A. Bar-on, O. Dunkelman, N. Keller, E. Ronen, and A. Shamir, Improved key recovery attacks on reduced-round AES with practical data and memory complexities, Advances in Cryptology -CRYPTO 2018 -38th Annual International Cryptology Conference, vol.10992, pp.185-212, 2018.

M. Bardet, J. Faugère, B. Salvy, and P. Spaenlehauer, On the complexity of solving quadratic boolean systems, J. Complexity, vol.29, issue.1, pp.53-75, 2013.
URL : https://hal.archives-ouvertes.fr/hal-00655745

D. J. Bernstein, Circuits for integer factorization: a proposal, 2001.

D. J. Bernstein, Better price-performance ratios for generalized birthday attacks, 2007.

D. J. Bernstein and T. Lange, Revised Selected Papers, Selected Areas in Cryptography -SAC 2014 -21st International Conference, vol.8781, pp.38-58, 2014.

D. J. Bernstein, T. Lange, R. Niederhagen, C. Peters, and P. Schwabe, FSBday: Implementing Wagner's Generalized Birthday Attack, pp.18-38, 2009.

G. Bilardi and F. P. Preparata, Area-time lower-bound techniques with applications to sorting, Algorithmica, vol.1, issue.1, pp.65-91, 1986.

A. Biryukov, D. Dinu, and D. Khovratovich, Argon2: New generation of memory-hard functions for password hashing and other applications, IEEE European Symposium on Security and Privacy, pp.292-302, 2016.

D. Boneh, Advances in Cryptology -CRYPTO 2003, 23rd Annual International Cryptology Conference, vol.2729, 2003.

C. Bouillaguet, H. Chen, C. Cheng, T. Chou, R. Niederhagen et al., Fast exhaustive search for polynomial systems in F 2, Cryptographic Hardware and Embedded Systems, vol.6225, pp.203-218, 2010.

C. Bouillaguet, C. Cheng, T. Chou, R. Niederhagen, and B. Yang, Fast exhaustive search for quadratic systems in $$\mathbb {F}_{2}$$ on fpgas, Selected Areas in Cryptography -SAC 2013 -20th International Conference, vol.8282, pp.205-222, 2013.

C. Bouillaguet, C. Delaplace, and P. Fouque, Revisiting and improving algorithms for the 3xor problem, IACR Trans. Symmetric Cryptol, vol.2018, issue.1, pp.254-276, 2018.
URL : https://hal.archives-ouvertes.fr/hal-01655907

R. P. Brent and H. T. Kung, The chip complexity of binary arithmetic, Proceedings of the Twelfth Annual ACM Symposium on Theory of Computing. STOC '80, pp.190-200, 1980.

A. Casanova, J. C. Faugère, G. Macario-rat, J. Patarin, L. Perret et al., GeMSS: A Great Multivariate Short Signature. Research report
URL : https://hal.archives-ouvertes.fr/hal-01662158

S. Universités, ;. Centre, and . Team, , 2017.

M. Delcourt, T. Kleinjung, A. Lenstra, S. Nath, D. Page et al., Using the cloud to determine key strengths -triennial update, Cryptology ePrint Archive, 1221.

I. Dinur, O. Dunkelman, N. Keller, and A. Shamir, Key recovery attacks on iterated even-mansour encryption schemes, J. Cryptology, vol.29, issue.4, pp.697-728, 2016.

I. Dinur, O. Dunkelman, and A. Shamir, Improved attacks on full GOST, Fast Software Encryption -19th International Workshop, FSE 2012, vol.7549, pp.9-28, 2012.

V. Dubois, P. Fouque, A. Shamir, and J. Stern, Practical cryptanalysis of SFLASH, Advances in Cryptology -CRYPTO 2007, 27th Annual International Cryptology Conference, vol.4622, pp.1-12, 2007.
URL : https://hal.archives-ouvertes.fr/inria-00556691

C. Dwork, A. V. Goldberg, and M. Naor, On memory-bound functions for fighting spam, pp.426-444

T. Isobe, A single-key attack on the full GOST block cipher, Fast Software Encryption -18th International Workshop, vol.6733, pp.290-305, 2011.

T. Isobe and K. Shibutani, New key recovery attacks on minimal two-round evenmansour ciphers, Advances in Cryptology -ASI-ACRYPT 2017 -23rd International Conference on the Theory and Applications of Cryptology and Information Security, vol.10624, pp.244-263, 2017.

A. Joux, Algorithmic cryptanalysis, 2009.

A. Joux and V. Vitse, A crossbred algorithm for solving boolean polynomial systems, Number-Theoretic Methods in Cryptology -First International Conference, vol.10737, pp.3-21, 2017.
URL : https://hal.archives-ouvertes.fr/hal-01981516

T. Kleinjung, K. Aoki, J. Franke, A. K. Lenstra, E. Thomé et al., Factorization of a 768-bit RSA modulus, Advances in Cryptology -CRYPTO 2010, 30th Annual Cryptology Conference, vol.6223, pp.333-350, 2010.
URL : https://hal.archives-ouvertes.fr/inria-00444693

T. Kleinjung, C. Diem, A. K. Lenstra, C. Priplata, and C. Stahlke, Computation of a 768-bit prime field discrete logarithm, Advances in Cryptology -EUROCRYPT 2017 -36th Annual International Conference on the Theory and Applications of Cryptographic Techniques, vol.10210, pp.185-201, 2017.

