Known-Key Distinguishing and Partial-Collision Attacks on GFN-2 with SP F-Function

Figure 3

Differences in the inbound structure of F-function with a = 4.