Mauer 71111 Lever Lock
Identification and Decoding Guide

By Topy

Step 0. Underlying mechanical weakness

The Mauer 71111 series lever lock exposes a measurable mechanical side channel during partial bolt interaction that allows individual lever states to be inferred without a correctly cut key.

This weakness exists due to the following properties:

• Each lever contains a distinct gate depth corresponding to a specific key cut.
• When the bolt throw is partially rotated, levers aligned with their true gate can move more freely than levers resting on serrations.
• This difference in movement is mechanically transmitted back through the bolt throw and lever pack.
• The lock provides sufficient access, via the keyway and bolt throw shaft, to probe and compare lever movement individually.

By applying a uniform cut depth across all levers using a simulated key, incorrect levers bind consistently while correctly aligned levers reveal themselves through increased freedom of movement or a detectable drop.

Repeating this process for each possible cut depth isolates the correct gate position for each lever independently. This converts the original exponential keyspace into a series of linear tests, dramatically reducing the effective number of remaining combinations.

Residual uncertainty typically arises from manufacturing tolerances, wear, or ambiguous feedback between adjacent cut depths. Even then, the remaining keyspace is small enough to resolve through limited brute force testing.

Step 1. Lock identification

Visual and tactile identification

A Mauer 71111 lock can be identified through the keyway by the following characteristics:

• A distinctive central post visible in the keyhole
• An asymmetrical key profile
• Tactile lever engagement when a correct 71111 key is inserted

Failure to open the lock is expected. Identification is based on correct key fit and the tactile feeling of lever engagement, not on bolt retraction.

Because one side of the 71111 key is longer than the other, the orientation of the lever pack can be determined clearly from the keyway. This allows the operator to reliably identify front to back lever order.

Having a known 71111 key available is useful for confirming both profile fit and lever engagement.

Model equivalence and naming

The following names refer to the same lock:

• Mauer 71111
• Mauer 71113
• KABA Mauer 71111
• President A
• VDS 1 Safe Lock

Mauer 71111 lock body and keys

Mauer 71111 dimensions

Step 2. Decoding approach

The lock can be decoded using a dedicated lever decoding tool designed to interface with the bolt throw shaft.

• Tool reference: link to online store

This tool provides graduated positioning that corresponds to individual lever locations.

Step 3. Decoding process

Make up key definition

A Make up key is used during decoding.

This is a key where each position that would normally be cut by machine can be slid onto a blank shaft. In essence, this makes up a simulated key one biting at a time, allowing uniform cut depths to be tested across the entire lever pack.

The Make up key is not intended to open the lock. Its sole purpose is to place the lock into a controlled internal state for probing.

Initial setup and rotation logic

1. Create a Make up key using all #1 cuts
2. Attach the Make up key to the bolt throw
3. Rotate the Make up key and bolt throw together 90 degrees relative to the lock entry, typically clockwise

The bolt throw must remain rotated to hold the internal lock state in position during decoding.

4. Rotate the Make up key only back 90 degrees, typically counter clockwise, returning it to the lock entry position
5. Remove the Make up key

The direction of rotation is not critical. What matters is that the Make up key and bolt throw are moved in discrete 90 degree increments to correctly load and unload the lever pack.

Lever probing mechanics

6. Insert the lever wire tool

Using the graduations marked on the bolt throw shaft, probe each lever position by rotating the lever wire tool left and right.

Meaningful movement is determined relative to the other levers. If most levers show little or no movement and one lever moves freely, that relative difference is the signal.

It is strongly recommended that the operator practices this technique on a cutaway lock, provided in the referenced kit, before attempting decoding on a live container or safe.

Lever wire tool movement consists of:

• Rotational movement to test individual levers left and right
• Lateral movement through the lever pack to feel for dips or drops

When scrubbing laterally, the operator should move in and out on both sides of the lever pack multiple times for the most accurate tactile feedback.

Levers resting on serrations will exhibit minimal movement.
Levers aligned with a correct gate will exhibit noticeably greater freedom.

Graduations and recording results

Graduations are marked on the bolt throw shaft, which the lever wire tool slides over. These graduations are pre marked and correspond to the thickness of each lever in the pack.

There is a small amount of mechanical slop between levers. This can make exact lever identification ambiguous, particularly between adjacent levers. Consistent practice prior to field use is advised.

Consistency across probes matters more than numeric graduation values.

Any probe result that potentially indicates a valid gate position should be recorded, even if uncertain. This reduces the keyspace during later brute force testing.

Iterating through cut depths

7. Once lever states for the current cut depth are recorded, remove all tools from the lock
8. Create a new Make up key using all #2 cuts
9. Repeat the process from initial setup through recording results

Continue sequentially for all cut depths up to #7.

If a lever position is unclear, record it as a likely or possible value rather than discarding it.

After testing all cut depths, unresolved positions may remain. Ideally this should be limited to one or two positions. If more remain, re probing the lock is recommended.

Step 4. Resolving the remaining keyspace

Once the majority of lever positions are confidently identified, the remaining combinations can be brute forced.

Example result

Front to back:

• Position 1 = Cut 5
• Position 2 = Cut 3
• Position 3 = Cut 4
• Position 4 = Unknown
• Position 5 = Cut 6 or 1
• Position 6 = Cut 4
• Position 7 = Cut 3 or 6

In this example:

• 4 positions are confirmed
• 2 positions have two likely values
• 1 position is completely unknown

The original keyspace of over 800,000 combinations has been reduced to:

2 x 2 x 6 = 24 possible keys

This reduction occurs because each lever is resolved independently, collapsing the exponential keyspace into a small multiplicative remainder.

The python script keyspacegen.py can be used to generate a list of possible keys for the lock. It is available here: keyspacegen.py

Testing all remaining combinations typically takes approximately 30 to 60 minutes.