Merge branch 'master' into 14a_rework3

[proxmark3-svn] / client / hardnested / hardnested_bf_core.c

//-----------------------------------------------------------------------------
// Copyright (C) 2016, 2017 by piwi
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// Implements a card only attack based on crypto text (encrypted nonces
// received during a nested authentication) only. Unlike other card only
// attacks this doesn't rely on implementation errors but only on the
// inherent weaknesses of the crypto1 cypher. Described in
//   Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
//   Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on 
//   Computer and Communications Security, 2015
//-----------------------------------------------------------------------------
//
// brute forcing is based on @aczids bitsliced brute forcer
// https://github.com/aczid/crypto1_bs with some modifications. Mainly:
// - don't rollback. Start with 2nd byte of nonce instead
// - reuse results of filter subfunctions
// - reuse results of previous nonces if some first bits are identical
// 
//-----------------------------------------------------------------------------
// aczid's Copyright notice:
//
// Bit-sliced Crypto-1 brute-forcing implementation
// Builds on the data structures returned by CraptEV1 craptev1_get_space(nonces, threshold, uid)
/*
Copyright (c) 2015-2016 Aram Verstegen

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
*/

#include "hardnested_bf_core.h"

#include <stdint.h>
#include <stdbool.h>
#include <stdlib.h>
#ifndef __APPLE__
#include <malloc.h>
#endif
#include <stdio.h>
#include <string.h>
#include "crapto1/crapto1.h"
#include "parity.h"

// bitslice type
// while AVX supports 256 bit vector floating point operations, we need integer operations for boolean logic
// same for AVX2 and 512 bit vectors
// using larger vectors works but seems to generate more register pressure
#if defined(__AVX512F__)
#define MAX_BITSLICES 512
#elif defined(__AVX2__)
#define MAX_BITSLICES 256
#elif defined(__AVX__)
#define MAX_BITSLICES 128
#elif defined(__SSE2__)
#define MAX_BITSLICES 128
#else // MMX or SSE or NOSIMD
#define MAX_BITSLICES 64
#endif

#define VECTOR_SIZE (MAX_BITSLICES/8)
typedef unsigned int __attribute__((aligned(VECTOR_SIZE))) __attribute__((vector_size(VECTOR_SIZE))) bitslice_value_t;
typedef union {
        bitslice_value_t value;
        uint64_t bytes64[MAX_BITSLICES/64];
        uint8_t bytes[MAX_BITSLICES/8];
} bitslice_t;

// filter function (f20)
// sourced from ``Wirelessly Pickpocketing a Mifare Classic Card'' by Flavio Garcia, Peter van Rossum, Roel Verdult and Ronny Wichers Schreur
#define f20a(a,b,c,d) (((a|b)^(a&d))^(c&((a^b)|d)))
#define f20b(a,b,c,d) (((a&b)|c)^((a^b)&(c|d)))
#define f20c(a,b,c,d,e) ((a|((b|e)&(d^e)))^((a^(b&d))&((c^d)|(b&e))))

// bit indexing
#define get_bit(n, word) (((word) >> (n)) & 1)
#define get_vector_bit(slice, value) get_bit((slice)&0x3f, value.bytes64[(slice)>>6])

// size of crypto-1 state
#define STATE_SIZE 48
// size of nonce to be decrypted
#define KEYSTREAM_SIZE 24

// endianness conversion
#define rev32(word) ((((word) & 0xff) << 24) | ((((word) >> 8) & 0xff) << 16) | ((((word) >> 16) & 0xff) << 8) | ((((word) >> 24) & 0xff)))

