A. Biryukov, D. Khovratovich, and L. Perrin, “Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs”, ToSC, vol. 2016, no. 2, pp. 226–247, Feb. 2017, doi: 10.13154/tosc.v2016.i2.226-247.