One thing that should also be noted is that ARX hashes are relatively less well suited to silicon implementations. The Keccak team published a short and poigna

One thing that should also be noted is that ARX hashes are relatively less well suited to silicon implementations. The Keccak team published a short and poignant relevant blog post back in 2017 as an answer to that notorious "Maybe skip SHA3" blog post: https://keccak.team/2017/not_arx.html https://keccak.team/2017/not_arx.html A HN commenter from 2017 explained ARX's safety downside better than I: https://news.ycombinator.com/item?id=15292103 https://news.ycombinator.com/item?id=15292103 > The nuance that's being made here is that the public cryptanalytic results we have are from researchers that need to publish. However blackhats (be it government or private) have no such need. Thus, they do not care if the analysis is elegant or neat. > This means that ARX functions will have less published analysis, but may still be successfully attacked. > This isn't even a new argument they're making here. It's been well understood that simple cipher designs are better, because they are easier to understand. If you can understand it well, yet not break it, that gives confidence. If you don't understand it, it might break as soon as you do.