# Why is variable rotation uncommon in cryptographic primitives?

Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though:

For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more sophisticated variants like that used in RC6.

To give these values a name: $A \lll B$.

Some good things:

• Rotations are fast
• Provides some diffusion
• Has some nonlinear properties
• Can be strong when combined with other operations

• Parity of $A$ is preserved
• Differences in $A$ are preserved
• Only a few bits in $B$ are used
• Differences in $B$ may not have an effect (or have little effect)
• Less differences if $A$ is mostly (or all) 0s or 1s
• Less differences with alignment in $A$
• Multiple variable rotations are not proportionally better

There's probably some more subtle weaknesses that make it more susceptible to differential cryptanalysis, but nothing that totally breaks it I think, or RC5 would be unusable.

One issue is that data-dependent rotations (such as you describe) is patented by RSA data security (or, at least, was, the patent may have expired). RC5 and RC6 was created by the holder of this patent, however such a patent could be enforced against someone else, and so people have shied away from it.

More minor issues would include:

• It is likely to take variable time on lower-end CPUs, and hence potentially vulnerable to time-based side channel attacks.

• Such variable rotates are moderately expensive in hardware (when they need to be implemented in constant time); yes, you can construct a barrel shifter, but that takes a number of gates and interconnects.

• Data-dependent rotations were patented by RSA and not just the whole cipher? Nov 18 '17 at 4:38
• @Melab: yes, RSA patented data dependent rotations used to encrypt; US patent 5724428, which appears to have expired... Nov 18 '17 at 4:41
• That looks like a patent on the cipher. Nov 18 '17 at 11:45
• @Melab: look at claim one of the patent; it is considerably more generic than 'just this cipher' Nov 18 '17 at 14:29
• I did not knew variable rotation as a cryptographic tool was patented. Here is another patent (alternate link). It also has expired in late 2015 in US. Even if it was filed elsewhere, it must have expired there too: patents expire after 21 years, with few exceptions (e.g. there can be extensions in Brasil to compensate for late registration).
– fgrieu
Feb 16 at 8:30