# Differenital and linear attack on specific vulnerabilities

Consider 128-bit cipher. It has one weakness. In every round you can find such even number $$E$$ which is encrypted into block that has $$0$$ as one of $$1-128$$ bits (lets say it has $$0$$ as $$k$$-th bit). And then you can find a numbers $$E+2^{i} \cdot n$$ $$\mod 2^{128}$$ which are encrypted into blocks that have $$r$$ consecutive zeros on $$k$$, $$k+1$$, $$k+2$$,... position, if number $$2+2^{i} \cdot n$$ is divisible by $$2^{r}$$.

Lets say $$E=14$$. It means that number $$E+2^{1} \cdot 3$$ will got $$3$$ zeros as $$k$$, $$k+1$$, $$k+2$$ bit (becasue $$2+2^1 \cdot 3$$ is divisible by $$2^{3}$$). And for example number $$14+2^{1} \cdot (2^{127}-1)$$ $$\mod 2^{128}$$ will got all zeros.

And you can find also odd number $$F$$ which is encrypted into block that has $$1$$ as one of $$1-128$$ bits (lets say it has $$1$$ as $$k$$-th bit). And then you can find a numbers $$F+2^{i} \cdot n$$ $$\mod 2^{128}$$ which are encrypted into blocks that have $$r$$ consecutive ones on $$k$$, $$k+1$$, $$k+2$$,... position, if number $$2+2^{i} \cdot n$$ is divided by $$2^{r}$$.

Let's assume that all other bits of encrypted blocks are indistinguishable from random. It make sense to attack this cipher using only that vulnerabilities. $$k$$ is secret (but it is only 7-bit number) and also $$E$$ and $$F$$ are secret (they are different in every round).

What is best differential attack on this? Can these weaknesses be vulnerable to linear cryptanalysis? I planned about $$20$$ rounds, but I don't know will it be enough. It is quite clear how to find differential if keys $$k$$ are equal to $$1$$ in every round. Then every even number will got $$0$$ as a first bit and every odd number will got $$1$$ as a first bit (we can make differential attack in this case). But $$k$$ can be every number from $$1$$ to $$128$$.

I can give you and example of such cipher. Let's consider $$a_{1}$$, $$a_{2}$$, ..., $$a_{20}$$, $$s_{1}$$,$$s_{2}$$,...,$$s_{20}$$ and $$k_{1}$$,$$k_{2}$$,...,$$k_{20}$$ as keys. In every round we compute:

$$P_{1}$$ --> $$INPUT$$ xor $$s_{i}$$

$$P_{2}$$ --> $$P_{1} \cdot$$ $$a_{i} \mod 2^{128}$$

$$P_{3}$$ --> move $$P_{2}$$ block by $$k_{i}$$ bits

I'm pretty sure that we can attack it somehow using such vulnerabilities, but I can't decide how serious the problem is and how many rounds the cipher should have.

• Here is python code of cipher: pastebin.pl/view/26abfc3b You can run it with yourfilename.py [1,2,3] [5,3,7] [1,1,1] 128 123, where 123 is plaintext. [1,2,3] are xoring keys. [5,3,7] are multipliers in subsequent rounds and [1,1,1] means that you are moving bits by one bit in every round. Example of first round: s = 123 XOR 1 = 122 s = 122*5 mod 2^128 = 610 Move it by 1 bit and you will get 1220. – Tom Dec 10 '20 at 1:57