| Type | Data | Memory | Time | Reference |
|---|---|---|---|---|
| Tag second-preimage attack, $\omega = 16$ | $2^{11}$ | $2^{11}$ | $2^{22}$ | Leurent 1) |
| Tag second-preimage attack, $\omega = 32$ | $2^{16}$ | $2^{15}$ | $2^{31}$ | Leurent 2) |
| Tag second-preimage attack, $\omega = 64$ | $2^{22}$ | $2^{23}$ | $2^{45}$ | Leurent 3) |
| Forgery due to padding weakness | Fuhr and Leurent on Cryptographic Competitions |