Phantom key

A phantom key is any combination of pin elevations that lifts the shear line on a cylinder it shouldn’t lift. Nothing in the access matrix authorised it, nobody cut it on purpose, but if you put the right uncut blank in the right cylinder, all chambers come up to shear and the door opens.

If you’ve ever charted a master key system on graph paper or a spreadsheet, the phantom problem is the thing the math can’t see directly. It emerges from the system as a whole — two valid keys, two valid cylinders, all the master pins sized correctly, and yet some unintended combination of those depths happens to align under a key not authorised for that door.

Why phantoms exist

A pin-tumbler cylinder works because each chamber’s stack of pins (bottom pin, master pin if any, top pin) sums to a fixed total height. The shear line — the boundary between the cylinder plug and the housing — sits at that fixed height. When the right key lifts the bottom pin to the right depth, every stack splits at the shear line and the plug rotates.

Master keying complicates this. To allow more than one key to open the same cylinder, you put a master pin in the chamber. The chamber now has two valid splits: one at the change-key depth, one at the master-key depth. The cylinder will open at either.

Now zoom out. A lock with six chambers, each chamber with a bottom + master pin, has 2⁶ = 64 valid pin-elevation combinations that produce six shear-line splits at once. Not all 64 correspond to keys you intended to issue. Most of them are phantoms.

This isn’t a bug in master keying — it’s a structural property. Adding a master pin to a chamber doubles the valid splits. The more master keys, change keys, and grand masters in the hierarchy, the more pins per chamber, and the more phantom combinations the cylinder will accept.

A worked example

Take a 6-pin cylinder on Lockwood 570. Suppose the bottom pins are at depths 4, 2, 6, 3, 5, 1 (the change-key cut), and the master pins are 2, —, 1, 3, —, 4 (no master pin in chamber 2 or 5).

The valid splits per chamber:

Chamber	1	2	3	4	5	6
Change-key splits at	4	2	6	3	5	1
Master-key splits at	6	2	7	6	5	5

Any combination of one valid depth per chamber will lift the shear line. The change key (4-2-6-3-5-1) is one. The master key (6-2-7-6-5-5) is another. There are 2 × 1 × 2 × 2 × 1 × 2 = 16 valid keys for this cylinder, but you only intended to issue two of them.

The other 14 are phantoms. Most are theoretical — you’d need to cut a key with that exact bitting on a 570 blank, and unless someone in the system has access to a key cutter, no one will. But if any of those 14 happens to be the bitting of another key in the same system, that other key opens this door whether you wanted it to or not.

That’s the phantom problem.

Severity classification

A phantom isn’t automatically a security failure — it depends on which key in the system the phantom corresponds to.

• Critical — a phantom that bypasses the TMK entirely. A key opens cylinders the TMK isn’t authorised for. The grand master is the apex of the hierarchy; if any other key reaches further than the GM, the structure of the hierarchy is broken at the cylinder level. Always blocks shipment.
• High — a phantom that crosses an explicit master-group boundary. East-zone master B opens a west-zone cylinder it wasn’t intended to. Common when a system was charted by hand from a hierarchy diagram without back-validation.
• Medium — a phantom between change keys in the same group. Sibling keys end up cross-accessing each other’s doors. Worth fixing on a clean system; not a security failure if everyone in the group already has equivalent privileges anyway.

How software finds them

A spreadsheet can’t enumerate phantoms because the math is combinatorial. For a 6-pin cylinder with two valid splits per chamber, you have 64 candidate keys per cylinder. Across a 30-cylinder system that’s 1,920 candidates that have to be checked against every key in the access matrix.

Software does this by exhaustive enumeration: walk every shear-line combination per cylinder, validate each against the active MACS for the profile, and check whether any key in the system would actually cut that bitting. Anything that opens a door not authorised by the matrix is flagged. The check runs in milliseconds — the only cost is writing the enumeration carefully so it doesn’t double-count.

How to chart for fewer phantoms

Some allocation methods generate fewer phantoms than others. The two patterns most commonly used are:

Total Position Progression (TPP) — change keys vary in every position. Maximum independence between keys; maximum phantom potential because every chamber gets a master pin.

Rotating Constant Method (RCM) — each change key shares one position with the TMK (the constant), and the constant rotates across keys. Change keys share DNA with the master, so chambers without master pins exist, and the phantom search space is smaller.

For commercial systems with several master groups, RCM-style allocation typically reduces phantom count by 30–50%. It doesn’t eliminate phantoms — that’s structurally impossible while keeping master keying functional — but it makes the residual phantom set easier to validate.

What to do when you find one

Phantom resolution comes in two flavours:

1. Re-allocate the affected change key. Pick a different bitting that doesn’t share the offending depth with the master pin in chamber X. Same hierarchy, same access matrix, different cuts. Re-validate.
2. Re-pin the cylinder. Use a different master pin size in the offending chamber. Sometimes the cleanest fix when the change-key bittings are otherwise locked in — for a rekey scope where you can’t change existing keys, for instance.

The right move depends on which is cheaper at this point in the job. Pre-pinning, re-allocate. Post-pinning but pre-handover, re-pin. Post-handover, you have a customer conversation and probably a rekey.

Related

→ Master pin — the mechanism that creates phantoms in the first place → TMK — the master key phantoms most commonly violate → Rotating Constant Method — an allocation pattern that reduces phantom count