From a749b1e58b3e2739460a982ca180d79012ab62c8 Mon Sep 17 00:00:00 2001
From: pwpiwi <pwpiwi@users.noreply.github.com>
Date: Thu, 9 Jan 2020 15:42:31 +0100
Subject: [PATCH] speedup 'hf mf chk' (#901)

* add separate timeout for tag response to nr_ar
* measure response time and use it for response timeout
* don't drop field between keyblocks
* some reformatting
* some whitespace fixes
* fishing for microseconds in TransmitFor14443a()
* allow arbitrary number of keys in MifareChkKeys()
* and move progress printing to MifareChkKeys()

Co-authored-by: uzlonewolf <github_com@hacker-nin.com>
---
 armsrc/iso14443a.c         |  96 ++++++++-----------
 armsrc/iso14443a.h         |   1 +
 armsrc/mifarecmd.c         |  91 +++++++++---------
 armsrc/mifarecmd.h         |   2 +-
 armsrc/mifareutil.c        |  88 +++++++++--------
 armsrc/mifareutil.h        |  26 +++---
 client/cmdhfmf.c           |  81 ++++++++--------
 client/mifare/mifarehost.c | 187 ++++++++++++++++++-------------------
 client/mifare/mifarehost.h |  31 +++---
 9 files changed, 284 insertions(+), 319 deletions(-)

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 0ca9873bb..31a3e4ccc 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -270,8 +270,7 @@ const bool Mod_Miller_LUT[] = {
 #define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4])
 #define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)])
 
-static void UartReset()
-{
+static void UartReset() {
 	Uart.state = STATE_UNSYNCD;
 	Uart.bitCount = 0;
 	Uart.len = 0;                       // number of decoded data bytes
@@ -280,8 +279,7 @@ static void UartReset()
 	Uart.parityBits = 0;                // holds 8 parity bits
 }
 
-static void UartInit(uint8_t *data, uint8_t *parity)
-{
+static void UartInit(uint8_t *data, uint8_t *parity) {
 	Uart.output = data;
 	Uart.parity = parity;
 	Uart.fourBits = 0x00000000;         // clear the buffer for 4 Bits
@@ -291,8 +289,7 @@ static void UartInit(uint8_t *data, uint8_t *parity)
 }
 
 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
-static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
-{
+static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time) {
 
 	Uart.fourBits = (Uart.fourBits << 8) | bit;
 
@@ -447,8 +444,7 @@ const bool Mod_Manchester_LUT[] = {
 #define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
 
 
-static void DemodReset()
-{
+static void DemodReset() {
 	Demod.state = DEMOD_UNSYNCD;
 	Demod.len = 0;                      // number of decoded data bytes
 	Demod.parityLen = 0;
@@ -461,16 +457,14 @@ static void DemodReset()
 	Demod.endTime = 0;
 }
 
-static void DemodInit(uint8_t *data, uint8_t *parity)
-{
+static void DemodInit(uint8_t *data, uint8_t *parity) {
 	Demod.output = data;
 	Demod.parity = parity;
 	DemodReset();
 }
 
 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
-static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
-{
+static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time) {
 
 	Demod.twoBits = (Demod.twoBits << 8) | bit;
 
@@ -729,8 +723,7 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
 //-----------------------------------------------------------------------------
 // Prepare tag messages
 //-----------------------------------------------------------------------------
-static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity)
-{
+static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity) {
 	ToSendReset();
 
 	// Correction bit, might be removed when not needed
@@ -778,8 +771,7 @@ static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *par
 }
 
 
-static void Code4bitAnswerAsTag(uint8_t cmd)
-{
+static void Code4bitAnswerAsTag(uint8_t cmd) {
 	int i;
 
 	ToSendReset();
@@ -853,8 +845,7 @@ static void EmLogTraceTag(uint8_t *tag_data, uint16_t tag_len, uint8_t *tag_Pari
 // Stop when button is pressed
 // Or return true when command is captured
 //-----------------------------------------------------------------------------
-static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len)
-{
+static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len) {
 	// Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
 	// only, since we are receiving, not transmitting).
 	// Signal field is off with the appropriate LED
@@ -951,8 +942,8 @@ bool prepare_allocated_tag_modulation(tag_response_info_t* response_info, uint8_
 // Main loop of simulated tag: receive commands from reader, decide what
 // response to send, and send it.
 //-----------------------------------------------------------------------------
-void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
-{
+void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data) {
+
 	uint8_t sak;
 
 	// The first response contains the ATQA (note: bytes are transmitted in reverse order).
@@ -1231,8 +1222,7 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
 
 // prepare a delayed transfer. This simply shifts ToSend[] by a number
 // of bits specified in the delay parameter.
-static void PrepareDelayedTransfer(uint16_t delay)
-{
+static void PrepareDelayedTransfer(uint16_t delay) {
 	uint8_t bitmask = 0;
 	uint8_t bits_to_shift = 0;
 	uint8_t bits_shifted = 0;
@@ -1261,8 +1251,7 @@ static void PrepareDelayedTransfer(uint16_t delay)
 // if == 0: transfer immediately and return time of transfer
 // if != 0: delay transfer until time specified
 //-------------------------------------------------------------------------------------
-static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing)
-{
+static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing) {
 	LED_B_ON();
 	LED_D_ON();
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
@@ -1270,12 +1259,12 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing
 	uint32_t ThisTransferTime = 0;
 
 	if (timing) {
-		if(*timing == 0) {                                      // Measure time
+		if (*timing == 0) {                                      // Measure time
 			*timing = (GetCountSspClk() + 8) & 0xfffffff8;
 		} else {
 			PrepareDelayedTransfer(*timing & 0x00000007);       // Delay transfer (fine tuning - up to 7 MF clock ticks)
 		}
-		if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
+		if (MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
 		while (GetCountSspClk() < (*timing & 0xfffffff8));      // Delay transfer (multiple of 8 MF clock ticks)
 		LastTimeProxToAirStart = *timing;
 	} else {
@@ -1284,12 +1273,9 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing
 		LastTimeProxToAirStart = ThisTransferTime;
 	}
 
-	// clear TXRDY
-	AT91C_BASE_SSC->SSC_THR = SEC_Y;
-
 	uint16_t c = 0;
 	for (;;) {
-		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
+		if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 			AT91C_BASE_SSC->SSC_THR = cmd[c];
 			c++;
 			if(c >= len) {
@@ -1306,8 +1292,7 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing
 //-----------------------------------------------------------------------------
 // Prepare reader command (in bits, support short frames) to send to FPGA
 //-----------------------------------------------------------------------------
-static void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity)
-{
+static void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity) {
 	int i, j;
 	int last;
 	uint8_t b;
@@ -1390,8 +1375,7 @@ static void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, cons
 // Stop when button is pressed (return 1) or field was gone (return 2)
 // Or return 0 when command is captured
 //-----------------------------------------------------------------------------
-int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
-{
+int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity) {
 	uint32_t field_off_time = -1;
 	uint32_t samples = 0;
 	int ret = 0;
@@ -1475,8 +1459,7 @@ int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
 }
 