// this needs to be compiled several times for each instruction set. 
// For each instruction set, define a dedicated function name:
#if defined (__AVX512F__)
#define BITSLICE_TEST_NONCES bitslice_test_nonces_AVX512
#define CRACK_STATES_BITSLICED crack_states_bitsliced_AVX512
#elif defined (__AVX2__)
#define BITSLICE_TEST_NONCES bitslice_test_nonces_AVX2
#define CRACK_STATES_BITSLICED crack_states_bitsliced_AVX2
#elif defined (__AVX__)
#define BITSLICE_TEST_NONCES bitslice_test_nonces_AVX
#define CRACK_STATES_BITSLICED crack_states_bitsliced_AVX
#elif defined (__SSE2__)
#define BITSLICE_TEST_NONCES bitslice_test_nonces_SSE2
#define CRACK_STATES_BITSLICED crack_states_bitsliced_SSE2
#elif defined (__MMX__) 
#define BITSLICE_TEST_NONCES bitslice_test_nonces_MMX
#define CRACK_STATES_BITSLICED crack_states_bitsliced_MMX
#else
#define BITSLICE_TEST_NONCES bitslice_test_nonces_NOSIMD
#define CRACK_STATES_BITSLICED crack_states_bitsliced_NOSIMD
#endif

// typedefs and declaration of functions:
typedef const uint64_t crack_states_bitsliced_t(uint32_t, uint8_t*, statelist_t*, uint32_t*, uint64_t*, uint32_t, uint8_t*, noncelist_t*);
crack_states_bitsliced_t crack_states_bitsliced_AVX512;
crack_states_bitsliced_t crack_states_bitsliced_AVX2;
crack_states_bitsliced_t crack_states_bitsliced_AVX;
crack_states_bitsliced_t crack_states_bitsliced_SSE2;
crack_states_bitsliced_t crack_states_bitsliced_MMX;
crack_states_bitsliced_t crack_states_bitsliced_NOSIMD;
crack_states_bitsliced_t crack_states_bitsliced_dispatch;

typedef void bitslice_test_nonces_t(uint32_t, uint32_t*, uint8_t*);
bitslice_test_nonces_t bitslice_test_nonces_AVX512;
bitslice_test_nonces_t bitslice_test_nonces_AVX2;
bitslice_test_nonces_t bitslice_test_nonces_AVX;
bitslice_test_nonces_t bitslice_test_nonces_SSE2;
bitslice_test_nonces_t bitslice_test_nonces_MMX;
bitslice_test_nonces_t bitslice_test_nonces_NOSIMD;
bitslice_test_nonces_t bitslice_test_nonces_dispatch;

#if defined (_WIN32)
#define malloc_bitslice(x) __builtin_assume_aligned(_aligned_malloc((x), MAX_BITSLICES/8), MAX_BITSLICES/8)
#define free_bitslice(x) _aligned_free(x)
#elif defined (__APPLE__)
static void *malloc_bitslice(size_t x) {
	char *allocated_memory;
	if (posix_memalign((void**)&allocated_memory, MAX_BITSLICES/8, x)) {
		return NULL;
	} else {
		return __builtin_assume_aligned(allocated_memory, MAX_BITSLICES/8);
	}
}
#define free_bitslice(x) free(x)
#else
#define malloc_bitslice(x) memalign(MAX_BITSLICES/8, (x))
#define free_bitslice(x) free(x)
#endif

typedef enum {
	EVEN_STATE = 0,
	ODD_STATE = 1
} odd_even_t;


// arrays of bitsliced states with identical values in all slices
static bitslice_t bitsliced_encrypted_nonces[256][KEYSTREAM_SIZE];
static bitslice_t bitsliced_encrypted_parity_bits[256][4];
// 1 and 0 vectors
static bitslice_t bs_ones;
static bitslice_t bs_zeroes;


void BITSLICE_TEST_NONCES(uint32_t nonces_to_bruteforce, uint32_t *bf_test_nonce, uint8_t *bf_test_nonce_par) {

	// initialize 1 and 0 vectors
    memset(bs_ones.bytes, 0xff, VECTOR_SIZE);
    memset(bs_zeroes.bytes, 0x00, VECTOR_SIZE);

