2016.05.23 22:35:02 (734845113285914624) from Daniel J. Bernstein, replying to "Samuel Neves (@sevenps)" (734831818965389312):
Each direction of diffusion of the differential is blocked by a 1. So try 2 rounds |, 2 rounds &.
2016.05.23 20:25:08 (734812425028014080) from "Paul Crowley (@ciphergoth)", replying to "Paul Crowley (@ciphergoth)" (734809803097268224):
Not knocking NORX, which is very cool! But I wouldn't use its H-op to build a Chor-Chor.
2016.05.23 20:54:52 (734819905158172673) from "Samuel Neves (@sevenps)", replying to "Paul Crowley (@ciphergoth)" (734812425028014080):
"Sorsa" was one of our first choices. Even after 20 rounds, it is easily distinguishable from random.
2016.05.23 21:12:14 (734824276591792128) from "Paul Crowley (@ciphergoth)", replying to "Samuel Neves (@sevenps)" (734819905158172673):
OK I am surprised and intrigued, thanks! Against a truncated-DC-based distinguisher, or LC, or something else?
2016.05.23 21:42:12 (734831818965389312) from "Samuel Neves (@sevenps)", replying to "Paul Crowley (@ciphergoth)" (734824276591792128):
https://gist.github.com/sneves/15d7ae82831044b0ac12c413adad36bf (Note the mins) Didn't investigate further, we just moved on from that candidate.