2021. Proving Resistance Against Infinitely Long Subspace Trails: How to Choose the Linear Layer. IACR Transactions on Symmetric Cryptology. 2021, 2 (Jun. 2021), 314–352. DOI:https://doi.org/10.46586/tosc.v2021.i2.314-352.