[proxmark3-svn] / client / nonce2key / nonce2key.c

//-----------------------------------------------------------------------------
// Merlok - June 2011
// Roel - Dec 2009
// Unknown author
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// MIFARE Darkside hack
//-----------------------------------------------------------------------------
#include "nonce2key.h"

int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
	struct Crypto1State *state;
	uint32_t i, pos, rr = 0, nr_diff;
	byte_t bt, ks3x[8], par[8][8];

	// Reset the last three significant bits of the reader nonce
	nr &= 0xffffff1f;
  
	PrintAndLog("uid(%08x) nt(%08x) par(%016"llx") ks(%016"llx") nr(%08x)\n", uid, nt, par_info, ks_info, nr);

	for ( pos = 0; pos < 8; pos++ ) {
		ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
		bt = (par_info >> (pos*8)) & 0xff;

		for ( i = 0; i < 8; i++) {
			par[7-pos][i] = (bt >> i) & 0x01;
		}
	}

	printf("+----+--------+---+-----+---------------+\n");
	printf("|diff|{nr}    |ks3|ks3^5|parity         |\n");
	printf("+----+--------+---+-----+---------------+\n");
	for ( i = 0; i < 8; i++) {
		nr_diff = nr | i << 5;
		printf("| %02x |%08x| %01x |  %01x  |", i << 5, nr_diff, ks3x[i], ks3x[i]^5);

		for (pos = 0; pos < 7; pos++) printf("%01x,", par[i][pos]);
		printf("%01x|\n", par[i][7]);
	}
	printf("+----+--------+---+-----+---------------+\n");

	clock_t t1 = clock();

	state = lfsr_common_prefix(nr, rr, ks3x, par);
	lfsr_rollback_word(state, uid ^ nt, 0);
	crypto1_get_lfsr(state, key);
	crypto1_destroy(state);

	t1 = clock() - t1;
	if ( t1 > 0 ) PrintAndLog("Time in nonce2key: %.0f ticks \n", (float)t1);
	return 0;
}

// call when PAR == 0,  special attack?  It seems to need two calls.  with same uid, block, keytype
int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, uint32_t nr, uint64_t ks_info, uint64_t * key) {

	struct Crypto1State *state;
	uint32_t i, pos, key_count;
	byte_t ks3x[8];

	uint64_t key_recovered;

	int64_t *state_s;
	static uint8_t last_blockno;
	static uint8_t last_keytype;
	static uint32_t last_uid;
	static int64_t *last_keylist;
  
	if (last_uid != uid &&
		last_blockno != blockno &&
		last_keytype != keytype &&
		last_keylist != NULL)
	{
		free(last_keylist);
		last_keylist = NULL;
	}
	last_uid = uid;
	last_blockno = blockno;
	last_keytype = keytype;

	// Reset the last three significant bits of the reader nonce
	nr &= 0xffffff1f;

	PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr);
 
	for (pos=0; pos<8; pos++) {
		ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
	}
  
  	PrintAndLog("parity is all zero, try special attack. Just wait for few more seconds...");
	
	state = lfsr_common_prefix_ex(nr, ks3x);
	state_s = (int64_t*)state;
	
	for (i = 0; (state) && ((state + i)->odd != -1); i++) {
		lfsr_rollback_word(state + i, uid ^ nt, 0);
		crypto1_get_lfsr(state + i, &key_recovered);
		*(state_s + i) = key_recovered;
	}
	
	if(!state)
		return 1;
	
	qsort(state_s, i, sizeof(*state_s), compar_int);
	*(state_s + i) = -1;
	
