# Best differential attack on round functions with specific vulnerabilities

I got problem with my encryption functions. They have a repeating series of ones and zeros. It is 128-bit symmetric cipher.

Let's consider numbers divisible by $$2.$$ Let's count how many times are they divided by $$2$$. If number is divisible by $$2$$ exactly $$n$$ times, then make a block of $$n$$ zeros or $$n$$ ones.

Now put it into encrypted blocks. Every encrypting number of the form $$2k$$ which is even and divisible by $$2$$ just $$n$$ times will got first $$n$$ bits as $$0$$. And every encrypting number of the form $$2k+1$$ which is odd and $$2k$$ is divisible by $$2$$ $$n$$ times will got first n bits as $$1$$. Let's assume that all the rest of bits is indistinguishable from random. In these scheme zero-block always go into zero-block. And number $$8$$ will always got first three zeros and rest of bits indistinguishable from random.

Now let's shift this regularities aside. Let's say every encrypting number of the form $$2k+a$$ which is even and divisible by $$2$$ just $$n$$ times will got first $$n$$ bits as $$0$$ and every encrypting number of the form $$2k+b+1$$ which is odd and $$2k+b$$ is divisible by $$2$$ just $$n$$ times will got first $$n$$ bits as $$1$$. Numbers $$a$$ and $$b$$ are secret and can be understand as keys (every round got different pair).

Now let's move this regularities perpendicularly. Let's move every block by $$m$$ bits (with wrapping). So for example number $$8$$ can have first or last three zeros or somewhere in the middle. What's more until we don't know key $$a$$, we don't know how many zeros will there be in this block.

It is easy to find differentials if $$a$$, $$b$$ and $$m$$ are equal to zero. It is harder or impossible if we will choose $$a$$, $$b$$ and $$m$$ randomly. What is best differential attack against such vulnerabilities? And what is best differential probability? I was thinking about implementing $$20$$ rounds and according to my preliminary findings it should be enough if we are talking about differential attacks. But I have no idea if this can be attacked efficiently with linear cryptanalysis. Can it be?

• a bit of mathematical language may help frame your question concretely. – kodlu Nov 22 '20 at 12:01