Conclusion
Design
- highly conservative
- use old techniques familiar from DES
- combine S-box with linear mapping
- bitslice implementation
Performance
- relatively slow
- small RAM usage, easily implemented on smartcard
Security
- “Generous margin of security.” -- Inventors
- No trapdoor