What does the minimal number of round of "nr" use Keccak to avoid collision attack?
$$nr = 12+2L$$
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
Cursory literature search suggests that the best collision attacks reach only six rounds of Keccak:
Of course, attacks only get better, so it would be imprudent to choose six rounds. This state of affairs justified the use of a mere twelve rounds in KangarooTwelve at substantial speed increase over the twenty-four used by SHA-3.