Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though:

Diagram of RC5, a Feistel cipher. One side is fed into the other as a rotation amount.

For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more sophisticated variants like that used in RC6.

To give these values a name: $A \lll B$.

Some good things:

  • Rotations are fast
  • Provides some diffusion
  • Has some nonlinear properties
  • Can be strong when combined with other operations

Some bad things:

  • Parity of $A$ is preserved
  • Differences in $A$ are preserved
  • Only a few bits in $B$ are used
  • Differences in $B$ may not have an effect (or have little effect)
  • Less differences if $A$ is mostly (or all) 0s or 1s
  • Less differences with alignment in $A$
  • Multiple variable rotations are not proportionally better

There's probably some more subtle weaknesses that make it more susceptible to differential cryptanalysis, but nothing that totally breaks it I think, or RC5 would be unusable.


One issue is that data-dependent rotations (such as you describe) is patented by RSA data security (or, at least, was, the patent may have expired). RC5 and RC6 was created by the holder of this patent, however such a patent could be enforced against someone else, and so people have shied away from it.

More minor issues would include:

  • It is likely to take variable time on lower-end CPUs, and hence potentially vulnerable to time-based side channel attacks.

  • Such variable rotates are moderately expensive in hardware (when they need to be implemented in constant time); yes, you can construct a barrel shifter, but that takes a number of gates and interconnects.

  • $\begingroup$ Data-dependent rotations were patented by RSA and not just the whole cipher? $\endgroup$
    – Melab
    Nov 18 '17 at 4:38
  • $\begingroup$ @Melab: yes, RSA patented data dependent rotations used to encrypt; US patent 5724428, which appears to have expired... $\endgroup$
    – poncho
    Nov 18 '17 at 4:41
  • $\begingroup$ That looks like a patent on the cipher. $\endgroup$
    – Melab
    Nov 18 '17 at 11:45
  • $\begingroup$ @Melab: look at claim one of the patent; it is considerably more generic than 'just this cipher' $\endgroup$
    – poncho
    Nov 18 '17 at 14:29
  • $\begingroup$ I did not knew variable rotation as a cryptographic tool was patented. Here is another patent (alternate link). It also has expired in late 2015 in US. Even if it was filed elsewhere, it must have expired there too: patents expire after 21 years, with few exceptions (e.g. there can be extensions in Brasil to compensate for late registration). $\endgroup$
    – fgrieu
    Feb 16 '21 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.