https://123dok.net/document/zlgv707l-second-order-differential-collisions-for-reduced-sha.html