# Aside from Keccak, are there any keyed/unkeyed permutations where the choice of all rotation constants is not based on heuristic methods?

I am interested to see examples of cryptographic algorithms (namely, keyed or unkeyed permutations that transform an $$n$$-bit input to an $$n$$-bit output) where the choice of all rotation values is not based on heuristic methods or empirical evidence (assuming that all rotations are constant, that is, their values do not depend on the input). That is, all rotation constants are either generated by a simple algorithm or extracted from some nothing-up-my-sleeve number.

The only example that I have found is Keccak, where all rotation constants are triangular numbers (taken modulo lane size).

Are there any other examples?

• There are a lot of nothing-up-my-sleeve number sequences to choose from. Enough, I think, to mean that any set of constants cannot be ruled totally unsuspicious. (If that is the point.) Heuristics, I assume, were used indirectly in the design process and acceptance of Keccak. If the first choice of NUMS numbers didn't compare well against general heuristics then a different set of NUMS numbers would have been chosen instead. Less safe constants would mean a performance hit after all, since more rounds would be required. – Future Security Jun 10 '19 at 23:22
• Of course, it is assumed that heuristic methods and tests support the hypothesis that the chosen set of constants is suitable. The point is that the set of rotation constants in Keccak is defined by a very simple mathematical formula ($r_i = i(i+1)/2 \mod 2^l$), instead of hard-coding the precomputed set of constants into the algorithm. This question is about other designs with a similar approach. – lyrically wicked Jun 12 '19 at 9:17