Type | Rounds | Nonce | Complexity | Reference |
---|---|---|---|---|
Key recovery | 5/12 Initialization | Respecting | $2^{35}$ | Dobraunig, Eichlseder, Mendel, and Schläffer 1) |
Key recovery | 6/12 Initialization | Respecting | $2^{66}$ | Ibid. 2) |
Forgery | 3/12 Finalization | Respecting | $2^{33}$ | Ibid. 3) |
Forgery | 4/12 Finalization | Respecting | $2^{101}$ | Ibid. 4) |
Permutation distinguisher | 12/12 Permutation | $2^{130}$ | Ibid. 5) |