	//Create the intersection:
	if ( last_keylist != NULL) {

		int64_t *p1, *p2, *p3;
		p1 = p3 = last_keylist; 
		p2 = state_s;
		
		while ( *p1 != -1 && *p2 != -1 ) {
			if (compar_int(p1, p2) == 0) {
				printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",(uint64_t)(p1-last_keylist),(uint64_t)(p2-state_s),(uint64_t)(p3-last_keylist),*p1);
				*p3++ = *p1++;
				p2++;
			}
			else {
				while (compar_int(p1, p2) == -1) ++p1;
				while (compar_int(p1, p2) == 1) ++p2;
			}
		}
		key_count = p3 - last_keylist;
		PrintAndLog("one A");
	} else {
		key_count = 0;
		PrintAndLog("one B");
	}

	printf("key_count:%d\n", key_count);
	
	// The list may still contain several key candidates. Test each of them with mfCheckKeys
	uint8_t keyBlock[6] = {0,0,0,0,0,0};
	uint64_t key64;
	for (i = 0; i < key_count; i++) {
		key64 = *(last_keylist + i);
		num_to_bytes(key64, 6, keyBlock);
		key64 = 0;
		if (!mfCheckKeys(blockno, keytype, false, 1, keyBlock, &key64)) {
			*key = key64;
			free(last_keylist);
			last_keylist = NULL;
			free(state);
			return 0;
		}
	}	
	
	free(last_keylist);
	last_keylist = state_s;
	return 1;
}

// 32 bit recover key from 2 nonces
bool tryMfk32(nonces_t data, uint64_t *outputkey, bool verbose) {
	struct Crypto1State *s,*t;
	uint64_t outkey = 0;
	uint64_t key=0;     // recovered key
	uint32_t uid     = data.cuid;
	uint32_t nt      = data.nonce;  // first tag challenge (nonce)
	uint32_t nr0_enc = data.nr;  // first encrypted reader challenge
	uint32_t ar0_enc = data.ar;  // first encrypted reader response
	uint32_t nr1_enc = data.nr2; // second encrypted reader challenge
	uint32_t ar1_enc = data.ar2; // second encrypted reader response
	bool isSuccess = FALSE;
	uint8_t counter = 0;
	
	clock_t t1 = clock();
	uint32_t p64 = prng_successor(nt, 64);
		
	if ( verbose ) {
		printf("Recovering key for:\n");
		printf("    uid: %08x\n",uid);
		printf("     nt: %08x\n",nt);
		printf(" {nr_0}: %08x\n",nr0_enc);
		printf(" {ar_0}: %08x\n",ar0_enc);
		printf(" {nr_1}: %08x\n",nr1_enc);
		printf(" {ar_1}: %08x\n",ar1_enc);
		printf("\nLFSR succesors of the tag challenge:\n");
		printf("  nt': %08x\n", p64);
		printf(" nt'': %08x\n", prng_successor(p64, 32));
	}
	
	s = lfsr_recovery32(ar0_enc ^ p64, 0);
  
	for(t = s; t->odd | t->even; ++t) {
		lfsr_rollback_word(t, 0, 0);
		lfsr_rollback_word(t, nr0_enc, 1);
		lfsr_rollback_word(t, uid ^ nt, 0);
		crypto1_get_lfsr(t, &key);
		crypto1_word(t, uid ^ nt, 0);
		crypto1_word(t, nr1_enc, 1);
		if (ar1_enc == (crypto1_word(t, 0, 0) ^ p64)) {
			outkey = key;
			++counter;
			if (counter==20) break;
		}
	}
 	isSuccess = (counter > 0);
	t1 = clock() - t1;
	if ( t1 > 0 ) PrintAndLog("Time in mfkey32: %.0f ticks  - possible keys %d\n", (float)t1, counter);

