What is the approximate effort to break one additional round of a primitive? Many of the cryptographic primitives currently in use have a number of their rounds already broken.  Generally and with no particular primitive in mind, what is the scale of the effort to break one more round? Is is anything like $O(n)$, or more like $O(n^{something})$ where $n$ is the number of rounds for any individual primitive? In short, is breaking each additional round as easy or harder than the previous one? Or are there impediments other than simple computational time &amp; effort?

So for example, assume an iterated primitive of $n$ rounds in total, where each round is $r_i$.  I'm asking is it as easy to break $r_{i+1}$ as it was to break $r_{i}$? It seems to me that this relationship should be independent of $n$ itself within the particular primitive. I'm not comparing between primitives.

This question is loosely based on the numbers of broken rounds identified in Origin of values for &quot;security margin&quot;?.
Think of breaking through rounds as doing ballistics tests to see how deep a projectile can get into a defensive barrier. Breaking through the first layer or two is easy, but each subsequent layer becomes increasingly harder to penetrate. It would be impossible to ask exactly how difficult it is without knowing both the projectile and the defensive material. All you can say is that each layer makes it less and less likely that anything will get through. Breaking an iterated cipher is exactly like that, but with more math.


  Generally and with no particular primitive in mind, what is the scale of the effort to break one more round?


There is no way to answer this without knowing the particular primitive you are talking about. In some cases, for a cipher with a small number of very complex rounds, extending an attack to another round may be a truly monumental effort and the discovery may be significant. For a cipher with a huge number of simple rounds, breaking one more may be just a matter of revisiting the original attack. In general, it's easier to extend an attack one more round for ciphers with a large number of simple rounds than with a few complex ones. This is why people tend to refer to broken rounds only in the context of the number of total rounds. Finding an attack that breaks 9 rounds is a big deal for a cipher with 10 rounds, but is not a big deal at all for a cipher with 72 rounds. That's why security margin is given as a percent.


  In short, is breaking each additional round as easy or harder than the previous one?


Each round introduces more confusion and diffusion. With the exception of a few rare types of attacks which do not depend on the number of rounds (like slide attacks), following e.g. a differential trail or linear hull through more rounds may not be possible without using completely new techniques in the attack. In general, each additional round is significantly harder to break than the last.