What is the AEGIS design rationale for one way rounds and slow diffusion?

The AEGIS reference document doesn't specify why the authors chose a slow diffusion process and a one way round transformation.

As you can see the previous state is XORed with AES applied to itself shifted by one (wrapped around). This is not a permutation.

The diffusion is also slow when comparing to the possibilities that the AES 4x4 byte matrix allows. See for example Haraka v2 hash:

Above are two permutation variants @ 256 bits and 512 bits respectively.

This is done with columns, if you shuffle bytes you can go up to a 2048 bit state with amazing diffusion potential (16 AES ops, 1 byte taken from each for the next round).

AEGIS instead goes for much slower diffusion.

• Looks like type-3 Feistel. Probably used to maximize what can be executed in parallel. Inverse is not needed so it can (must?) be one-way. Related to diffusion paper states: "In AEGIS, the first difference in the state would pass through at least 4 AES round functions before being affected by another difference. In addition, when a difference passes through AES round functions, the differences are injected into at least four elements in the state, so it becomes more difficult to eliminate the state difference." Commented Oct 15, 2023 at 8:00
• Feistel networks are permutations. They are invertible. Permutations are used inside primitives to preserve entropy, when using one way functions multiple rounds in a row you can have internal collisions and it's difficult to reason about them. Here is a type 3 feistel: media.springernature.com/lw685/springer-static/image/… Commented Oct 15, 2023 at 16:43
• Yes, it has additional F operation that makes it non-inverable. Probably internal collisions are not significant due to big block size. It is very specific design. If you don't get good answer you can also try to ask authors. Commented Oct 15, 2023 at 17:09
• Also note there is no "permutation" word in the paper. They mention stream cipher. Commented Oct 16, 2023 at 6:22