	*outputkey = ( isSuccess ) ? outkey : 0;	
	crypto1_destroy(s);
	return isSuccess;
}

bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool verbose) {
	struct Crypto1State *s, *t;
	uint64_t outkey  = 0;
	uint64_t key 	 = 0;			     // recovered key
	uint32_t uid     = data.cuid;
	uint32_t nt0     = data.nonce;  // first tag challenge (nonce)
	uint32_t nr0_enc = data.nr;  // first encrypted reader challenge
	uint32_t ar0_enc = data.ar; // first encrypted reader response
	//uint32_t uid1    = le32toh(data+16);
	uint32_t nt1     = data.nonce2; // second tag challenge (nonce)
	uint32_t nr1_enc = data.nr2; // second encrypted reader challenge
	uint32_t ar1_enc = data.ar2; // second encrypted reader response	
	bool isSuccess = FALSE;
	int counter = 0;

	clock_t t1 = clock();

	uint32_t p640 = prng_successor(nt0, 64);
	uint32_t p641 = prng_successor(nt1, 64);
	
	if (verbose) {
		printf("Recovering key for:\n");
		printf("    uid: %08x\n", uid);
		printf("   nt_0: %08x\n", nt0);
		printf(" {nr_0}: %08x\n", nr0_enc);
		printf(" {ar_0}: %08x\n", ar0_enc);
		printf("   nt_1: %08x\n", nt1);
		printf(" {nr_1}: %08x\n", nr1_enc);
		printf(" {ar_1}: %08x\n", ar1_enc);
		printf("\nLFSR succesors of the tag challenge:\n");
		printf("  nt': %08x\n", p640);
		printf(" nt'': %08x\n", prng_successor(p640, 32));
	}
	
	s = lfsr_recovery32(ar0_enc ^ p640, 0);
  
	for(t = s; t->odd | t->even; ++t) {
		lfsr_rollback_word(t, 0, 0);
		lfsr_rollback_word(t, nr0_enc, 1);
		lfsr_rollback_word(t, uid ^ nt0, 0);
		crypto1_get_lfsr(t, &key);
		
		crypto1_word(t, uid ^ nt1, 0);
		crypto1_word(t, nr1_enc, 1);
		if (ar1_enc == (crypto1_word(t, 0, 0) ^ p641)) {
			outkey=key;
			++counter;
			if (counter==20) break;
		}
	}
    isSuccess	= (counter > 0);
	t1 = clock() - t1;
	if ( t1 > 0 ) PrintAndLog("Time in mfkey32_moebius: %.0f ticks  - possible keys %d\n", (float)t1, counter);

	*outputkey = ( isSuccess ) ? outkey : 0;
	crypto1_destroy(s);
	return isSuccess;
}

int tryMfk64_ex(uint8_t *data, uint64_t *outputkey){
	uint32_t uid    = le32toh(data);
	uint32_t nt     = le32toh(data+4);  // tag challenge
	uint32_t nr_enc = le32toh(data+8);  // encrypted reader challenge
	uint32_t ar_enc = le32toh(data+12); // encrypted reader response	
	uint32_t at_enc = le32toh(data+16);	// encrypted tag response
	return tryMfk64(uid, nt, nr_enc, ar_enc, at_enc, outputkey);
}

int tryMfk64(uint32_t uid, uint32_t nt, uint32_t nr_enc, uint32_t ar_enc, uint32_t at_enc, uint64_t *outputkey){
	uint64_t key = 0;		// recovered key
	uint32_t ks2;     		// keystream used to encrypt reader response
	uint32_t ks3;     		// keystream used to encrypt tag response
	struct Crypto1State *revstate;
	
	PrintAndLog("Enter mfkey64");
	clock_t t1 = clock();
	
	// Extract the keystream from the messages
	ks2 = ar_enc ^ prng_successor(nt, 64);
	ks3 = at_enc ^ prng_successor(nt, 96);
	revstate = lfsr_recovery64(ks2, ks3);
	lfsr_rollback_word(revstate, 0, 0);
	lfsr_rollback_word(revstate, 0, 0);
	lfsr_rollback_word(revstate, nr_enc, 1);
	lfsr_rollback_word(revstate, uid ^ nt, 0);
	crypto1_get_lfsr(revstate, &key);

	PrintAndLog("Found Key: [%012"llx"]", key);
	t1 = clock() - t1;
	if ( t1 > 0 ) PrintAndLog("Time in mfkey64: %.0f ticks \n", (float)t1);

