Can a differential attack work for an arbitrarily large number of rounds?
scientific article; zbMATH DE number 7497445
scientific article