Algorithm 5: Simon [15,16]

Proceed with the following steps. Make $n-1$ repetitions of Subroutine 6 (also shown in Figure 37). This will with high probability yield $n-1$ linearly independent bit-vectors orthogonal to s. Solve the resulting linear system of equations to obtain the candidate solution $s^{*}$ Query the function for $f\left(x\right)$ and $f(x\oplus s^{*})$, for some x.   If the two queries give the same value, then the function is two-to-one and invariant under the XOR-mask $s=s^{*}$, and otherwise not.