"Conditional Differential Cryptanalysis of Grain-128a."

Michael Lehmann, Willi Meier (2012)
a service of Schloss Dagstuhl - Leibniz Center for Informatics