Security
Against differential cryptanalysis
after 8 rounds, the probability of getting the best characteristic is lower than 2-149.7
Against linear cryptanalysis
after 8 rounds, the probability of getting the best linear approximation is lower than 2-154.6