	*outputkey = key;
	crypto1_destroy(revstate);
	return 0;
}
Commit	Line	Data
f89c7050 M	1	//-----------------------------------------------------------------------------
	2	// Merlok - June 2011
	3	// Roel - Dec 2009
	4	// Unknown author
	5	//
	6	// This code is licensed to you under the terms of the GNU GPL, version 2 or,
	7	// at your option, any later version. See the LICENSE.txt file for the text of
	8	// the license.
	9	//-----------------------------------------------------------------------------
	10	// MIFARE Darkside hack
	11	//-----------------------------------------------------------------------------
f89c7050	12	#include "nonce2key.h"
f89c7050	13
1c611bbd	14	int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
0de8e387	15	struct Crypto1State *state;
a0f33b66	16	uint32_t i, pos, rr = 0, nr_diff;
0de8e387	17	byte_t bt, ks3x[8], par[8][8];
b19bd5d6	18
0de8e387	19	// Reset the last three significant bits of the reader nonce
0de8e387	20	nr &= 0xffffff1f;
f89c7050	21
22635d61	22	PrintAndLog("uid(%08x) nt(%08x) par(%016"llx") ks(%016"llx") nr(%08x)\n", uid, nt, par_info, ks_info, nr);
0de8e387	23
738eeccd	24	for ( pos = 0; pos < 8; pos++ ) {
0de8e387	25	ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
0de8e387	26	bt = (par_info >> (pos*8)) & 0xff;
738eeccd	27
738eeccd	28	for ( i = 0; i < 8; i++) {
0de8e387	29	par[7-pos][i] = (bt >> i) & 0x01;
	30	}
	31	}
f89c7050	32
cd91e41c	33	printf("+----+--------+---+-----+---------------+\n");
0de8e387	34	printf("\|diff\|{nr} \|ks3\|ks3^5\|parity \|\n");
0de8e387	35	printf("+----+--------+---+-----+---------------+\n");
738eeccd	36	for ( i = 0; i < 8; i++) {
0de8e387	37	nr_diff = nr \| i << 5;
5fdf8672	38	printf("\| %02x \|%08x\| %01x \| %01x \|", i << 5, nr_diff, ks3x[i], ks3x[i]^5);
5fdf8672	39
a0f33b66	40	for (pos = 0; pos < 7; pos++) printf("%01x,", par[i][pos]);
0de8e387	41	printf("%01x\|\n", par[i][7]);
	42	}
	43	printf("+----+--------+---+-----+---------------+\n");
f89c7050	44
5fdf8672	45	clock_t t1 = clock();
5fdf8672	46
a0f33b66	47	state = lfsr_common_prefix(nr, rr, ks3x, par);
59e933fc	48	lfsr_rollback_word(state, uid ^ nt, 0);
a0f33b66	49	crypto1_get_lfsr(state, key);
a0f33b66	50	crypto1_destroy(state);
5fdf8672	51
	52	t1 = clock() - t1;
	53	if ( t1 > 0 ) PrintAndLog("Time in nonce2key: %.0f ticks \n", (float)t1);
a0f33b66	54	return 0;
f89c7050	55	}
46cd801c	56
59e933fc	57	// call when PAR == 0, special attack? It seems to need two calls. with same uid, block, keytype
	58	int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, uint32_t nr, uint64_t ks_info, uint64_t * key) {
	59
cd91e41c	60	struct Crypto1State *state;
	61	uint32_t i, pos, key_count;
	62	byte_t ks3x[8];
	63
	64	uint64_t key_recovered;
59e933fc	65
cd91e41c	66	int64_t *state_s;
59e933fc	67	static uint8_t last_blockno;
59e933fc	68	static uint8_t last_keytype;
