“Significantly Improved Multi-bit Differentials for Reduced Round Salsa and ChaCha” (2017) IACR Transactions on Symmetric Cryptology, 2016(2), pp. 261–287. doi:10.13154/tosc.v2016.i2.261-287.