+There is a two-round truncated differential \cite{storin-tdiff}, which can be
+used to break Storin reduced to only 2 rounds. The differential
+\[ (\hex{800000}, \hex{800000}, \hex{800000}, 0) \to
+ (0, 0, \hex{800000}, 0) \]
+holds with probability 1 through the matrix multiplication.
+Differentials in the linear transform are easy to find; for example:
+\[ (0, 0, \hex{800000}, 0) \to (0, 0, \hex{800800}, 0) \]
+We can continue through the second round's matrix multiplication with a
+truncated differential, again with probability 1:
+\[ (0, 0, \hex{800800}, 0) \to
+ (\hex{???000}, \hex{???800}, \hex{???800}, \hex{???800}) \]
+The following linear transform can be commuted with the postwhitening by
+applying a trivial reversible transformation to the postwhitening keys, and
+we can apply it to the ciphertext. If we do this, we can combine the
+differentials above to construct a probability-1 characteristic for a 2-round
+variant of Storin:
+\[ (\hex{800000}, \hex{800000}, \hex{800000}, 0) \to
+ (\hex{???000}, \hex{???800}, \hex{???800}, \hex{???800}) \]
+This characteristic is non-iterative, and can't be extended to more rounds.
+
+In \cite{storin-collide}, Matthew Fisher speculates on breaking 2 rounds of
+Storin by forcing collisions in the matrix multiplication outputs. This
+attack doesn't extend to more than two rounds either.
+