cd91e41c	69	static uint32_t last_uid;
cd91e41c	70	static int64_t *last_keylist;
59e933fc	71
	72	if (last_uid != uid &&
	73	last_blockno != blockno &&
	74	last_keytype != keytype &&
	75	last_keylist != NULL)
	76	{
cd91e41c	77	free(last_keylist);
	78	last_keylist = NULL;
	79	}
	80	last_uid = uid;
59e933fc	81	last_blockno = blockno;
59e933fc	82	last_keytype = keytype;
cd91e41c	83
	84	// Reset the last three significant bits of the reader nonce
	85	nr &= 0xffffff1f;
	86
22635d61	87	PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr);
cd91e41c	88
	89	for (pos=0; pos<8; pos++) {
	90	ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
	91	}
	92
59e933fc	93	PrintAndLog("parity is all zero, try special attack. Just wait for few more seconds...");
cd91e41c	94
	95	state = lfsr_common_prefix_ex(nr, ks3x);
	96	state_s = (int64_t*)state;
	97
cd91e41c	98	for (i = 0; (state) && ((state + i)->odd != -1); i++) {
59e933fc	99	lfsr_rollback_word(state + i, uid ^ nt, 0);
cd91e41c	100	crypto1_get_lfsr(state + i, &key_recovered);
cd91e41c	101	*(state_s + i) = key_recovered;
cd91e41c	102	}
cd91e41c	103
	104	if(!state)
	105	return 1;
	106
	107	qsort(state_s, i, sizeof(*state_s), compar_int);
	108	*(state_s + i) = -1;
	109
	110	//Create the intersection:
	111	if ( last_keylist != NULL) {
59e933fc	112
cd91e41c	113	int64_t p1, p2, *p3;
	114	p1 = p3 = last_keylist;
	115	p2 = state_s;
59e933fc	116
cd91e41c	117	while ( p1 != -1 && p2 != -1 ) {
	118	if (compar_int(p1, p2) == 0) {
	119	printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",(uint64_t)(p1-last_keylist),(uint64_t)(p2-state_s),(uint64_t)(p3-last_keylist),*p1);
	120	p3++ = p1++;
	121	p2++;
	122	}
	123	else {
	124	while (compar_int(p1, p2) == -1) ++p1;
	125	while (compar_int(p1, p2) == 1) ++p2;
	126	}
	127	}
31cf8048	128	key_count = p3 - last_keylist;
31cf8048	129	PrintAndLog("one A");
cd91e41c	130	} else {
cd91e41c	131	key_count = 0;
31cf8048	132	PrintAndLog("one B");
cd91e41c	133	}
	134
	135	printf("key_count:%d\n", key_count);
	136
	137	// The list may still contain several key candidates. Test each of them with mfCheckKeys
59e933fc	138	uint8_t keyBlock[6] = {0,0,0,0,0,0};
cd91e41c	139	uint64_t key64;
	140	for (i = 0; i < key_count; i++) {
	141	key64 = *(last_keylist + i);
	142	num_to_bytes(key64, 6, keyBlock);
	143	key64 = 0;
59e933fc	144	if (!mfCheckKeys(blockno, keytype, false, 1, keyBlock, &key64)) {
cd91e41c	145	*key = key64;
	146	free(last_keylist);
	147	last_keylist = NULL;
	148	free(state);
	149	return 0;
	150	}
59e933fc	151	}
59e933fc	152
cd91e41c	153	free(last_keylist);
	154	last_keylist = state_s;
	155	return 1;
	156	}
46cd801c	157
f0e183ec	158	// 32 bit recover key from 2 nonces
ba39db37	159	bool tryMfk32(nonces_t data, uint64_t *outputkey, bool verbose) {
46cd801c	160	struct Crypto1State s,t;
f0e183ec	161	uint64_t outkey = 0;
	162	uint64_t key=0; // recovered key
