# How secure is this block cipher? [closed]

As an 17-year old highschool student with some interests into cryptography I developed following block cipher:

Let $H$ be an irreversible hash function with the block length $L$, which also is the block and key length. (I used SHA-256 for my example implementation below).

$O$ is the original key while $K$ is the expanded (and mutated) key.

First, the key is expanded to the length of the plain text $P$ using following scheme:

$K_0=H(O)$

$K_n=H(H(K_0,n) \oplus O)$ ($K_0,n$ should be the n'th byte of $K_0$)

Next, the ciphertext $C$ is set to $P$ and following modification of the feistel round is being run 64 times, please note that $C_0$ are the first 64 bits of an block, $C_1$ the second 64 bit, etc.

$C_2 = C_2 \oplus ((C_3 \oplus K_3) \lll 41)$

$C_1 = C_1 \oplus ((C_2 \oplus K_2) \lll 29)$

$C_0 = C_0 \oplus ((C_1 \oplus K_1) \lll 13)$

$C_3 = C_3 \oplus ((C_0 \oplus K_0) \lll 5)$

After each round, the key mutates by $K_n = H(K_n \oplus O)$, this key mutation is not shown in the graph below.

To decrypt, you'll just have to calculate the round keys and apply the rules above in reversed order. Functional java code can be found here.

Sadly, I'm not able to perform an any "modern" cryptoanalysis due to lack of mathematical knowledge, but here are some thoughts on my cipher:

• You shouldn't be able to get $O$ unless you are able to break $H$.

• Since key expansion and mutation make use of $O$, you shouldn't be able to predict another round key given you already have one and don't know $O$.

• An attack vector could be predicting $H$ outcome even without knowing it's input.

I hope you have more idea's when it comes to attacking this algorithm and / or are able to perform known cryptoanalysis.

Thanks in advance

// Edit: Updated algorithm and added graph

## closed as off-topic by fgrieu, Maarten Bodewes♦, e-sushiMay 21 '17 at 22:11

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

• Convince yourself that each round is such that any output bit is the XOR of some public fixed input and key bits. Extend that to the block cipher. Show how you obtain the plaintext for any desired ciphertext from the ciphertext for 256 well-chosen plaintexts. Remark: non-linearity is a must in any block cipher. – fgrieu May 21 '17 at 20:37
• Send two plaintext through whose ^ == 0x1, now ^ the the two cipher texts. Do this again with two different plaintext whose ^ == 0x1. You will see that the cipher texts have the same ^ as the first set. This idea is called 'differential cryptanalysis' and is powerful against many block ciphers. Start your study with Biham's great book cs.bilkent.edu.tr/~selcuk/teaching/cs519/Biham-DC.pdf – Matthew Fisher May 22 '17 at 5:02
• The cipher has ver bad diffusion, if i change one bit in plaintext, at max i will get 4 bits changed, rest all bits of ciphertext will be similar. This helps us in applying differential CA. Since cipher consists of a very simple operation i.e Xor the round key and circular shift, Interpolation attack can also be applied which needs a few plaintext-ciphertext pairs to find round keys. see here for interpolation attack. en.wikipedia.org/wiki/Interpolation_attack – khan May 22 '17 at 7:40
• @Raza But since the round function is run 64 times and the sub-block are circular shifted with a period lenght of 31, one bit can change up to 31 * 4 = 124 bits. Also, you shouldn't be able to do a full key recovery since K is build upon hashing O, which doesn't makes the encryption stronger unless longer messages than the attacked ones are sent. – VincBreaker May 22 '17 at 10:39
• you mean have have 64 rounds, and in each round you are processing the block 3 times with k0,k1,k2? it will be nice if you can draw a diagram of the cipher in terms of Feistel Cipher with F function. – khan May 22 '17 at 10:59

## 1 Answer

As pointed out in the comments, your encryption process is linear (mod 2). So this cipher is very weak, all you need is linear algebra.

See, for example, the question answered here

• @Raza FYI: your edit to this answer didn't really make sense so I reverted your edit. (You only added a single line going [2]: https://i.stack.imgur.com/nsx0z.png, but didn't embed the image or anything and the comment to your edit describing what you edited and why merely says Removed the figure which makes even less sense.) – e-sushi May 22 '17 at 18:38
• the answer was edited by a mistake, i have made a comment about it to the questioner about my understanding of the cipher ibb.co/g2tZna – khan May 22 '17 at 19:27