Editing Common Scrambling Algorithm (section)

===Software implementations and bit slicing===
The stream cipher part of CSA is prone to [[bit slicing]], a software implementation technique which allows decryption of many blocks, or the same block with many different keys, at the same time. This significantly speeds up a brute force search implemented in software, although the factor is too low for a practical real-time attack.

The block cipher part is harder to bit slice, as the [[S-boxes]] involved are too large (8x8) to be efficiently implemented using logical operations, a prerequisite for bit slicing to be more efficient than a regular implementation. However, as all operations are on 8-bit subblocks, the algorithm can be implemented using regular [[SIMD]], or a form of “byteslicing”. As most SIMD instruction sets, (with the exception of [[AVX2]]) do not support parallel look-up tables, the S-box lookups are done in a non-bytesliced implementation, but their integration into the rest of the algorithm is not hampered markedly by the byteslicing.

Both techniques are used in [http://www.videolan.org/developers/libdvbcsa.html libdvbcsa], a free implementation of CSA.