Generalization of Matsui's Algorithm 1 to linear hull for key-alternating block ciphers (2013)
Röck Andrea , Nyberg Kaisa