A multidimensional linear distinguishing attack on the Shannon cipher (2009)
Hakala Risto , Nyberg Kaisa