Johan Borst Bart Preneel Joos Vandewalle Linear Cryptanalysis of RC5 and RC6. 16-30 http://link.springer.de/link/service/series/0558/bibs/1636/16360016.htm 1999 conf/fse/1999 FSE db/conf/fse/fse99.html#BorstPV99