State recovery attacks against π-cipher.