	// bitslice nonces' 2nd to 4th byte
	for (uint32_t i = 0; i < nonces_to_bruteforce; i++) {
		for(uint32_t bit_idx = 0; bit_idx < KEYSTREAM_SIZE; bit_idx++){
			bool bit = get_bit(KEYSTREAM_SIZE-1-bit_idx, rev32(bf_test_nonce[i] << 8));
			if(bit){
				bitsliced_encrypted_nonces[i][bit_idx].value = bs_ones.value;
			} else {
				bitsliced_encrypted_nonces[i][bit_idx].value = bs_zeroes.value;
			}
		}
	}
	// bitslice nonces' parity (4 bits)
	for (uint32_t i = 0; i < nonces_to_bruteforce; i++) {
		for(uint32_t bit_idx = 0; bit_idx < 4; bit_idx++){
			bool bit = get_bit(4-1-bit_idx, bf_test_nonce_par[i]);
			if(bit){
				bitsliced_encrypted_parity_bits[i][bit_idx].value = bs_ones.value;
			} else {
				bitsliced_encrypted_parity_bits[i][bit_idx].value = bs_zeroes.value;
			}
		}
	}

}


const uint64_t CRACK_STATES_BITSLICED(uint32_t cuid, uint8_t *best_first_bytes, statelist_t *p, uint32_t *keys_found, uint64_t *num_keys_tested, uint32_t nonces_to_bruteforce, uint8_t *bf_test_nonce_2nd_byte, noncelist_t *nonces){

    // Unlike aczid's implementation this doesn't roll back at all when performing bitsliced bruteforce.
	// We know that the best first byte is already shifted in. Testing with the remaining three bytes of 
	// the nonces is sufficient to eliminate most of them. The small rest is tested with a simple unsliced
	// brute forcing (including roll back).

	bitslice_t states[KEYSTREAM_SIZE+STATE_SIZE];
	bitslice_t * restrict state_p;
    uint64_t key = -1;
    uint64_t bucket_states_tested = 0;
    uint32_t bucket_size[(p->len[EVEN_STATE] - 1)/MAX_BITSLICES + 1];
    uint32_t bitsliced_blocks = 0;
    uint32_t const *restrict p_even_end = p->states[EVEN_STATE] + p->len[EVEN_STATE];
#if defined (DEBUG_BRUTE_FORCE)
	uint32_t elimination_step = 0;
	#define MAX_ELIMINATION_STEP	32
	uint64_t keys_eliminated[MAX_ELIMINATION_STEP] = {0};
#endif	
#ifdef DEBUG_KEY_ELIMINATION
	bool bucket_contains_test_key[(p->len[EVEN_STATE] - 1)/MAX_BITSLICES + 1];
#endif

	// constant ones/zeroes
	bitslice_t bs_ones;
    memset(bs_ones.bytes, 0xff, VECTOR_SIZE);
	bitslice_t bs_zeroes;
    memset(bs_zeroes.bytes, 0x00, VECTOR_SIZE);
	
