Mostly similar to block ciphers or permutations. Differential cryptanalysis is a good starting point. Usually one starts with a reduced-round version, often a s

Mostly similar to block ciphers or permutations. Differential cryptanalysis is a good starting point. Usually one starts with a reduced-round version, often a single round. Break one round, then see if that can be extended to 2, etc, etc. The cryptanalysis of Meow Hash[1] is instructive, since it's a weak hash and actually vulnerable in full. There's also a good Differential propagation analysis of Keccak[1] paper, using a reduced-round Keccak. There's also Rotational cryptanalysis. Here's a paper on Keccak uses that technique.[3] It was first formally defined by Khovratovich and Nikolić.[4] [1] https://peter.website/meow-hash-cryptanalysis https://peter.website/meow-hash-cryptanalysis [2] https://eprint.iacr.org/2012/163.pdf https://eprint.iacr.org/2012/163.pdf [3] https://eprint.iacr.org/2012/546.pdf https://eprint.iacr.org/2012/546.pdf [4] https://www.iacr.org/archive/fse2010/61470339/61470339.pdf https://www.iacr.org/archive/fse2010/61470339/61470339.pdf