 
-static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen)
-{
+static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen) {
 	LED_C_ON();
 
 	uint8_t b;
@@ -1578,8 +1561,7 @@ int EmSendPrecompiledCmd(tag_response_info_t *response_info) {
 //  If a response is captured return true
 //  If it takes too long return false
 //-----------------------------------------------------------------------------
-static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset)
-{
+static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset) {
 	uint32_t c;
 
 	// Set FPGA mode to "reader listen mode", no modulation (listen
@@ -1598,9 +1580,9 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receive
 	for (;;) {
 		WDT_HIT();
 
-		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
+		if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 			b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-			if(ManchesterDecoding(b, offset, 0)) {
+			if (ManchesterDecoding(b, offset, 0)) {
 				NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
 				return true;
 			} else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
@@ -1611,13 +1593,13 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receive
 }
 
 
-void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing)
-{
+void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing) {
+
 	CodeIso14443aBitsAsReaderPar(frame, bits, par);
 
 	// Send command to tag
 	TransmitFor14443a(ToSend, ToSendMax, timing);
-	if(trigger)
+	if (trigger)
 		LED_A_ON();
 
 	// Log reader command in trace buffer
@@ -1625,14 +1607,12 @@ void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t
 }
 
 
-void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing)
-{
-  ReaderTransmitBitsPar(frame, len*8, par, timing);
+void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing) {
+	ReaderTransmitBitsPar(frame, len*8, par, timing);
 }
 
 
-static void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
-{
+static void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing) {
   // Generate parity and redirect
   uint8_t par[MAX_PARITY_SIZE];
   GetParity(frame, len/8, par);
@@ -1640,8 +1620,7 @@ static void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
 }
 
 
-void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
-{
+void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing) {
   // Generate parity and redirect
   uint8_t par[MAX_PARITY_SIZE];
   GetParity(frame, len, par);
@@ -1649,17 +1628,16 @@ void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
 }
 
 
-static int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity)
-{
+static int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity) {
 	if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return false;
 	LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, false);
 	return Demod.len;
 }
 
 
-int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
-{
+int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity) {
 	if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return false;
+
 	LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, false);
 	return Demod.len;
 }
@@ -1696,7 +1674,7 @@ static void iso14a_set_ATS_times(uint8_t *ats) {
 static int GetATQA(uint8_t *resp, uint8_t *resp_par) {
 
 #define WUPA_RETRY_TIMEOUT  10  // 10ms
-	uint8_t wupa[]       = { 0x52 };  // 0x26 - REQA  0x52 - WAKE-UP
+	uint8_t wupa[]       = {ISO14443A_CMD_WUPA};  // 0x26 - REQA  0x52 - WAKE-UP
 
 	uint32_t save_iso14a_timeout = iso14a_get_timeout();
 	iso14a_set_timeout(1236/(16*8)+1);      // response to WUPA is expected at exactly 1236/fc. No need to wait longer.
@@ -1737,7 +1715,7 @@ int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, u
 	int len;
 
 	// init card struct
-	if(p_hi14a_card) {
+	if (p_hi14a_card) {
 		p_hi14a_card->uidlen = 0;
 		memset(p_hi14a_card->uid, 0, 10);
 		p_hi14a_card->ats_len = 0;
@@ -1747,7 +1725,7 @@ int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, u
 		return 0;
 	}
 
-	if(p_hi14a_card) {
+	if (p_hi14a_card) {
 		memcpy(p_hi14a_card->atqa, resp, 2);
 	}
 
@@ -2034,8 +2012,8 @@ int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, bool send_chaining, void *data, u
 // Read an ISO 14443a tag. Send out commands and store answers.
 //
 //-----------------------------------------------------------------------------
-void ReaderIso14443a(UsbCommand *c)
-{
+void ReaderIso14443a(UsbCommand *c) {
+
 	iso14a_command_t param = c->arg[0];
 	uint8_t *cmd = c->d.asBytes;
 	size_t len = c->arg[1] & 0xffff;
diff --git a/armsrc/iso14443a.h b/armsrc/iso14443a.h
index df2dcbea6..d2a94a788 100644
--- a/armsrc/iso14443a.h
+++ b/armsrc/iso14443a.h
@@ -52,4 +52,5 @@ extern int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, bool send_chaining, void *
 extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr, bool anticollision, uint8_t num_cascades, bool no_rats);
 extern void iso14a_set_trigger(bool enable);
 extern void iso14a_set_timeout(uint32_t timeout);
+extern uint32_t iso14a_get_timeout(void);
 #endif /* __ISO14443A_H */
diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c
index 89afe06a4..b9032c5fa 100644
--- a/armsrc/mifarecmd.c
+++ b/armsrc/mifarecmd.c
@@ -87,7 +87,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 			break;
 		};
 
-		if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
+		if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
 			if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 			break;
 		};
@@ -244,7 +244,7 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	}
 
 
-	if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
+	if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
 		isOK = 0;
 		if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 	}
@@ -407,7 +407,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 			break;
 		};
 
-		if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
+		if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
 			if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 			break;
 		};
@@ -705,7 +705,7 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
 		}
 
 		uint32_t nt1;
-		if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
+		if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL, NULL)) {
 			if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Auth1 error");
 			continue;
 		}
@@ -760,9 +760,8 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
 // MIFARE nested authentication.
 //
 //-----------------------------------------------------------------------------
-void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
-{
-	// params
+void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain) {
+
 	uint8_t blockNo = arg0 & 0xff;
 	uint8_t keyType = (arg0 >> 8) & 0xff;
 	uint8_t targetBlockNo = arg1 & 0xff;
@@ -771,7 +770,6 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 
 	ui64Key = bytes_to_num(datain, 6);
 
-	// variables
 	uint16_t rtr, i, j, len;
 	uint16_t davg;
 	static uint16_t dmin, dmax;
@@ -788,11 +786,10 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 	pcs = &mpcs;
 	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
 
-	uint32_t auth1_time, auth2_time;
+	uint32_t auth1_time, auth2_time, authentication_timeout = 0;
 	static uint16_t delta_time;
 
 	LED_A_ON();
-	LED_C_OFF();
 	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 
 	// free eventually allocated BigBuf memory
@@ -816,26 +813,26 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 		for (rtr = 0; rtr < 17; rtr++) {
 
 			// prepare next select. No need to power down the card.
-			if(mifare_classic_halt(pcs, cuid)) {
+			if (mifare_classic_halt(pcs, cuid)) {
 				if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 				rtr--;
 				continue;
 			}
 
