| Type | Rounds | Nonce | Complexity | Reference |
|---|---|---|---|---|
| Key recovery | 5/12 Initialization | Respecting | $2^{35}$ | Dobraunig, Eichlseder, Mendel, and Schläffer 1) |
| Key recovery | 6/12 Initialization | Respecting | $2^{66}$ | Ibid. 2) |
| Forgery | 3/12 Finalization | Respecting | $2^{33}$ | Ibid. 3) |
| Forgery | 4/12 Finalization | Respecting | $2^{101}$ | Ibid. 4) |
| Permutation distinguisher | 12/12 Permutation | $2^{130}$ | Ibid. 5) |