How Many Rounds Does a Hash Function Need? Reconciling Spectral Theory with Cryptanalytic Practice

Hash-function constructions have security proofs; the round-based primitives they iterate do not, and no theory predicts how many rounds a primitive needs. This statement proposes measuring the decay of maximum linear-trail correlation (and minimum differential-trail weight) across rounds, exactly for small-width functions and by analytic bound for SHA-512 and Keccak-f[1600], and testing whether the round at which correlation falls below 2^{−n/2} predicts the reach of the best published attacks on reduced-round SHA-256 and Keccak-f.