 			// Test if the action was cancelled
-			if(BUTTON_PRESS()) {
+			if (BUTTON_PRESS()) {
 				isOK = -2;
 				break;
 			}
 
-			if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
+			if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
 				if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 				rtr--;
 				continue;
 			};
 
 			auth1_time = 0;
-			if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
+			if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, NULL)) {
 				if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 				rtr--;
 				continue;
@@ -846,7 +843,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 			} else {
 				auth2_time = 0;
 			}
-			if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
+			if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time, NULL)) {
 				if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 				rtr--;
 				continue;
@@ -891,10 +888,10 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 	LED_C_ON();
 
 	//  get crypted nonces for target sector
-	for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
+	for (i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
 
 		target_nt[i] = 0;
-		while(target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce
+		while (target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce
 
 			// prepare next select. No need to power down the card.
 			if(mifare_classic_halt(pcs, cuid)) {
@@ -903,19 +900,20 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 			}
 
 			// break out of the loop on button press
-			if(BUTTON_PRESS()) {
+			if (BUTTON_PRESS()) {
 				isOK = -2;
 				break;
 			}
 
-			if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
+			if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
 				if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 				continue;
 			}
 
 			auth1_time = 0;
-			if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
-				if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
+			authentication_timeout = 0;
+			if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, &authentication_timeout)) {
+				if (MF_DBGLEVEL >= 1)  Dbprintf("Nested: Auth1 error");
 				continue;
 			}
 
@@ -972,12 +970,13 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 
-	byte_t buf[4 + 4 * 4];
+	uint8_t buf[4 + 4 * 4 + 4];
 	memcpy(buf, &cuid, 4);
 	memcpy(buf+4, &target_nt[0], 4);
 	memcpy(buf+8, &target_ks[0], 4);
 	memcpy(buf+12, &target_nt[1], 4);
 	memcpy(buf+16, &target_ks[1], 4);
+	memcpy(buf+20, &authentication_timeout, 4);
 
 	LED_B_ON();
 	cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
@@ -989,49 +988,49 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 	LEDsoff();
 }
 
+
 //-----------------------------------------------------------------------------
 // MIFARE check keys. key count up to 85.
 //
 //-----------------------------------------------------------------------------
-void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
-{
+void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain) {
+
 	uint8_t blockNo = arg0 & 0xff;
-	uint8_t keyType = (arg0 >> 8) & 0xff;
+	uint8_t keyType = arg0 >> 8;
 	bool clearTrace = arg1 & 0x01;
 	bool multisectorCheck = arg1 & 0x02;
-	uint8_t set14aTimeout = (arg1 >> 8) & 0xff;
+	bool init = arg1 & 0x04;
+	bool drop_field = arg1 & 0x08;
+	uint32_t auth_timeout = arg1 >> 16;
 	uint8_t keyCount = arg2;
 
 	LED_A_ON();
 
-	// clear debug level
-	int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
-	MF_DBGLEVEL = MF_DBG_NONE;
-
-	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
-
+	if (init) {
+		iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
+	}
+	
 	if (clearTrace) {
 		clear_trace();
 	}
 	set_tracing(true);
 
-	if (set14aTimeout){
-		iso14a_set_timeout(set14aTimeout * 10); // timeout: ms = x/106  35-minimum, 50-OK 106-recommended 500-safe
-	}
+	// clear debug level. We are expecting lots of authentication failures...
+	int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
+	MF_DBGLEVEL = MF_DBG_NONE;
 
+	int res = 0;
 	if (multisectorCheck) {
 		TKeyIndex keyIndex = {{0}};
 		uint8_t sectorCnt = blockNo;
-		int res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, OLD_MF_DBGLEVEL, &keyIndex);
-
+		res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, &auth_timeout, OLD_MF_DBGLEVEL, &keyIndex);
 		if (res >= 0) {
 			cmd_send(CMD_ACK, 1, res, 0, keyIndex, 80);
 		} else {
 			cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
 		}
 	} else {	
-		int res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, OLD_MF_DBGLEVEL);
-		
+		res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, &auth_timeout, OLD_MF_DBGLEVEL);
 		if (res > 0) {
 			cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6);
 		} else {
@@ -1039,12 +1038,14 @@ void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 		}
 	}
 
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-	LED_D_OFF();
+	if (drop_field || res != 0) {
+		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+		LED_D_OFF();
+	}
 
 	// restore debug level
 	MF_DBGLEVEL = OLD_MF_DBGLEVEL;
-	
+
 	LED_A_OFF();
 }
 
@@ -1074,7 +1075,7 @@ void MifarePersonalizeUID(uint8_t keyType, uint8_t perso_option, uint8_t *data)
 
 		uint8_t block_number = 0;
 		uint64_t key = bytes_to_num(data, 6);
-		if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST)) {
+		if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST, NULL)) {
 			if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 			break;
 		}
@@ -1175,13 +1176,13 @@ void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
 	for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
 		ui64Key = emlGetKey(sectorNo, keyType);
 		if (sectorNo == 0){
-			if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
+			if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
 				isOK = false;
 				if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
 				break;
 			}
 		} else {
-			if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
+			if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED, NULL)) {
 				isOK = false;
 				if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
 				break;
diff --git a/armsrc/mifarecmd.h b/armsrc/mifarecmd.h
index c16c3a3e9..40bfb9652 100644
--- a/armsrc/mifarecmd.h
+++ b/armsrc/mifarecmd.h
@@ -25,7 +25,7 @@ extern void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *
 extern void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);
 extern void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
 extern void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain);
-extern void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain);
+extern void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain);
 extern void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
 extern void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
 extern void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
diff --git a/armsrc/mifareutil.c b/armsrc/mifareutil.c
index fe5a74857..93df109c8 100644
--- a/armsrc/mifareutil.c
+++ b/armsrc/mifareutil.c
@@ -113,9 +113,7 @@ int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd,
 			ecmd[pos] = crypto1_byte(pcs, 0x00, 0) ^ dcmd[pos];
 			par[0] |= (((filter(pcs->odd) ^ oddparity8(dcmd[pos])) & 0x01) << (7-pos));
 		}
-
 		ReaderTransmitPar(ecmd, sizeof(ecmd), par, timing);
-
 	} else {
 		ReaderTransmit(dcmd, sizeof(dcmd), timing);
 	}
@@ -143,18 +141,18 @@ int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd,
 	return len;
 }
 
+
 // mifare classic commands
-int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested)
-{
-	return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL);
+int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *auth_timeout) {
+
+	return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL, auth_timeout);
 }
 
