“Linear Cryptanalyses of Three AEADs with GIFT-128 as Underlying Primitives” (2021) IACR Transactions on Symmetric Cryptology, 2021(2), pp. 199–221. doi:10.46586/tosc.v2021.i2.199-221.