Go to
slide 17
Linear Cryptanalysis
Forced to use symmetric expressions
6-round expression with probability 2^-42
Need 2^82 ciphertexts to break Thin-ICE with 75% probability
Other variants need even more