L. Sun, W. Wang, and M. Wang, “Linear Cryptanalyses of Three AEADs with GIFT-128 as Underlying Primitives”, ToSC, vol. 2021, no. 2, pp. 199–221, Jun. 2021.