I know this paper, and like this approach. Reduced-round primitives let you take advantage of existent analysis, and keep <i>some</i> guarantees while improving speed. In the case of AES, we know that the probability of any differential for 4 rounds is at most 2^-113; similar for linear probabilities [1]. I&#x27;m curious why ARS-4 fails Crush; I wonder if the custom key schedule is the culprit.<p>[1] <a href="https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2005&#x2F;321" rel="nofollow">https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2005&#x2F;321</a>