“LM-DAE: Low-Memory Deterministic Authenticated Encryption for 128-bit Security” (2020) IACR Transactions on Symmetric Cryptology, 2020(4), pp. 1–38. doi:10.46586/tosc.v2020.i4.1-38.