Is there block cipher that is secure for n rounds but not secure when the rounds are increased?

The common wisdom is that increasing the number of rounds of a block cipher can make it more secure. This is quite true if we consider the linear and differential attacks.

The Tiny encryption algorithm supports this theory. It has a simple round, and it becomes secure after 32 rounds. Even Schneier et. al has the support this theory in their TwoFish Paper.

However, with enough rounds, even bad round functions can be made to be secure.

Even some of last round AES candidates wanted a higher round (32 rounds) [Rijndael].

All of these (and more) support this theory:

$$\text{More round is more secure.}$$

• Is there any proof of this claim? or
• Has somebody built a counterexample block cipher that is secure for $$n$$ rounds but not secure for $$n+m$$ rounds?
• Surely anecdotal evidence proves this? Virtually all cipher attacks are done incrementally versus the number of rounds. You can mathematically generalise the avalanche effect of a primitive (thus prove), but I think you'll struggle to generalise a cryptographic attack against unspecified constructs. Commented Jul 7, 2021 at 12:35
• You might be able to build a dodgy key schedule that nullifies itself when repeated. Commented Jul 7, 2021 at 12:36
• @PaulUszak Yes, those are all some thoughts, not proof. Considering against known attacks is not proof either. Looking for some work on this.. Commented Jul 7, 2021 at 12:51
• Could such a cipher be created? Yes, simply have the rounds mirror earlier rounds after a pivot point - so 16 rounds work normally, next 16 are the reverse of the first 16. So 17 rounds would be equivalent to 15 rounds, 32 rounds to 0 rounds etc. As noticed by another commenter a purposely bad key schedule would be one way to do this. Commented Jul 7, 2021 at 13:57
• I'd dispute the "more rounds is more secure" notion entirely. It's better (absent weird self-negating cycles) for the Confidentiality and (in AEADs) Integrity parts of CIA, but it slows the system down and thus reduces Availability. So once the C and I are "good enough" any additional rounds reduce overall security, by increasing the vulnerability to denial-of-service through excessive resource use. Or they discourage people from using the cipher in the first place. TLS being "slow" was a major problem with getting it deployed for decades. Commented Jul 7, 2021 at 14:19