    // bitslice all the even states
    bitslice_t **restrict bitsliced_even_states = (bitslice_t **)malloc(((p->len[EVEN_STATE] - 1)/MAX_BITSLICES + 1) * sizeof(bitslice_t *));
	if (bitsliced_even_states == NULL) {
		printf("Out of memory error in brute_force. Aborting...");
		exit(4);
	}
    bitslice_value_t *restrict bitsliced_even_feedback = malloc_bitslice(((p->len[EVEN_STATE] - 1)/MAX_BITSLICES + 1) * sizeof(bitslice_value_t));
	if (bitsliced_even_feedback == NULL) {
		printf("Out of memory error in brute_force. Aborting...");
		exit(4);
	}
    for(uint32_t *restrict p_even = p->states[EVEN_STATE]; p_even < p_even_end; p_even += MAX_BITSLICES){
        bitslice_t *restrict lstate_p = malloc_bitslice(STATE_SIZE/2*sizeof(bitslice_t));
		if (lstate_p == NULL) {
			printf("Out of memory error in brute_force. Aborting... \n");
			exit(4);
		}
        memset(lstate_p, 0x00, STATE_SIZE/2*sizeof(bitslice_t)); // zero even bits
        // bitslice even half-states
        const uint32_t max_slices = (p_even_end-p_even) < MAX_BITSLICES ? p_even_end-p_even : MAX_BITSLICES;
        bucket_size[bitsliced_blocks] = max_slices;
#ifdef DEBUG_KEY_ELIMINATION
		bucket_contains_test_key[bitsliced_blocks] = false;
#endif
		uint32_t slice_idx;
        for(slice_idx = 0; slice_idx < max_slices; ++slice_idx){
            uint32_t e = *(p_even+slice_idx);
#ifdef DEBUG_KEY_ELIMINATION
			if (known_target_key != -1 && e == test_state[EVEN_STATE]) {
				bucket_contains_test_key[bitsliced_blocks] = true;
				// printf("bucket %d contains test key even state\n", bitsliced_blocks);
				// printf("in slice %d\n", slice_idx);
			}
#endif
            for(uint32_t bit_idx = 0; bit_idx < STATE_SIZE/2; bit_idx++, e >>= 1){
                // set even bits
                if(e&1){
                    lstate_p[bit_idx].bytes64[slice_idx>>6] |= 1ull << (slice_idx & 0x3f);
                }
            }
        }
		// padding with last even state
		for ( ; slice_idx < MAX_BITSLICES; ++slice_idx) {
            uint32_t e = *(p_even_end-1);
            for(uint32_t bit_idx = 0; bit_idx < STATE_SIZE/2; bit_idx++, e >>= 1){
                // set even bits
                if(e&1){
                    lstate_p[bit_idx].bytes64[slice_idx>>6] |= 1ull << (slice_idx & 0x3f);
                }
            }
		}			
        bitsliced_even_states[bitsliced_blocks] = lstate_p;
		// bitsliced_even_feedback[bitsliced_blocks] = bs_ones;
		bitsliced_even_feedback[bitsliced_blocks] = lstate_p[(47- 0)/2].value ^ 
                                                    lstate_p[(47-10)/2].value ^ lstate_p[(47-12)/2].value ^ lstate_p[(47-14)/2].value ^
                                                    lstate_p[(47-24)/2].value ^ lstate_p[(47-42)/2].value;
		bitsliced_blocks++;
    }
    // bitslice every odd state to every block of even states
    for(uint32_t const *restrict p_odd = p->states[ODD_STATE]; p_odd < p->states[ODD_STATE] + p->len[ODD_STATE]; ++p_odd){
        // early abort
        if(*keys_found){
            goto out;
        }
		
		// set odd state bits and pre-compute first keystream bit vector. This is the same for all blocks of even states
		
		state_p = &states[KEYSTREAM_SIZE];
		uint32_t o = *p_odd;

        // pre-compute the odd feedback bit
        bool odd_feedback_bit = evenparity32(o&0x29ce5c);
        const bitslice_value_t odd_feedback = odd_feedback_bit ? bs_ones.value : bs_zeroes.value;

		// set odd state bits
		for (uint32_t state_idx = 0; state_idx < STATE_SIZE; o >>= 1, state_idx += 2) {
			if (o & 1){
				state_p[state_idx] = bs_ones;
			} else {
				state_p[state_idx] = bs_zeroes;
			}
		}
		
		bitslice_value_t crypto1_bs_f20b_2[16];
		bitslice_value_t crypto1_bs_f20b_3[8];

		crypto1_bs_f20b_2[0] = f20b(state_p[47-25].value, state_p[47-27].value, state_p[47-29].value, state_p[47-31].value);
		crypto1_bs_f20b_3[0] = f20b(state_p[47-41].value, state_p[47-43].value, state_p[47-45].value, state_p[47-47].value);
		
		bitslice_value_t ksb[8];
		ksb[0] = f20c(f20a(state_p[47- 9].value, state_p[47-11].value, state_p[47-13].value, state_p[47-15].value),
		              f20b(state_p[47-17].value, state_p[47-19].value, state_p[47-21].value, state_p[47-23].value),
		              crypto1_bs_f20b_2[0],
		              f20a(state_p[47-33].value, state_p[47-35].value, state_p[47-37].value, state_p[47-39].value),
		              crypto1_bs_f20b_3[0]);

		uint32_t *restrict p_even = p->states[EVEN_STATE];
        for (uint32_t block_idx = 0; block_idx < bitsliced_blocks; ++block_idx, p_even += MAX_BITSLICES) {

