# Security of key schedule that only XORs a key with constants

Suppose that:

• $MK \in \{0, 1\}^{n}$ and the main key of a block cipher.
• $RK_{r} \in \{0, 1\}^{n}$ and is the $r$th round key.
• $RC_{r} \in \{0, 1\}^{n}$ and is the $r$th round constant.
• $RK_{r} = MK \oplus RC_{r}$

What's the security of this key schedule. I'm imagining that it is not very strong.

• "security" in regards to what? You might be interested in the LED cipher Commented Oct 16, 2017 at 1:05
• This makes no sense. Commented Oct 16, 2017 at 1:25
• Perhaps for the last line, you meant $RK_r = MK \oplus RC_r$? Commented Oct 16, 2017 at 1:53
• In any case, unless the key schedule does something exceedingly silly (e.g. set all round keys to constant values), it's impossible to talk about the security of a key schedule without specifying what cipher it is a part of. The above key schedule might cause the cipher to be quite weak; or it might be exactly the sort of thing the cipher needs to be secure. Commented Oct 16, 2017 at 2:01
• A key schedule has no security definition. Also, how is this used in a cipher, what are the definitions, etc.? From the little information there, I would say this is vulnerable to linear and differential cryptanalysis at least.
– tylo
Commented Oct 16, 2017 at 14:04

This key schedule is Totally Linear. If two Master Keys $MK$1 and $MK$2 have a difference of d, all the round keys will have difference of d with probability of 1. This makes the cipher vulnerable to Related key Attack. But its hard to workout and comment without the knowledge of the cipher description that how badly such key-schedule effects the security of cipher

The PRINCE – A Low-latency Block Cipher for Pervasive Computing Applications have very simple key-schedule, and its designers say

for our cipher it holds that decryption for one key corresponds to encryption with a related key. This property we refer to as α-reflection