“Proving Resistance Against Infinitely Long Subspace Trails: How to Choose the Linear Layer” (2021) IACR Transactions on Symmetric Cryptology, 2021(2), pp. 314–352. doi:10.46586/tosc.v2021.i2.314-352.