#ifdef DEBUG_KEY_ELIMINATION
			// if (known_target_key != -1 && bucket_contains_test_key[block_idx] && *p_odd == test_state[ODD_STATE]) {
				// printf("Now testing known target key.\n");
				// printf("block_idx = %d/%d\n", block_idx, bitsliced_blocks);
			// }
#endif
            // add the even state bits
			const bitslice_t *restrict bitsliced_even_state = bitsliced_even_states[block_idx];
			for(uint32_t state_idx = 1; state_idx < STATE_SIZE; state_idx += 2) {
				state_p[state_idx] = bitsliced_even_state[state_idx/2];
			}

			// pre-compute first feedback bit vector. This is the same for all nonces
			bitslice_value_t fbb[8];
            fbb[0] = odd_feedback ^ bitsliced_even_feedback[block_idx]; 

            // vector to contain test results (1 = passed, 0 = failed)
            bitslice_t results = bs_ones;
			
			// parity_bits
			bitslice_value_t par[8];
			par[0] = bs_zeroes.value;
			uint32_t next_common_bits = 0;

            for(uint32_t tests = 0; tests < nonces_to_bruteforce; ++tests){
				// common bits with preceding test nonce
				uint32_t common_bits = next_common_bits; //tests ? trailing_zeros(bf_test_nonce_2nd_byte[tests] ^ bf_test_nonce_2nd_byte[tests-1]) : 0;
				next_common_bits = tests < nonces_to_bruteforce - 1 ? trailing_zeros(bf_test_nonce_2nd_byte[tests] ^ bf_test_nonce_2nd_byte[tests+1]) : 0;
                uint32_t parity_bit_idx = 1;							// start checking with the parity of second nonce byte
                bitslice_value_t fb_bits = fbb[common_bits];		// start with precomputed feedback bits from previous nonce
                bitslice_value_t ks_bits = ksb[common_bits];		// dito for first keystream bits
                bitslice_value_t parity_bit_vector = par[common_bits]; // dito for first parity vector
				// bitslice_value_t fb_bits = fbb[0];		// start with precomputed feedback bits from previous nonce
				// bitslice_value_t ks_bits = ksb[0];		// dito for first keystream bits
				// bitslice_value_t parity_bit_vector = par[0]; // dito for first parity vector
				state_p -= common_bits;								// and reuse the already calculated state bits
                // highest bit is transmitted/received first. We start with Bit 23 (highest bit of second nonce byte),
				// or the highest bit which differs from the previous nonce
                for (int32_t ks_idx = KEYSTREAM_SIZE-1-common_bits; ks_idx >= 0; --ks_idx) {

                    // decrypt nonce bits
                    const bitslice_value_t encrypted_nonce_bit_vector = bitsliced_encrypted_nonces[tests][ks_idx].value;
                    const bitslice_value_t decrypted_nonce_bit_vector = encrypted_nonce_bit_vector ^ ks_bits;

                    // compute real parity bits on the fly
                    parity_bit_vector ^= decrypted_nonce_bit_vector;

                    // update state
					state_p--;
                    state_p[0].value = fb_bits ^ decrypted_nonce_bit_vector;

