Grassi, L., Rechberger, C., & Schofnegger, M. (2021). Proving Resistance Against Infinitely Long Subspace Trails: How to Choose the Linear Layer. IACR Transactions on Symmetric Cryptology, 2021(2), 314–352. https://doi.org/10.46586/tosc.v2021.i2.314-352