Exact linear correlations and the cost of Walsh-transform key recovery, with application to SPEEDY | AIChainDay