Some extra context: here's Maurer [1, §4], in 1991, describing the same property exploited here, on a generic class of CBC-like functions. Also, Knudsen [2, §4

Some extra context: here's Maurer [1, §4], in 1991, describing the same property exploited here, on a generic class of CBC-like functions. Also, Knudsen [2, §4.4] on his 1994 PhD thesis. I believe Schneier et al.'s 'Practical Cryptography' also mentioned this. The Sweet32 paper only mentions papers from 2011 and 2012, so one might be mislead to believe this was something relatively new. [1] https://dx.doi.org/10.1007/3-540-46416-6_39 https://dx.doi.org/10.1007/3-540-46416-6_39 [2] http://dx.doi.org/10.7146/dpb.v23i485.6978 http://dx.doi.org/10.7146/dpb.v23i485.6978