I thought I'd post this thread for those doing future searches on the subject of keys and locks. An attempt to increase the 'body of knowledge' on the web, as I found very little out there when I was hunting.
Both Yakima & Thule use replaceable lock cylinder assemblies, and the same key blank. If the cylinder is currently in the 'unlocked' position, you can insert a master key and pull the tumbler core out of the case. This allows you to either read the key code (Yakima is stamped inside, some Thule may be on the outside) for ordering replacement keys, or replace the core. You can buy sets of matching cores so that all of your racks or cargo boxes use the same key.
In my situation, I purchased a Subaru branded Yakima bike roof rack off of Craig's List that didn't come with keys. Fortunately, the cores were left in the 'unlocked' position. I found out a couple of thinks along the way:
1) These are 5 pin locks. In the case of the Yakima lock, the farthest in pin (tip of the key) is the pin that holds the cylinder in the bore throughout it's rotation. Only 4 pins are used on standard keys for normal lock/unlock operation. If the tip spot on the key is full height (uncut), this will center the pin and serve as a master key for removing the core. All 'normal' Yakima keys have the tip ground down to prevent this feature from being used, but the key for my Thule box had this spot full height and works great as a Yakima master!
I have not explored removal of my Thule core, but it is probably a similar concept, just in a different position (maybe the first pin instead of the last...).
SECURITY NOTE -> Never leave your locks in the unlocked position, or someone with this knowledge can steal your cores!!!
2) You can order replacement pre-cut keys by cylinder number from both Yakima & Thule. Unfortunately, there is a low probability of getting one cut at your local hardware store as the blanks are not usually part of the kit most retailers get as part of stock store displays. After some research on the web, and a secure search done by my local retailer of a protected locksmith site, I found that the most commonly available blank is the ILCO X132. Apparently this was also once used by VW for some model car locks. I still had to then call around to find a locksmith that had some in stock.
Other options listed on the ILCO site are the Alba T44, ILCO BU8, Silca BT2, Taylor X132
Not sure about these, but from another casual post someone said that ILCO 62FT or F68YT work in some rooftop boxes.
Hope this helps!