	163	uint32_t uid = data.cuid;
	164	uint32_t nt = data.nonce; // first tag challenge (nonce)
	165	uint32_t nr0_enc = data.nr; // first encrypted reader challenge
	166	uint32_t ar0_enc = data.ar; // first encrypted reader response
	167	uint32_t nr1_enc = data.nr2; // second encrypted reader challenge
	168	uint32_t ar1_enc = data.ar2; // second encrypted reader response
46cd801c	169	bool isSuccess = FALSE;
f0e183ec	170	uint8_t counter = 0;
ba39db37	171
ba39db37	172	clock_t t1 = clock();
02d5a583	173	uint32_t p64 = prng_successor(nt, 64);
ba39db37	174
	175	if ( verbose ) {
	176	printf("Recovering key for:\n");
	177	printf(" uid: %08x\n",uid);
	178	printf(" nt: %08x\n",nt);
	179	printf(" {nr_0}: %08x\n",nr0_enc);
	180	printf(" {ar_0}: %08x\n",ar0_enc);
	181	printf(" {nr_1}: %08x\n",nr1_enc);
	182	printf(" {ar_1}: %08x\n",ar1_enc);
	183	printf("\nLFSR succesors of the tag challenge:\n");
	184	printf(" nt': %08x\n", p64);
	185	printf(" nt'': %08x\n", prng_successor(p64, 32));
	186	}
02d5a583	187
02d5a583	188	s = lfsr_recovery32(ar0_enc ^ p64, 0);
46cd801c	189
	190	for(t = s; t->odd \| t->even; ++t) {
	191	lfsr_rollback_word(t, 0, 0);
	192	lfsr_rollback_word(t, nr0_enc, 1);
	193	lfsr_rollback_word(t, uid ^ nt, 0);
	194	crypto1_get_lfsr(t, &key);
	195	crypto1_word(t, uid ^ nt, 0);
	196	crypto1_word(t, nr1_enc, 1);
02d5a583	197	if (ar1_enc == (crypto1_word(t, 0, 0) ^ p64)) {
f0e183ec	198	outkey = key;
46cd801c	199	++counter;
f0e183ec	200	if (counter==20) break;
46cd801c	201	}
46cd801c	202	}
f0e183ec	203	isSuccess = (counter > 0);
cd91e41c	204	t1 = clock() - t1;
f0e183ec	205	if ( t1 > 0 ) PrintAndLog("Time in mfkey32: %.0f ticks - possible keys %d\n", (float)t1, counter);
02d5a583	206
02d5a583	207	*outputkey = ( isSuccess ) ? outkey : 0;
cd91e41c	208	crypto1_destroy(s);
46cd801c	209	return isSuccess;
	210	}
	211
ba39db37	212	bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool verbose) {
738eeccd	213	struct Crypto1State s, t;
f0e183ec	214	uint64_t outkey = 0;
cd91e41c	215	uint64_t key = 0; // recovered key
f0e183ec	216	uint32_t uid = data.cuid;
	217	uint32_t nt0 = data.nonce; // first tag challenge (nonce)
	218	uint32_t nr0_enc = data.nr; // first encrypted reader challenge
	219	uint32_t ar0_enc = data.ar; // first encrypted reader response
cd91e41c	220	//uint32_t uid1 = le32toh(data+16);
f0e183ec	221	uint32_t nt1 = data.nonce2; // second tag challenge (nonce)
	222	uint32_t nr1_enc = data.nr2; // second encrypted reader challenge
	223	uint32_t ar1_enc = data.ar2; // second encrypted reader response
d8af608f	224	bool isSuccess = FALSE;
d8af608f	225	int counter = 0;
ba39db37	226
	227	clock_t t1 = clock();
	228
	229	uint32_t p640 = prng_successor(nt0, 64);
	230	uint32_t p641 = prng_successor(nt1, 64);
d8af608f	231
ba39db37	232	if (verbose) {
dfdbfa07 MF	233	printf("Recovering key for:\n");
	234	printf(" uid: %08x\n", uid);
