I'll give my try to explain, though I give no guarantee for correctness and would be happy if someone provided a better answer, because, I too, struggle with fully understanding the complete attack.
The "offline nested" authentication attack requires a known key (can be recovered using MFCUK, or might be known, e.g. as a default key).
The known key is used to authenticate to a sector using a constant tag nonce N_T and from there on perform nested authentication to another sector and key.
The request resets the internal streamcipher state to the sector key.
This time, the tag nonce is sent encrypted as {N_T} (also constant!).
The parity bits sent with the encrypted tag can be used to deduce some information on the nonce and reduce the possible number from 2^16 to 2^13 possibilities to speed up the attack.
Every byte sent is followed by a parity bit, where the Mifare Classic computes parity over the plaintext, while the bit of the keystream used to encrypt the parity bits is used to encrypt the next bit of the plaintext.
Additionally, if the reader sends the correct parity, but the wrong answer to the challenge (attacker can forge this situation), the tag sends an encrypted error code. With a chance of 1/256, the parity bits are correct, which leaks 12 out of 48 bits of entropy. The procecure can be repeated several times (~6 times) until the rest of the bits can be bruteforced using the obtained parity bits (the key should produce all of them).
The distance between the tag nonces used in consecutive authentication attempts strongly depends on the time between the attemts (LFSR shifts).
Herein, the attacker uses a distance estimation and parity bits to guess the nonce and recover bits of the keystream (abusing the weak PRNG that allows only 16 possible nonces to gain 32 bits of keystream), while the fact, that only odd-numbered bits of the LFSR are inputs of the filter function, is used to recover 2^16 possible keys (direct inversion). Given a nonce, the attacker can generate all possible keys, only if the low-most 16 bit are correct, the generated key is a valid candidate.
The attacker can repeat the attack with other sectors until all keys are known.
The keys of subsequent sectors can be recovered by passive eavesdropping, as just around 8 authentication attempts are needed.
Literature
https://www.researchgate.net/publication/220713937_Wirelessly_Pickpocketing_a_Mifare_Classic_Card
https://www.sciencedirect.com/science/article/pii/S0895717712002038
