# Security of a cipher with some imperfection in round function

I got specific problem with round function in my symmetric cipher. It works on $$128$$-bit blocks. Every round got two $$128$$-bit keys. Block is xored with $$k_{1}$$ on the beggining of the round. Then it goes into round function (which is using the same $$k_{1}$$ and $$k_{2}$$ keys, both $$128$$-bit long). And then it is xored with $$k_{2}$$ in the end.

Problem is with round function. Let's asssume that it transom every $$128$$-bit block into $$128$$-bit block indistinguishable from random, if you don't have $$k_{1}$$ and $$k_{2}$$. But there is one exception. All zeros block is always encrypted into all zeros block (with every key). So only xoring makes it different from all zeros block before it goes into round function.

If we will consider let's say $$10$$ rounds - is it secure cipher? Is it possible to broke it because of that problem with all zeros block?

EDIT:

I clarified my question, specifically when xoring is performed:

$$INPUT \oplus k_{1}$$ $$\to$$ $$F_{roundfunction}$$ $$\to$$ $$OUTPUT \oplus k_{2}$$

• Round function is never "perfect" - otherwise we wouldn't need more than 1 round. Zero going to zero is not a problem. For example in the NORX permutation, you have this property (well it's not a block cipher but the idea is the same). It is also strange that you use $k_1$ and $k_2$ inside your transformation as well - it can easily be keyless, like in all usual block ciphers. – Fractalice Sep 3 '20 at 13:14
• Round function is never "perfect - of course, mein is not either. But I made that assumption to make more easy and clear to investigating that problem with all zeros blocks. I don't understand why it is strange to use $k_{1}$ and $k_{2}$? It is just key whitening, what's more it is helpful to avoid problem with all zeros blocks (if I'm right) and it can help to avoid some kind of attacks in my round functions (but this is separate topic). – Tom Sep 3 '20 at 14:24
• Note: "Block is xored with $k_1$ on the beggining and with $k_2$ in the end of the round": that's equivalent to xor with $k_1\oplus k_2$. Thus we can remove the xor after each round except the last round, adjust the constants, and get an equivalent cipher that might be easier to analyse. – fgrieu Sep 3 '20 at 16:27
• Hint: compute the probability that an adversary, not knowing any of the constants, and making chosen plaintext or chosen ciphertext queries, can trigger the special case where one round function has input and outputs zero. Is that immediately worrying? Also: by what fraction does the stated condition reduce the number of possible round functions? – fgrieu Sep 3 '20 at 16:46
• "that's equivalent to xor with $k_{1} \oplus k_{2}$" - no, because round function $f$ will give us completely different output if use plaintext $p$ and compute $f(p)$ and something completely different for $f(k_{1} \oplus p)$. – Tom Sep 3 '20 at 18:57

However, the solution is fairly simple... simply XOR one of k1 or k2 with a constant value to turn your all-zero block into something that'll produce a better result. Personally I'd XOR with the current round number in each round because that'll prevent your algorithm from accidentally ending up with another input that produces the same issue.