T. Kleinjung, A. K. Lenstra, D. Page, and N. P. Smart, Using the cloud to determine key strengths, Progress in Cryptology -INDOCRYPT 2012, pp.17-39, 2012.

S. S. Kumar, C. Paar, J. Pelzl, G. Pfeiffer, and M. Schimmler, Breaking ciphers with COPACOBANA -A cost-optimized parallel code breaker, Cryptographic Hardware and Embedded Systems -CHES 2006, 8th International Workshop, vol.4249, pp.101-118, 2006.

P. Kuo, M. Schneider, Ö. Dagdelen, J. Reichelt, J. A. Buchmann et al., Extreme enumeration on GPU and in clouds --how many dollars you need to break SVP challenges, Cryptographic Hardware and Embedded Systems -CHES 2011 -13th International Workshop, vol.6917, pp.176-191, 2011.

A. K. Lenstra, A. Shamir, J. Tomlinson, and E. Tromer, Analysis of bernstein's factorization circuit, Advances in Cryptology -ASIACRYPT 2002, 8th International Conference on the Theory and Application of Cryptology and Information Security, vol.2501, pp.1-26, 2002.

G. Leurent and F. Sibleyras, Low-memory attacks against two-round even-mansour using the 3-xor problem, Advances in Cryptology -CRYPTO 2019 -39th Annual International Cryptology Conference, vol.11693, pp.210-235, 2019.

D. Lokshtanov, R. Paturi, S. Tamaki, R. R. Williams, and H. Yu, Beating brute force for systems of polynomial equations over finite fields, Proceedings of the Twenty-Eighth Annual ACM-SIAM Symposium on Discrete Algorithms, pp.2190-2202, 2017.

M. Nandi, Revisiting Security Claims of XLS and COPA. IACR Cryptology ePrint Archive, p.444, 2015.

I. Nikoli? and Y. Sasaki, Refinements of the k-tree Algorithm for the Generalized Birthday Problem, pp.683-703, 2014.

I. Nikolic, L. Wang, and S. Wu, Cryptanalysis of round-reduced led, Fast Software Encryption -20th International Workshop, FSE 2013, vol.8424, pp.112-129, 2013.

J. E. Savage, Area-time tradeoffs for matrix multiplication and related problems in vlsi models, Journal of Computer and System Sciences, vol.22, issue.2, pp.230-242, 1981.

M. Stevens, E. Bursztein, P. Karpman, A. Albertini, and Y. Markov, The first collision for full sha-1, Advances in Cryptology -CRYPTO 2017, pp.570-596, 2017.
URL : https://hal.archives-ouvertes.fr/hal-01982005

M. Stevens, A. K. Lenstra, and B. De-weger, Chosen-prefix collisions for MD5 and colliding X.509 certificates for different identities, 26th Annual International Conference on the Theory and Applications of Cryptographic Techniques, vol.4515, pp.1-22, 2007.

C. D. Thompson, Area-time complexity for vlsi, Proceedings of the Eleventh Annual ACM Symposium on Theory of Computing. STOC '79, pp.81-88, 1979.

C. D. Thompson and H. T. Kung, Sorting on a mesh-connected parallel computer, Commun. ACM, vol.20, issue.4, pp.263-271, 1977.

L. G. Valiant and G. J. Brebner, Universal schemes for parallel communication, Proceedings of the Thirteenth Annual ACM Symposium on Theory of Computing. STOC '81, pp.263-277, 1981.

P. C. Van-oorschot and M. J. Wiener, Parallel collision search with cryptanalytic applications, J. Cryptology, vol.12, issue.1, pp.1-28, 1999.

E. Vasilakis, An instruction level energy characterization of ARM processors, Computer Architecture and VLSI Systems, 2015.

P. Vitányi, Locality, communication, and interconnect length in multicomputers, SIAM Journal on Computing, vol.17, issue.4, pp.659-672, 1988.

J. Vuillemin, A combinatorial limit to the computing power of vlsi circuits, IEEE Trans. Comput, vol.32, issue.3, pp.294-300, 1983.

M. J. Wiener, The full cost of cryptanalytic attacks, J. Cryptology, vol.17, issue.2, pp.105-124, 2004.

, Wikipedia contributors: Triple des -Wikipedia, the free encyclopedia, 2019.

W. A. Wulf and S. A. Mckee, Hitting the memory wall: implications of the obvious, SIGARCH Computer Architecture News, vol.23, issue.1, pp.20-24, 1995.