“Don’t Reject This: Key-Recovery Timing Attacks Due to Rejection-Sampling in HQC and BIKE” (2022) IACR Transactions on Cryptographic Hardware and Embedded Systems, 2022(3), pp. 223–263. doi:10.46586/tches.v2022.i3.223-263.