I'm trying to understand [Understanding brute force][1] by Bernstein. I couldn't understand how the described machine can brute force the AES.
The attacker builds a very small key-search circuit. The key-search circuit has three inputs: a 12-byte string $\beta$, a 4-byte integer $n$, and a 16-byte string $s$. The key-search circuit has one output: a 16-byte string $Z(\beta, n, s)$ defined recursively by $Z(\beta, 0, s) = s$ and $Z(\beta, n + 1, s) = Z(\beta, n, H(s \oplus (\beta, n))$.