I am trying to learn cryptanalysis on the Keccak hash function. One of the papers on zero sum distinguishers talks about Keccak having inverse degree of 3.
I am unable to figure this out: how do you get an inverse degree of 3? For example one of the permutations Chi in Keccak does the multiplication in GF(2). So I would guess that means the image transformation for Keccak has degree 2, but am unable to figure out how they derive degree 3 for preimage or inverse or going backwards.
If someone can point me to a resource, that would be of great help, since I am unable to find one.