Its basic structure is an 8-round Feistel network, but with an additional operation after the first 4 rounds, called a decorrelation module.
The round function makes use of modular multiplication and addition, bit rotation, XORs, and a single 8×24-bit S-box.
The entries of the S-box are derived using the binary expansion of e as a source of "nothing up my sleeve numbers".
[3] Despite Vaudenay's proof of COCONUT98's security, in 1999 David Wagner developed the boomerang attack against it.
[4] Then in 2002, Biham, et al. applied differential-linear cryptanalysis, a purely chosen-plaintext attack, to break the cipher.