					// update crypto1 subfunctions
					bitslice_value_t f20a_1, f20b_1, f20b_2, f20a_2, f20b_3;
					f20a_2 = f20a(state_p[47-33].value, state_p[47-35].value, state_p[47-37].value, state_p[47-39].value);
					f20b_3 = f20b(state_p[47-41].value, state_p[47-43].value, state_p[47-45].value, state_p[47-47].value);
					if (ks_idx > KEYSTREAM_SIZE - 8) {
						f20a_1 = f20a(state_p[47- 9].value, state_p[47-11].value, state_p[47-13].value, state_p[47-15].value);
						f20b_1 = f20b(state_p[47-17].value, state_p[47-19].value, state_p[47-21].value, state_p[47-23].value);
						f20b_2 = f20b(state_p[47-25].value, state_p[47-27].value, state_p[47-29].value, state_p[47-31].value);
						crypto1_bs_f20b_2[KEYSTREAM_SIZE - ks_idx] = f20b_2;
						crypto1_bs_f20b_3[KEYSTREAM_SIZE - ks_idx] = f20b_3;
					} else if (ks_idx > KEYSTREAM_SIZE - 16) {
						f20a_1 = f20a(state_p[47- 9].value, state_p[47-11].value, state_p[47-13].value, state_p[47-15].value);
						f20b_1 = crypto1_bs_f20b_2[KEYSTREAM_SIZE - ks_idx - 8];
						f20b_2 = f20b(state_p[47-25].value, state_p[47-27].value, state_p[47-29].value, state_p[47-31].value);
						crypto1_bs_f20b_2[KEYSTREAM_SIZE - ks_idx] = f20b_2; 
					} else if (ks_idx > KEYSTREAM_SIZE - 24){
						f20a_1 = f20a(state_p[47- 9].value, state_p[47-11].value, state_p[47-13].value, state_p[47-15].value);
						f20b_1 = crypto1_bs_f20b_2[KEYSTREAM_SIZE - ks_idx - 8];
						f20b_2 = crypto1_bs_f20b_3[KEYSTREAM_SIZE - ks_idx - 16];
					} else {
						f20a_1 = f20a(state_p[47- 9].value, state_p[47-11].value, state_p[47-13].value, state_p[47-15].value);
						f20b_1 = f20b(state_p[47-17].value, state_p[47-19].value, state_p[47-21].value, state_p[47-23].value);
						f20b_2 = f20b(state_p[47-25].value, state_p[47-27].value, state_p[47-29].value, state_p[47-31].value);
					}						
					// update keystream bit
					ks_bits = f20c(f20a_1, f20b_1, f20b_2, f20a_2, f20b_3);

                    // for each completed byte:
                    if ((ks_idx & 0x07) == 0) {
                        // get encrypted parity bits
                        const bitslice_value_t encrypted_parity_bit_vector = bitsliced_encrypted_parity_bits[tests][parity_bit_idx++].value;

                        // decrypt parity bits
                        const bitslice_value_t decrypted_parity_bit_vector = encrypted_parity_bit_vector ^ ks_bits;

                        // compare actual parity bits with decrypted parity bits and take count in results vector
                        results.value &= ~parity_bit_vector ^ decrypted_parity_bit_vector;

                        // make sure we still have a match in our set
                        // if(memcmp(&results, &bs_zeroes, sizeof(bitslice_t)) == 0){

                        // this is much faster on my gcc, because somehow a memcmp needlessly spills/fills all the xmm registers to/from the stack - ???
                        // the short-circuiting also helps
                        if(results.bytes64[0] == 0
#if MAX_BITSLICES > 64
                           && results.bytes64[1] == 0
#endif
#if MAX_BITSLICES > 128
                           && results.bytes64[2] == 0
                           && results.bytes64[3] == 0
#endif
                          ) {
#if defined (DEBUG_BRUTE_FORCE)						  
							if (elimination_step < MAX_ELIMINATION_STEP) {
								keys_eliminated[elimination_step] += MAX_BITSLICES;
							}
#endif
#ifdef DEBUG_KEY_ELIMINATION
							if (known_target_key != -1 && bucket_contains_test_key[block_idx] && *p_odd == test_state[ODD_STATE]) {
								printf("Known target key eliminated in brute_force.\n");
								printf("block_idx = %d/%d, nonce = %d/%d\n", block_idx, bitsliced_blocks, tests, nonces_to_bruteforce);
							}
#endif
							goto stop_tests;
						}
						// prepare for next nonce byte
#if defined (DEBUG_BRUTE_FORCE)							  
						elimination_step++;
#endif
						parity_bit_vector = bs_zeroes.value;
					}						
					// update feedback bit vector
					if (ks_idx != 0) {
						fb_bits = 
								  (state_p[47- 0].value ^ state_p[47- 5].value ^ state_p[47- 9].value ^
								   state_p[47-10].value ^ state_p[47-12].value ^ state_p[47-14].value ^
								   state_p[47-15].value ^ state_p[47-17].value ^ state_p[47-19].value ^
								   state_p[47-24].value ^ state_p[47-25].value ^ state_p[47-27].value ^
								   state_p[47-29].value ^ state_p[47-35].value ^ state_p[47-39].value ^
								   state_p[47-41].value ^ state_p[47-42].value ^ state_p[47-43].value);
					}
					// remember feedback and keystream vectors for later use
					uint8_t bit = KEYSTREAM_SIZE - ks_idx;
					if (bit <= next_common_bits) {  // if needed and not yet stored
						fbb[bit] = fb_bits;
						ksb[bit] = ks_bits;
						par[bit] = parity_bit_vector;
					}
                }
				// prepare for next nonce. Revert to initial state
				state_p = &states[KEYSTREAM_SIZE];
            }

