MULTI2

Designed for general-purpose cryptography, its current use is encryption of high-definition television broadcasts in Japan.

The largest class (so far found) stems from the fact that the Pi3 round function in the key schedule is not bijective.

The collision occurs because a single byte difference turns into a pattern like 0X0X0000 (rotated by 0, 8, 16, or 24 bits) which then expands to a variation of 0X000X00 and finally in the second last line (with the rotate by 16 and the XOR) the differences cancel out.

The problem stems from the fact that the function Where ROL means rotate left by y bits, is not bijective for any value of y.

There are similar problems with the Pi2 and Pi4 functions but they are seemingly harder to exploit because the rotation value is smaller.