B. Mennink and S. Neves, “Optimal PRFs from Blockcipher Designs”, ToSC, vol. 2017, no. 3, pp. 228–252, Sep. 2017.