BGEAttack: recover round keys procedure works