-int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing)
-{
-	// variables
+
+int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing, uint32_t *auth_timeout) {
+
 	int len;
 	uint32_t pos;
-	uint8_t tmp4[4];
 	uint8_t par[1] = {0x00};
 	byte_t nr[4];
 	uint32_t nt, ntpp; // Supplied tag nonce
@@ -202,8 +200,7 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
 
 	// Generate (encrypted) nr+parity by loading it into the cipher (Nr)
 	par[0] = 0;
-	for (pos = 0; pos < 4; pos++)
-	{
+	for (pos = 0; pos < 4; pos++) {
 		mf_nr_ar[pos] = crypto1_byte(pcs, nr[pos], 0) ^ nr[pos];
 		par[0] |= (((filter(pcs->odd) ^ oddparity8(nr[pos])) & 0x01) << (7-pos));
 	}
@@ -212,8 +209,7 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
 	nt = prng_successor(nt,32);
 
 	//  ar+parity
-	for (pos = 4; pos < 8; pos++)
-	{
+	for (pos = 4; pos < 8; pos++) {
 		nt = prng_successor(nt,8);
 		mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);
 		par[0] |= (((filter(pcs->odd) ^ oddparity8(nt)) & 0x01) << (7-pos));
@@ -223,17 +219,24 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
 	ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
 
 	// Receive 4 byte tag answer
+	uint32_t save_timeout = iso14a_get_timeout(); // save standard timeout
+	if (auth_timeout && *auth_timeout) {
+		iso14a_set_timeout(*auth_timeout);        // set timeout for authentication response
+	}
+	uint32_t auth_timeout_start = GetCountSspClk();
 	len = ReaderReceive(receivedAnswer, receivedAnswerPar);
-	if (!len)
-	{
+	iso14a_set_timeout(save_timeout);             // restore standard timeout
+	if (!len) {
 		if (MF_DBGLEVEL >= 1)   Dbprintf("Authentication failed. Card timeout.");
 		return 2;
 	}
+	if (auth_timeout && !*auth_timeout) {         // measure time for future authentication response timeout
+		*auth_timeout = (GetCountSspClk() - auth_timeout_start - (len * 9 + 2) * 8) / 8 + 1;
+	}
 
-	memcpy(tmp4, receivedAnswer, 4);
-	ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0,0);
+	ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0, 0);
 
-	if (ntpp != bytes_to_num(tmp4, 4)) {
+	if (ntpp != bytes_to_num(receivedAnswer, 4)) {
 		if (MF_DBGLEVEL >= 1)   Dbprintf("Authentication failed. Error card response.");
 		return 3;
 	}
@@ -241,8 +244,8 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
 	return 0;
 }
 
-int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData)
-{
+
+int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) {
 	// variables
 	int len;
 	uint8_t bt[2];
@@ -811,7 +814,7 @@ int mifare_desfire_des_auth2(uint32_t uid, uint8_t *key, uint8_t *blockData){
 //
 //-----------------------------------------------------------------------------
 // one key check
-int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel) {
+int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
 
 	struct Crypto1State mpcs = {0, 0};
 	struct Crypto1State *pcs;
@@ -820,7 +823,7 @@ int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uin
 	// Iceman: use piwi's faster nonce collecting part in hardnested.
 	if (*cascade_levels == 0) { // need a full select cycle to get the uid first
 		iso14a_card_select_t card_info;
-		if(!iso14443a_select_card(uid, &card_info, cuid, true, 0, true)) {
+		if (!iso14443a_select_card(uid, &card_info, cuid, true, 0, true)) {
 			if (debugLevel >= 1)    Dbprintf("ChkKeys: Can't select card");
 			return  1;
 		}
@@ -831,32 +834,25 @@ int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uin
 			default: break;
 		}
 	} else { // no need for anticollision. We can directly select the card
-		if(!iso14443a_select_card(uid, NULL, NULL, false, *cascade_levels, true)) {
+		if (!iso14443a_select_card(uid, NULL, NULL, false, *cascade_levels, true)) {
 			if (debugLevel >= 1)    Dbprintf("ChkKeys: Can't select card (UID) lvl=%d", *cascade_levels);
 			return  1;
 		}
 	}
 
-	if(mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
-//      SpinDelayUs(AUTHENTICATION_TIMEOUT); // it not needs because mifare_classic_auth have timeout from iso14a_set_timeout()
+	if (mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST, auth_timeout)) { // authentication failed
 		return 2;
 	} else {
-/*      // let it be here. it like halt command, but maybe it will work in some strange cases
-		uint8_t dummy_answer = 0;
-		ReaderTransmit(&dummy_answer, 1, NULL);
-		int timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
-		// wait for the card to become ready again
-		while(GetCountSspClk() < timeout) {};
-*/
-		// it needs after success authentication
 		mifare_classic_halt(pcs, *cuid);
 	}
 
 	return 0;
 }
 
+
 // multi key check
-int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel) {
+int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
+
 	uint8_t uid[10];
 	uint32_t cuid = 0;
 	uint8_t cascade_levels = 0;
@@ -865,14 +861,8 @@ int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t
 	int retryCount = 0;
 	for (uint8_t i = 0; i < keyCount; i++) {
 
-		// Allow button press / usb cmd to interrupt device
-		if (BUTTON_PRESS() && !usb_poll_validate_length()) {
-			Dbprintf("ChkKeys: Cancel operation. Exit...");
-			return -2;
-		}
-
 		ui64Key = bytes_to_num(keys + i * 6, 6);
-		int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, debugLevel);
+		int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, auth_timeout, debugLevel);
 
 		// can't select
 		if (res == 1) {
@@ -894,14 +884,20 @@ int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t
 			continue; // can't auth. wrong key.
 		}
 
+		// successful authentication
 		return i + 1;
 	}
 
+	if (BUTTON_PRESS()) {
+		return -2;
+	}
+
 	return 0;
 }
 
+
 // multisector multikey check
-int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint8_t debugLevel, TKeyIndex *keyIndex) {
+int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, TKeyIndex *keyIndex) {
 	int res = 0;
 
 //  int clk = GetCountSspClk();
@@ -911,11 +907,11 @@ int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, u
 
 		int keyAB = keyType;
 		do {
-			res = MifareChkBlockKeys(keys, keyCount, FirstBlockOfSector(sc), keyAB & 0x01, debugLevel);
-			if (res < 0){
+			res = MifareChkBlockKeys(keys, keyCount, FirstBlockOfSector(sc), keyAB & 0x01, auth_timeout, debugLevel);
+			if (res < 0) {
 				return res;
 			}
-			if (res > 0){
+			if (res > 0) {
 				(*keyIndex)[keyAB & 0x01][sc] = res;
 			}
 		} while(--keyAB > 0);
@@ -923,7 +919,7 @@ int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, u
 
 //  Dbprintf("%d %d", GetCountSspClk() - clk, (GetCountSspClk() - clk)/(SectorCount*keyCount*(keyType==2?2:1)));
 
