Concrete Bit-Operation Cost of XL: For Solving Multivariate Quadratic Systems Using Wiedemann and Berlekamp-Massey eprint.iacr.org
A bit-operation cost model for XL plus Wiedemann/Berlekamp-Massey, with formulas and experiments for MQ challenge and NIST candidates.