Is there an algorithm that gives a reasonable chance of decoding the entire ciphertext of this encryption scheme? Suppose Alice and Bob share two $n$-bit shared keys, $k_1$ and $k_2$, and decide to send multiple $n$-bit messages to each other. The encryption scheme they use simply sends $c_i = (k_1 + i k_2) \oplus m_i$, where $m_i$ is the $i$th plaintext. Here, the addition and multiplication are both done modulo $2^n$.
Clearly, they can send at least two $n$-bit messages with perfect secrecy, since $k_1 + k_2$ and $k_1 + 2 k_2$ will be independent and have equal probability being each possible $n$-length bitstring. Once they send three, though, we can start learning some information about the plaintexts. For example, $k_1 + k_2$ and $k_1 + 3 k_2$ will always have the last bit, so $c_1$ and $c_3$ will share the same last bit if and only if $m_1$ and $m_3$ did. Still, though, even in this case we still wouldn't know what the last bit of the messages was.
My question is, at what point does it become feasible to figure out the entire message (i.e. how many messages do Alice and Bob need to send before an adversary with relative ease can figure out large portions of the message)? And at this point, what is an algorithm that would recover the plaintexts? We can assume that the messages are patterned, e.g. in the English language, so if we can reduce this problem to one where crib-dragging/frequency analysis/etc. can be applied, that would work!
For a frequency-style solution, we can guess the least significant bytes of $k_1, k_2$, decrypt the least significant byte of each block, and check the frequency (e.g. space should be the most often). Then repeat with the previous byte, etc.
The scheme is bad in that it reduces to schemes mod $2^N$ for any $N &lt; n$.