-	return 0;
+	return 1;
 }
 
 
diff --git a/armsrc/mifareutil.h b/armsrc/mifareutil.h
index 856040ca5..d8f2602e5 100644
--- a/armsrc/mifareutil.h
+++ b/armsrc/mifareutil.h
@@ -9,8 +9,8 @@
 // code for work with mifare cards.
 //-----------------------------------------------------------------------------
 
-#ifndef __MIFAREUTIL_H
-#define __MIFAREUTIL_H
+#ifndef MIFAREUTIL_H__
+#define MIFAREUTIL_H__
 
 #include <stdint.h>
 #include <stdbool.h>
@@ -19,11 +19,11 @@
 #include "usb_cdc.h"
 
 // mifare authentication
-#define CRYPT_NONE    0
-#define CRYPT_ALL     1
-#define CRYPT_REQUEST 2
-#define AUTH_FIRST    0	
-#define AUTH_NESTED   2
+#define CRYPT_NONE           0
+#define CRYPT_ALL            1
+#define CRYPT_REQUEST        2
+#define AUTH_FIRST           0
+#define AUTH_NESTED          2
 
 // reader voltage field detector
 #define MF_MINFIELDV      4000
@@ -42,10 +42,10 @@ int mifare_sendcmd(uint8_t cmd, uint8_t *data, uint8_t data_size, uint8_t* answe
 int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);
 
 // mifare classic
-int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested);
-int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing);
+int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *auth_timeout);
+int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing, uint32_t *auth_timeout);
 int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
-int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid); 
+int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid);
 int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
 
 // Ultralight/NTAG...
@@ -87,8 +87,8 @@ int emlCheckValBl(int blockNum);
 
 // mifare check keys
 typedef uint8_t TKeyIndex[2][40];
-int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel);
-int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel);
-int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint8_t debugLevel, TKeyIndex *keyIndex);
+int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);
+int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);
+int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, TKeyIndex *keyIndex);
 
 #endif
diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 22e6efac6..93c3ea65c 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -570,7 +570,7 @@ int CmdHF14AMfRestore(const char *Cmd)
 //   Nested
 //----------------------------------------------
 
-static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint8_t *timeout) {
+static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint16_t *timeout) {
 	char ctmp3[4] = {0};
 	int len = param_getlength(Cmd, indx);
 	if (len > 0 && len < 4){
@@ -582,20 +582,19 @@ static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, boo
 
 		// slow and very slow
 		if (ctmp3[0] == 's' || ctmp3[0] == 'S' || ctmp3[1] == 's' || ctmp3[1] == 'S') {
-			*timeout = 11; // slow
+			*timeout = MF_CHKKEYS_SLOWTIMEOUT; // slow
 
 			if (!paramS1 && (ctmp3[1] == 's' || ctmp3[1] == 'S')) {
-				*timeout = 53; // very slow
+				*timeout = MF_CHKKEYS_VERYSLOWTIMEOUT; // very slow
 			}
 			if (paramS1 && (ctmp3[2] == 's' || ctmp3[2] == 'S')) {
-				*timeout = 53; // very slow
+				*timeout = MF_CHKKEYS_VERYSLOWTIMEOUT; // very slow
 			}
 		}
 	}
 }
 
-int CmdHF14AMfNested(const char *Cmd)
-{
+int CmdHF14AMfNested(const char *Cmd) {
 	int i, j, res, iterations;
 	sector_t *e_sector = NULL;
 	uint8_t blockNo = 0;
@@ -606,8 +605,8 @@ int CmdHF14AMfNested(const char *Cmd)
 	uint8_t key[6] = {0, 0, 0, 0, 0, 0};
 	uint8_t keyBlock[MifareDefaultKeysSize * 6];
 	uint64_t key64 = 0;
-	// timeout in units. (ms * 106)/10 or us*0.0106
-	uint8_t btimeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default
+	// timeout in units. (ms * 106) or us*0.106
+	uint16_t timeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default
 
 	bool autosearchKey = false;
 
@@ -654,10 +653,10 @@ int CmdHF14AMfNested(const char *Cmd)
 	if (param_getchar(Cmd, 1) == '*') {
 		autosearchKey = true;
 
-		parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &btimeout14a);
+		parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &timeout14a);
 
 		PrintAndLog("--nested. sectors:%2d, block no:*, eml:%c, dmp=%c checktimeout=%d us",
-			SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106);
+			SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
 	} else {
 		blockNo = param_get8(Cmd, 1);
 
@@ -676,7 +675,7 @@ int CmdHF14AMfNested(const char *Cmd)
 		}
 
 		// check if we can authenticate to sector
-		res = mfCheckKeys(blockNo, keyType, true, 1, key, &key64);
+		res = mfCheckKeys(blockNo, keyType, timeout14a, true, 1, key, &key64);
 		if (res) {
 			PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
 			return 3;
@@ -694,19 +693,19 @@ int CmdHF14AMfNested(const char *Cmd)
 			if (ctmp != 'A' && ctmp != 'a')
 				trgKeyType = 1;
 
-			parseParamTDS(Cmd, 6, &transferToEml, &createDumpFile, &btimeout14a);
+			parseParamTDS(Cmd, 6, &transferToEml, &createDumpFile, &timeout14a);
 		} else {
-			parseParamTDS(Cmd, 4, &transferToEml, &createDumpFile, &btimeout14a);
+			parseParamTDS(Cmd, 4, &transferToEml, &createDumpFile, &timeout14a);
 		}
 
 		PrintAndLog("--nested. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us",
-			SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106);
+			SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
 	}
 
 	// one-sector nested
 	if (cmdp == 'o') { // ------------------------------------  one sector working
 		PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A');
-		int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true);
+		int16_t isOK = mfnested(blockNo, keyType, timeout14a, key, trgBlockNo, trgKeyType, keyBlock, true);
 		if (isOK < 0) {
 			switch (isOK) {
 				case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
@@ -754,7 +753,7 @@ int CmdHF14AMfNested(const char *Cmd)
 		}
 
 		PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);
-		mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, MifareDefaultKeysSize, keyBlock, e_sector);
+		mfCheckKeysSec(SectorsCnt, 2, timeout14a, true, true, true, MifareDefaultKeysSize, keyBlock, e_sector);
 
 		// get known key from array
 		bool keyFound = false;
@@ -791,7 +790,7 @@ int CmdHF14AMfNested(const char *Cmd)
 				for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) {
 					if (e_sector[sectorNo].foundKey[trgKeyType]) continue;
 					PrintAndLog("-----------------------------------------------");
-					int16_t isOK = mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate);
+					int16_t isOK = mfnested(blockNo, keyType, timeout14a, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate);
 					if(isOK < 0) {
 						switch (isOK) {
 							case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
@@ -814,7 +813,7 @@ int CmdHF14AMfNested(const char *Cmd)
 						e_sector[sectorNo].Key[trgKeyType] = key64;
 
