The design looks very elegant, and they manage to avoid using sboxes at all, departing from most known lightweight ciphers. It also has decent performance in 64

The design looks very elegant, and they manage to avoid using sboxes at all, departing from most known lightweight ciphers. It also has decent performance in 64-bit hardware, without having to recur to bitslicing, which is nice. The whole round has algebraic degree 2, like Keccak, which makes things easier to analyze when it comes to differential and linear cryptanalysis. Hard to say much more at this point.