Encryption method that is purposely vulnerable to cracking parts at a time?
Encrypt a short known plaintext ($s$ bits) using truncated keys (to $s$, $2s$, $3s$, etc. bits) and publish them alongside the ciphertext. Then an attacker can break them in order of increasing keylength, until they recover the full key.

There is a quite similar vulnerability when performing a chosen-ciphertext (online) attack against short polynomial MACs. For example consider GCM with a short 32-bit authentication tag (hence you should never use short tags). The attacker submits messages to an oracle and learns if they're accepted or not. After a successful forgery (chance $2^{-32}$) the attacker learns 32-bits of the MAC key. After several successful forgeries they can recover the full MAC key. The decryption key can then be recovered using standard oracle attacks against unauthenticated CTR mode.