 						// try to check this key as a key to the other sectors
-						mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, 1, keyBlock, e_sector);
+						mfCheckKeysSec(SectorsCnt, 2, timeout14a, true, true, true, 1, keyBlock, e_sector);
 					}
 				}
 			}
@@ -1049,8 +1048,8 @@ int CmdHF14AMfNestedHard(const char *Cmd)
 }
 
 
-int CmdHF14AMfChk(const char *Cmd)
-{
+int CmdHF14AMfChk(const char *Cmd) {
+
 	if (strlen(Cmd)<3) {
 		PrintAndLog("Usage:  hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d|s|ss] [<key (12 hex symbols)>] [<dic (*.dic)>]");
 		PrintAndLog("          * - all sectors");
@@ -1081,7 +1080,7 @@ int CmdHF14AMfChk(const char *Cmd)
 	uint8_t  keyType        = 0;
 	uint64_t key64          = 0;
 	// timeout in units. (ms * 106)/10 or us*0.0106
-	uint8_t  btimeout14a    = MF_CHKKEYS_DEFTIMEOUT; // fast by default
+	uint16_t  timeout14a    = MF_CHKKEYS_DEFTIMEOUT; // fast by default
 	bool     param3InUse    = false;
 	bool     transferToEml  = 0;
 	bool     createDumpFile = 0;
@@ -1134,7 +1133,7 @@ int CmdHF14AMfChk(const char *Cmd)
 		};
 	}
 
-	parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &btimeout14a);
+	parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &timeout14a);
 
 	if (singleBlock & createDumpFile) {
 		PrintAndLog (" block key check (<block no>) and write to dump file (d) combination is not supported ");
@@ -1142,10 +1141,10 @@ int CmdHF14AMfChk(const char *Cmd)
 		return 1;
 	}
 
-	param3InUse = transferToEml | createDumpFile | (btimeout14a != MF_CHKKEYS_DEFTIMEOUT);
+	param3InUse = transferToEml | createDumpFile | (timeout14a != MF_CHKKEYS_DEFTIMEOUT);
 
 	PrintAndLog("--chk keys. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us",
-			SectorsCnt, blockNo, keyType==0?'A':keyType==1?'B':'?', transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106);
+			SectorsCnt, blockNo, keyType==0?'A':keyType==1?'B':'?', transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
 
 	for (i = param3InUse; param_getchar(Cmd, 2 + i); i++) {
 		if (!param_gethex(Cmd, 2 + i, keyBlock + 6 * keycnt, 12)) {
@@ -1251,7 +1250,9 @@ int CmdHF14AMfChk(const char *Cmd)
 		for (uint32_t c = 0; c < keycnt; c += max_keys) {
 
 			uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;
-			res = mfCheckKeysSec(SectorsCnt, keyType, btimeout14a, clearTraceLog, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106
+			bool init = (c == 0);
+			bool drop_field = (c + size == keycnt);
+			res = mfCheckKeysSec(SectorsCnt, keyType, timeout14a, clearTraceLog, init, drop_field, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106
 			clearTraceLog = false;
 
 			if (res != 1) {
@@ -1269,27 +1270,23 @@ int CmdHF14AMfChk(const char *Cmd)
 	} else {
 		int keyAB = keyType;
 		do {
-			for (uint32_t c = 0; c < keycnt; c += max_keys) {
-
-				uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;
-				res = mfCheckKeys(blockNo, keyAB & 0x01, true, size, &keyBlock[6 * c], &key64);
-				clearTraceLog = false;
+			res = mfCheckKeys(blockNo, keyAB & 0x01, timeout14a, true, keycnt, keyBlock, &key64);
+			clearTraceLog = false;
 
-				if (res != 1) {
-					if (!res) {
-						// Use the common format below
-						// PrintAndLog("Found valid key:[%d:%c]%012" PRIx64, blockNo, (keyAB & 0x01)?'B':'A', key64);
-						foundAKey = true;
+			if (res != 1) {
+				if (!res) {
+					// Use the common format below
+					// PrintAndLog("Found valid key:[%d:%c]%012" PRIx64, blockNo, (keyAB & 0x01)?'B':'A', key64);
+					foundAKey = true;
 
-						// Store the Single Key for display list
-						// For a single block check, SectorsCnt = Sector that contains the block
-						e_sector[SectorsCnt-1].foundKey[(keyAB & 0x01)] = true;  // flag key found
-						e_sector[SectorsCnt-1].Key[(keyAB & 0x01)]      = key64; // Save key data
+					// Store the Single Key for display list
+					// For a single block check, SectorsCnt = Sector that contains the block
+					e_sector[SectorsCnt-1].foundKey[(keyAB & 0x01)] = true;  // flag key found
+					e_sector[SectorsCnt-1].Key[(keyAB & 0x01)]      = key64; // Save key data
 
-					}
-				} else {
-					PrintAndLog("Command execute timeout");
 				}
+			} else {
+				PrintAndLog("Command execute timeout");
 			}
 		} while(--keyAB > 0);
 	}
diff --git a/client/mifare/mifarehost.c b/client/mifare/mifarehost.c
index 3a961ef78..7b7107105 100644
--- a/client/mifare/mifarehost.c
+++ b/client/mifare/mifarehost.c
@@ -10,6 +10,7 @@
 
 #include "mifarehost.h"
 
+#include <inttypes.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -115,8 +116,7 @@ static uint32_t nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint32_t ar, u
 }
 
 
-int mfDarkside(uint64_t *key)
-{
+int mfDarkside(uint64_t *key) {
 	uint32_t uid = 0;
 	uint32_t nt = 0, nr = 0, ar = 0;
 	uint64_t par_list = 0, ks_list = 0;
@@ -196,22 +196,15 @@ int mfDarkside(uint64_t *key)
 			PrintAndLog("Found a possible key. Trying to authenticate...\n");
 		}
 
-		*key = -1;
-		uint8_t keyBlock[USB_CMD_DATA_SIZE];
-		int max_keys = USB_CMD_DATA_SIZE/6;
-		for (int i = 0; i < keycount; i += max_keys) {
-			int size = keycount - i > max_keys ? max_keys : keycount - i;
-			for (int j = 0; j < size; j++) {
-				if (par_list == 0) {
-					num_to_bytes(last_keylist[i*max_keys + j], 6, keyBlock+(j*6));
-				} else {
-					num_to_bytes(keylist[i*max_keys + j], 6, keyBlock+(j*6));
-				}
-			}
-			if (!mfCheckKeys(0, 0, false, size, keyBlock, key)) {
-				break;
-			}
+		uint8_t *keys_to_chk = malloc(keycount * 6);
+		for (int i = 0; i < keycount; i++) {
+			num_to_bytes(keylist[i], 6, keys_to_chk+i);
 		}
+ 
+		*key = -1;
+		mfCheckKeys(0, 0, 0, false, keycount, keys_to_chk, key);
+
+		free(keys_to_chk);
 
 		if (*key != -1) {
 			free(last_keylist);
@@ -228,37 +221,73 @@ int mfDarkside(uint64_t *key)
 }
 
