Linearly weak keys of RC5 [private-key cipher]

The author examines the application of linear cryptanalysis to the RC5 private-key cipher and shows that there are expected to be weak keys for which the attack is applicable to many rounds. It is demonstrated that, for the 12-round nominal RC5 version with a 64 bit block size and a 128 bit key, there are 2²⁸ weak keys for which only ~2¹⁷ known plaintexts are required to break the cipher. There are 268 keys for which the cipher is theoretically breakable, requiring ~2⁵⁷ known plaintexts. The analysis highlights the sensitivity of RC5 security to its key scheduling algorithm