I'm trying to solve efficiently a quadratic equation in the finite field GF(2**128) represented as $\mathbb{Z}/(2\mathbb{Z})[x] / (x^{128} + x^7 + x^2 + x + 1)$.

Until now, I came across this paper https://www.staff.uni-mainz.de/pommeren/MathMisc/QuGlChar2.pdf that seems to tackle the problem, but I'm rather lost in the details (e.g., in section 3, how to compute the matrix $L_d$).

I am looking for a rather efficient algorithm solving this but I didn't manage to find any algorithm.

Motivation: this would be of use in cryptography for the AES-GCM mode of operation.

Any help is welcome !