 
-int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){
+int mfCheckKeys(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, uint32_t keycnt, uint8_t *keys, uint64_t *found_key) {
 
-	*key = -1;
+	bool display_progress = false;
+	uint64_t start_time = msclock();
+	uint64_t next_print_time = start_time + 5 * 1000;
 
-	UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), clear_trace, keycnt}}; 
-	memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
-	SendCommand(&c);
+	if (keycnt > 1000) {
+		PrintAndLog("We have %d keys to check. This will take some time!", keycnt);
+		PrintAndLog("Press button to abort.");
+		display_progress = true;
+	}
 
-	UsbCommand resp;
-	if (!WaitForResponseTimeout(CMD_ACK,&resp,3000))
-		return 1;
+	uint32_t max_keys  = (keycnt > (USB_CMD_DATA_SIZE / 6)) ? (USB_CMD_DATA_SIZE / 6) : keycnt;
+	*found_key = -1;
+	bool multisectorCheck = false;
+
+	for (int i = 0, ii = 0; i < keycnt; i += max_keys) {
+
+		if ((i + max_keys) >= keycnt) {
+			max_keys = keycnt - i;
+		}
 
-	if ((resp.arg[0] & 0xff) != 0x01) {
-		if (((int)resp.arg[1]) < 0)
-			return (int)resp.arg[1];
+		bool init = (i == 0);
+		bool drop_field = (max_keys == keycnt);
+		uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
 
-		return 2;
+		UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, max_keys}}; 
+		memcpy(c.d.asBytes, keys + i * 6, max_keys * 6);
+		SendCommand(&c);
+
+		UsbCommand resp;
+		if (!WaitForResponseTimeout(CMD_ACK, &resp, 3000))
+			return 1;
+
+		if ((resp.arg[0] & 0xff) != 0x01) {
+			if (((int)resp.arg[1]) < 0) {   // error
+				return (int)resp.arg[1];
+			} else {                        // nothing found yet
+				if (display_progress && msclock() >= next_print_time) {
+					float brute_force_per_second = (float)(i - ii) / (float)(msclock() - start_time) * 1000.0;
+					ii = i;
+					start_time = msclock();
+					next_print_time = start_time + 10 * 1000;
+					PrintAndLog(" %8d keys left | %5.1f keys/sec | worst case %6.1f seconds remaining", keycnt - i, brute_force_per_second, (keycnt-i)/brute_force_per_second);
+				}
+			}
+		} else {							// success
+			*found_key = bytes_to_num(resp.d.asBytes, 6);
+			return 0;
+		}
 	}
 
-	*key = bytes_to_num(resp.d.asBytes, 6);
-	return 0;
+	return 2;	// nothing found
 }
 
-int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint8_t timeout14a, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector){
+
+int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector) {
 
 	uint8_t keyPtr = 0;
 
 	if (e_sector == NULL)
 		return -1;
 
-	UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), (clear_trace | 0x02)|((timeout14a & 0xff) << 8), keycnt}}; 
+	bool multisectorCheck = true;
+	uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
+
+	UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, keycnt}}; 
 	memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
 	SendCommand(&c);
 
@@ -301,7 +330,7 @@ typedef
 		uint32_t uid;
 		uint32_t blockNo;
 		uint32_t keyType;
-		uint32_t nt;
+		uint32_t nt_enc;
 		uint32_t ks1;
 	} StateList_t;
 
@@ -313,12 +342,11 @@ void
 __attribute__((force_align_arg_pointer)) 
 #endif
 #endif
-*nested_worker_thread(void *arg)
-{
+*nested_worker_thread(void *arg) {
 	struct Crypto1State *p1;
 	StateList_t *statelist = arg;
 
-	statelist->head.slhead = lfsr_recovery32(statelist->ks1, statelist->nt ^ statelist->uid);
+	statelist->head.slhead = lfsr_recovery32(statelist->ks1, statelist->nt_enc ^ statelist->uid);
 	for (p1 = statelist->head.slhead; *(uint64_t *)p1 != 0; p1++);
 	statelist->len = p1 - statelist->head.slhead;
 	statelist->tail.sltail = --p1;
@@ -328,9 +356,8 @@ __attribute__((force_align_arg_pointer))
 }
 
 
-int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate)
-{
-	uint32_t i, j;
+int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate) {
+	uint32_t i;
 	uint32_t uid;
 	UsbCommand resp;
 
@@ -344,11 +371,6 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
 
 	int isOK = 1;
 
-	uint64_t next_print_time = 0;
-	uint64_t start_time;
-	float brute_force_time;
-	float brute_force_per_second;
-
 	// flush queue
 	(void)WaitForResponseTimeout(CMD_ACK,NULL,100);
 
@@ -375,11 +397,15 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
 		statelists[i].blockNo = resp.arg[2] & 0xff;
 		statelists[i].keyType = (resp.arg[2] >> 8) & 0xff;
 		statelists[i].uid = uid;
-		memcpy(&statelists[i].nt,  (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4);
+		memcpy(&statelists[i].nt_enc,  (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4);
 		memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4);
 	}
 
-	if (statelists[0].nt == statelists[1].nt && statelists[0].ks1 == statelists[1].ks1)
+	uint32_t authentication_timeout;
+	memcpy(&authentication_timeout, resp.d.asBytes + 20, 4);
+	PrintAndLog("Setting authentication timeout to %" PRIu32 "us", authentication_timeout * 1000 / 106);
+	
+	if (statelists[0].nt_enc == statelists[1].nt_enc && statelists[0].ks1 == statelists[1].ks1)
 		num_unique_nonces = 1;
 	else
 		num_unique_nonces = 2;
@@ -410,14 +436,14 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
 			savestate = *p1;
 			while(Compare16Bits(p1, savep) == 0 && p1 <= statelists[0].tail.sltail) {
 				*p3 = *p1;
-				lfsr_rollback_word(p3, statelists[0].nt ^ statelists[0].uid, 0);
+				lfsr_rollback_word(p3, statelists[0].nt_enc ^ statelists[0].uid, 0);
 				p3++;
 				p1++;
 			}
 			savestate = *p2;
 			while(Compare16Bits(p2, savep) == 0 && p2 <= statelists[1].tail.sltail) {
 				*p4 = *p2;
-				lfsr_rollback_word(p4, statelists[1].nt ^ statelists[1].uid, 0);
+				lfsr_rollback_word(p4, statelists[1].nt_enc ^ statelists[1].uid, 0);
 				p4++;
 				p2++;
 			}
@@ -435,7 +461,7 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
 	statelists[1].tail.sltail=--p4;
 
 	for (i = 0; i < 2; i++) {
-		PrintAndLog("statelist %d: length:%d block:%02d keytype:%d nt:%08X ks1:%08X", i, statelists[i].len, statelists[i].blockNo, statelists[i].keyType, statelists[i].nt, statelists[i].ks1);
+		PrintAndLog("statelist %d: length:%d block:%02d keytype:%d nt_enc:%08X ks1:%08X", i, statelists[i].len, statelists[i].blockNo, statelists[i].keyType, statelists[i].nt_enc, statelists[i].ks1);
 	}
 
