1. [1] A. Albertini, J.-P. Aumasson, M. Eichlseder, F. Mendel, and M. Schläffer, “Malicious Hashing: Eve's Variant of SHA-1,” Selected Areas in Cryptography — SAC 2014, Lecture Notes in Computer Science, vol.8781, pp.1-19, Springer, 2014.
2. [2] R. AlTawy and A.M. Youssef, “Watch your constants: Malicious Streebog.” Cryptology ePrint Archive, Report 2014/879, 2014. http://eprint.iacr.org/
3. [3] F. Armknecht, E. Fleischmann, M. Krause, J. Lee, M. Stam, and J. Steinberger, “The preimage security of double-block-length compression functions,” Advances in Cryptology — ASIACRYPT 2011, Lecture Notes in Computer Science, vol.7073, pp.233-251, Springer, 2011.
4. [4] G. Bertoni, J. Daemen, M. Peeters, and G. Van Assche, “The Keccak sponge function family,” 2008. http://keccak.noekeon.org
5. [5] A. Biryukov, D. Khovratovich, and I. Nikolic, “Distinguisher and related-key attack on the full AES-256,” CRYPTO, ed. S. Halevi, Lecture Notes in Computer Science, vol.5677, pp.231-249, Springer, 2009. An extended version is “Cryptology ePrint Archive: Report 2009/241” at http://eprint.iacr.org/