            // all nonce tests were successful: we've found a possible key in this block!
			uint32_t *p_even_test = p_even;
            for (uint32_t results_word = 0; results_word < MAX_BITSLICES / 64; ++results_word) {
				uint64_t results64 = results.bytes64[results_word];
				for (uint32_t results_bit = 0; results_bit < 64; results_bit++) {
					if (results64 & 0x01) {
						if (verify_key(cuid, nonces, best_first_bytes, *p_odd, *p_even_test)) {
							struct Crypto1State pcs;
							pcs.odd = *p_odd;
							pcs.even = *p_even_test;
							lfsr_rollback_byte(&pcs, (cuid >> 24) ^ best_first_bytes[0], true);
							crypto1_get_lfsr(&pcs, &key);
							bucket_states_tested += 64 * results_word + results_bit;
							goto out;
						}
#ifdef DEBUG_KEY_ELIMINATION
						if (known_target_key != -1 && *p_even_test == test_state[EVEN_STATE] && *p_odd == test_state[ODD_STATE]) {
							printf("Known target key eliminated in brute_force verification.\n");
							printf("block_idx = %d/%d\n", block_idx, bitsliced_blocks);
						}
#endif
					}
#ifdef DEBUG_KEY_ELIMINATION
					if (known_target_key != -1 && *p_even_test == test_state[EVEN_STATE] && *p_odd == test_state[ODD_STATE]) {
						printf("Known target key eliminated in brute_force (results_bit == 0).\n");
						printf("block_idx = %d/%d\n", block_idx, bitsliced_blocks);
					}
#endif
					results64 >>= 1;
					p_even_test++;
					if (p_even_test == p_even_end) {
						goto stop_tests;
					}
				}
            }
stop_tests:
#if defined (DEBUG_BRUTE_FORCE)							  
			elimination_step = 0;
#endif			
            bucket_states_tested += bucket_size[block_idx];
            // prepare to set new states
			state_p = &states[KEYSTREAM_SIZE];
            continue;
        }
    }
out:
    for(uint32_t block_idx = 0; block_idx < bitsliced_blocks; ++block_idx){
        free_bitslice(bitsliced_even_states[block_idx]);
    }
	free(bitsliced_even_states);
	free_bitslice(bitsliced_even_feedback);
    __sync_fetch_and_add(num_keys_tested, bucket_states_tested);
	
#if defined (DEBUG_BRUTE_FORCE)	
	for (uint32_t i = 0; i < MAX_ELIMINATION_STEP; i++) {
		printf("Eliminated after %2u test_bytes: %5.2f%%\n", i+1, (float)keys_eliminated[i] / bucket_states_tested * 100);
	}
#endif	
    return key;
}



#ifndef __MMX__

// pointers to functions:
crack_states_bitsliced_t *crack_states_bitsliced_function_p = &crack_states_bitsliced_dispatch;
bitslice_test_nonces_t *bitslice_test_nonces_function_p = &bitslice_test_nonces_dispatch;

