Via IACR – SymSum: Symmetric-Sum Distinguishers Against Round Reduced SHA3

Keygen time down to ~2 minutes for 128 bit parameters! (Although it requires a slightly stronger assumption about the prime factors of random numbers, but I've also made solid progress in proving this assumption unconditionally.)