 	// the statelists now contain possible keys. The key we are searching for must be in the
@@ -450,64 +476,29 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
 		PrintAndLog("Nonce 1 and 2 are the same!");
 	}
 
-	if (statelists[0].len > 100) {
-		PrintAndLog("We have %d keys to check. This will take a very long time!", statelists[0].len);
-		PrintAndLog("Press button to abort.");
-	}
-	else if (statelists[0].len < 1) {
-		PrintAndLog("No candidate keys to check!");
-	}
-	else {
-		PrintAndLog("We have %d key(s) to check.", statelists[0].len);
-	}
-
-	uint32_t max_keys  = (statelists[0].len > (USB_CMD_DATA_SIZE / 6)) ? (USB_CMD_DATA_SIZE / 6) : statelists[0].len;
-	keyBlock = calloc(max_keys, 6);
-
+	uint32_t num_keys = statelists[0].len;
+	keyBlock = calloc(num_keys, 6);
 	if (keyBlock == NULL) {
 		free(statelists[0].head.slhead);
 		free(statelists[1].head.slhead);
 		return -4;
 	}
 
-	memset(resultKey, 0, 6);
-	start_time = msclock();
-	next_print_time = start_time + 1 * 1000;
-	// The list may still contain several key candidates. Test each of them with mfCheckKeys
-	for (i = 0; i < statelists[0].len; i+=max_keys) {
-		if (next_print_time <= msclock()) {
-			brute_force_per_second = ((float)i) / (((float)(msclock() - start_time)) / 1000.0);
-			brute_force_time = ((float)(statelists[0].len - i)) / brute_force_per_second;
-			next_print_time = msclock() + 10 * 1000;
-			PrintAndLog(" %8d keys left | %5.1f keys/sec | worst case %6.1f seconds remaining", statelists[0].len - i, brute_force_per_second, brute_force_time);
-		}
-
-		if ((i+max_keys) >= statelists[0].len)
-			max_keys = statelists[0].len - i;
-
-		for (j = 0; j < max_keys; j++) {
-			crypto1_get_lfsr(statelists[0].head.slhead + i + j, &key64);
-			num_to_bytes(key64, 6, keyBlock+(j*6));
-		}
+	for (i = 0; i < num_keys; i++) {
+		crypto1_get_lfsr(statelists[0].head.slhead + i, &key64);
+		num_to_bytes(key64, 6, keyBlock + i*6);
+	}
 
-		key64 = 0;
-		isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, true, max_keys, keyBlock, &key64);
+	// The list may still contain several key candidates. Test each of them with mfCheckKeys
+	isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, authentication_timeout, true, num_keys, keyBlock, &key64);
 
-		if (isOK == 1) { // timeout
-			isOK = -1;
-			break;
-		}
-		else if (isOK < 0) { // -2 is button pressed
-            break;
-		}
-		else if (!isOK) {
-			num_to_bytes(key64, 6, resultKey);
-			break;
-		}
+	if (isOK == 0) {     // success, key found
+		num_to_bytes(key64, 6, resultKey);
 	}
 
-	if (isOK == 0 && statelists[0].len != 1)
-		PrintAndLog("Key found in %0.2f seconds after checking %d keys\n", ((float)(msclock() - start_time)) / 1000.0, i+max_keys);
+	if (isOK == 1) {     // timeout
+		isOK = -1;
+	}
 
 	free(statelists[0].head.slhead);
 	free(statelists[1].head.slhead);
diff --git a/client/mifare/mifarehost.h b/client/mifare/mifarehost.h
index 18a8a5e1b..82fe7ad8b 100644
--- a/client/mifare/mifarehost.h
+++ b/client/mifare/mifarehost.h
@@ -8,8 +8,8 @@
 // High frequency ISO14443A commands
 //-----------------------------------------------------------------------------
 
-#ifndef MIFAREHOST_H
-#define MIFAREHOST_H
+#ifndef MIFAREHOST_H__
+#define MIFAREHOST_H__
 
 #include <stdint.h>
 #include <stdbool.h>
@@ -17,18 +17,19 @@
 #include "util.h"
 
 // defaults
-// timeout in units. (ms * 106)/10 or us*0.0106
-// 5 == 500us
-#define MF_CHKKEYS_DEFTIMEOUT		5
+// timeout in units. ms * 106 or us * 0.106
+#define MF_CHKKEYS_DEFTIMEOUT         50 // 0.47ms
+#define MF_CHKKEYS_SLOWTIMEOUT       106 // 1ms
+#define MF_CHKKEYS_VERYSLOWTIMEOUT   530 // 5ms
 
 // mfCSetBlock work flags
-#define CSETBLOCK_UID 				0x01
-#define CSETBLOCK_WUPC				0x02
-#define CSETBLOCK_HALT				0x04
-#define CSETBLOCK_INIT_FIELD			0x08
-#define CSETBLOCK_RESET_FIELD			0x10
-#define CSETBLOCK_SINGLE_OPER			0x1F
-#define CSETBLOCK_MAGIC_1B 			0x40
+#define CSETBLOCK_UID               0x01
+#define CSETBLOCK_WUPC              0x02
+#define CSETBLOCK_HALT              0x04
+#define CSETBLOCK_INIT_FIELD        0x08
+#define CSETBLOCK_RESET_FIELD       0x10
+#define CSETBLOCK_SINGLE_OPER       0x1F
+#define CSETBLOCK_MAGIC_1B          0x40
 
 typedef struct {
 	uint64_t Key[2];
@@ -38,9 +39,9 @@ typedef struct {
 extern char logHexFileName[FILE_PATH_SIZE];
 
 extern int mfDarkside(uint64_t *key);
-extern int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *ResultKeys, bool calibrate);
-extern int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t *keyBlock, uint64_t *key);
-extern int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint8_t timeout14a, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector);
+extern int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *ResultKeys, bool calibrate);
+extern int mfCheckKeys(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, uint32_t keycnt, uint8_t *keyBlock, uint64_t *key);
+extern int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector);
 
 extern int mfReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data);