting of each wafer) to raise them to the proper position.

Wafers provide pick resistance in the form of serrations on the side of the wafer that engages the sidebar. Because the lock is not pin-tumbler based, it is also not subject to key bumping attacks.

When the user wants to rekey the lock, the working key is used to rotate the plug 90&deg; clockwise. A special tool known as the "SmartKey tool" is used on the small hole to the left of the keyway. This physically disengages the sidebar and wafers from the guide pins and allows the working key to be removed. A new key can be inserted and the plug rotated back to the default position. When this is done, the sidebar and wafers slide back onto the new position of the guide pins, and rekeys the lock.

Notes
 * A ball bearing sits at the 2 o'clock position in the plug to promote smooth operation and longevity of the lock.

Key
The Kwikset SmartKey uses the standard Kwikset key blank 1-1063 and "KS" keyway.
 * Axxess 66
 * ILCO 1176 or KW1
 * Silca KS1
 * Taylor 54KS

Rekeying instructions

 * 1) Insert the working key and rotate 90&deg; clockwise.
 * 2) Use the "SmartKey tool" on the hole left of the keyway by inserting it (notice a small click) then removing.
 * 3) Remove the working key and insert the new key.
 * 4) Rotate the new key in the lock 90&deg; counter-clockwise.
 * 5) Once back in the default (vertical) position the lock will be rekeyed and the new key can be removed.

Disassembly instructions
The SmartKey uses a four piece assembly of housing, cylinder, core, and plug. Disassembly is fairly simple with care given to the removal of the sidebar components.

Note: Complete disassembly of the SmartKey will erase the bitting code unless a working key is available to reset the lock.


 * 1) Remove the cylinder from the housing, either by removing the screws (deadbolts) or releasing the retaining clips (key in knob cylinders).
 * 2) Remove the extended C-clip from the cylinder and remove the core.
 * 3) Remove the C-clip from the core.
 * 4) Remove the plug from the core, either by using a working key or manipulating each wafer so that it does not block above or below the shear line. A key with all #3 cuts will do this, too.

Notes
 * Full disassembly will erase the bitting of the lock.

Vulnerabilities

 * Lockpicking
 * Tryout keys
 * Impressioning
 * Decoding
 * Bypass
 * Destructive entry

Notes
 * Poor tolerances allow a set of 243 keys to open any SmartKey lock.
 * A decoding tool was developed by Shane Lawson (Valanx) of the locksport group FOOLS.
 * Various low-skill, quick bypass, and destructive entry techniques can be used against the SmartKey.