	235	printf(" nt_0: %08x\n", nt0);
	236	printf(" {nr_0}: %08x\n", nr0_enc);
	237	printf(" {ar_0}: %08x\n", ar0_enc);
	238	printf(" nt_1: %08x\n", nt1);
	239	printf(" {nr_1}: %08x\n", nr1_enc);
	240	printf(" {ar_1}: %08x\n", ar1_enc);
dfdbfa07 MF	241	printf("\nLFSR succesors of the tag challenge:\n");
	242	printf(" nt': %08x\n", p640);
	243	printf(" nt'': %08x\n", prng_successor(p640, 32));
	244	}
b6e05350	245
02d5a583	246	s = lfsr_recovery32(ar0_enc ^ p640, 0);
d8af608f	247
	248	for(t = s; t->odd \| t->even; ++t) {
	249	lfsr_rollback_word(t, 0, 0);
	250	lfsr_rollback_word(t, nr0_enc, 1);
	251	lfsr_rollback_word(t, uid ^ nt0, 0);
	252	crypto1_get_lfsr(t, &key);
	253
	254	crypto1_word(t, uid ^ nt1, 0);
	255	crypto1_word(t, nr1_enc, 1);
02d5a583	256	if (ar1_enc == (crypto1_word(t, 0, 0) ^ p641)) {
f0e183ec	257	outkey=key;
d8af608f	258	++counter;
f0e183ec	259	if (counter==20) break;
d8af608f	260	}
d8af608f	261	}
f0e183ec	262	isSuccess = (counter > 0);
cd91e41c	263	t1 = clock() - t1;
f0e183ec	264	if ( t1 > 0 ) PrintAndLog("Time in mfkey32_moebius: %.0f ticks - possible keys %d\n", (float)t1, counter);
02d5a583	265
f0e183ec	266	*outputkey = ( isSuccess ) ? outkey : 0;
cd91e41c	267	crypto1_destroy(s);
d8af608f	268	return isSuccess;
	269	}
	270
cd91e41c	271	int tryMfk64_ex(uint8_t data, uint64_t outputkey){
	272	uint32_t uid = le32toh(data);
	273	uint32_t nt = le32toh(data+4); // tag challenge
	274	uint32_t nr_enc = le32toh(data+8); // encrypted reader challenge
	275	uint32_t ar_enc = le32toh(data+12); // encrypted reader response
	276	uint32_t at_enc = le32toh(data+16); // encrypted tag response
	277	return tryMfk64(uid, nt, nr_enc, ar_enc, at_enc, outputkey);
	278	}
46cd801c	279
cd91e41c	280	int tryMfk64(uint32_t uid, uint32_t nt, uint32_t nr_enc, uint32_t ar_enc, uint32_t at_enc, uint64_t *outputkey){
02d5a583	281	uint64_t key = 0; // recovered key
	282	uint32_t ks2; // keystream used to encrypt reader response
	283	uint32_t ks3; // keystream used to encrypt tag response
46cd801c	284	struct Crypto1State *revstate;
46cd801c	285
cd91e41c	286	PrintAndLog("Enter mfkey64");
cd91e41c	287	clock_t t1 = clock();
46cd801c	288
46cd801c	289	// Extract the keystream from the messages
	290	ks2 = ar_enc ^ prng_successor(nt, 64);
	291	ks3 = at_enc ^ prng_successor(nt, 96);
46cd801c	292	revstate = lfsr_recovery64(ks2, ks3);
	293	lfsr_rollback_word(revstate, 0, 0);
	294	lfsr_rollback_word(revstate, 0, 0);
	295	lfsr_rollback_word(revstate, nr_enc, 1);
	296	lfsr_rollback_word(revstate, uid ^ nt, 0);
	297	crypto1_get_lfsr(revstate, &key);
02d5a583	298
cd91e41c	299	PrintAndLog("Found Key: [%012"llx"]", key);
cd91e41c	300	t1 = clock() - t1;
cd91e41c	301	if ( t1 > 0 ) PrintAndLog("Time in mfkey64: %.0f ticks \n", (float)t1);
02d5a583	302
	303	*outputkey = key;
	304	crypto1_destroy(revstate);
46cd801c	305	return 0;
5fdf8672	306	}