// determine the available instruction set at runtime and call the correct function
const uint64_t crack_states_bitsliced_dispatch(uint32_t cuid, uint8_t *best_first_bytes, statelist_t *p, uint32_t *keys_found, uint64_t *num_keys_tested, uint32_t nonces_to_bruteforce, uint8_t *bf_test_nonce_2nd_byte, noncelist_t *nonces) {
#if defined (__i386__) || defined (__x86_64__)
	#if !defined(__APPLE__) || (defined(__APPLE__) && (__clang_major__ > 8 || __clang_major__ == 8 && __clang_minor__ >= 1))
		#if (__GNUC__ >= 5) && (__GNUC__ > 5 || __GNUC_MINOR__ > 2) 
		if (__builtin_cpu_supports("avx512f")) crack_states_bitsliced_function_p = &crack_states_bitsliced_AVX512;
		else if (__builtin_cpu_supports("avx2")) crack_states_bitsliced_function_p = &crack_states_bitsliced_AVX2;
		#else
		if (__builtin_cpu_supports("avx2")) crack_states_bitsliced_function_p = &crack_states_bitsliced_AVX2;
		#endif
		else if (__builtin_cpu_supports("avx")) crack_states_bitsliced_function_p = &crack_states_bitsliced_AVX;
		else if (__builtin_cpu_supports("sse2")) crack_states_bitsliced_function_p = &crack_states_bitsliced_SSE2;
		else if (__builtin_cpu_supports("mmx")) crack_states_bitsliced_function_p = &crack_states_bitsliced_MMX;
		else
	#endif
#endif
		crack_states_bitsliced_function_p = &crack_states_bitsliced_NOSIMD;

    // call the most optimized function for this CPU
    return (*crack_states_bitsliced_function_p)(cuid, best_first_bytes, p, keys_found, num_keys_tested, nonces_to_bruteforce, bf_test_nonce_2nd_byte, nonces);
}

void bitslice_test_nonces_dispatch(uint32_t nonces_to_bruteforce, uint32_t *bf_test_nonce, uint8_t *bf_test_nonce_par) {
#if defined (__i386__) || defined (__x86_64__)	
	#if !defined(__APPLE__) || (defined(__APPLE__) && (__clang_major__ > 8 || __clang_major__ == 8 && __clang_minor__ >= 1))
		#if (__GNUC__ >= 5) && (__GNUC__ > 5 || __GNUC_MINOR__ > 2)
		if (__builtin_cpu_supports("avx512f")) bitslice_test_nonces_function_p = &bitslice_test_nonces_AVX512;
		else if (__builtin_cpu_supports("avx2")) bitslice_test_nonces_function_p = &bitslice_test_nonces_AVX2;
		#else
		if (__builtin_cpu_supports("avx2")) bitslice_test_nonces_function_p = &bitslice_test_nonces_AVX2;
		#endif
		else if (__builtin_cpu_supports("avx")) bitslice_test_nonces_function_p = &bitslice_test_nonces_AVX;
		else if (__builtin_cpu_supports("sse2")) bitslice_test_nonces_function_p = &bitslice_test_nonces_SSE2;
		else if (__builtin_cpu_supports("mmx")) bitslice_test_nonces_function_p = &bitslice_test_nonces_MMX;
		else
	#endif
#endif
		bitslice_test_nonces_function_p = &bitslice_test_nonces_NOSIMD;

    // call the most optimized function for this CPU
    (*bitslice_test_nonces_function_p)(nonces_to_bruteforce, bf_test_nonce, bf_test_nonce_par);
}

// Entries to dispatched function calls
const uint64_t crack_states_bitsliced(uint32_t cuid, uint8_t *best_first_bytes, statelist_t *p, uint32_t *keys_found, uint64_t *num_keys_tested, uint32_t nonces_to_bruteforce, uint8_t *bf_test_nonce_2nd_byte, noncelist_t *nonces) {
    return (*crack_states_bitsliced_function_p)(cuid, best_first_bytes, p, keys_found, num_keys_tested, nonces_to_bruteforce, bf_test_nonce_2nd_byte, nonces);
}

void bitslice_test_nonces(uint32_t nonces_to_bruteforce, uint32_t *bf_test_nonce, uint8_t *bf_test_nonce_par) {
    (*bitslice_test_nonces_function_p)(nonces_to_bruteforce, bf_test_nonce, bf_test_nonce_par);
}

#endif