A. Biryukov, D. Khovratovich, and L. Perrin, “Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs”, ToSC, vol. 2016, no. 2, pp. 226–247, Feb. 2017.