What would a backdoor in symmetric key cipher look like? Pretty much what the title says. DES was suspected of having one, but I couldn't imagine what it could possibly look like if only the NSA knew how to use it. Dual_EC_DRBG's backdoor is asymmetric, but it's not a cipher. Could one have a kletographic symmetric key cipher?
As usual, inserting a backdoor in a symmetric cipher becomes a lot easier if you have knowledge your adversaries lack.

DES is a pretty good (counter)example of how a backdoor could be introduced in a symmetric cipher.

Back in 1974, IBM and the NSA both knew about differential cryptanalysis, but they did not publish their findings. Some 16 years later, differential cryptanalysis was rediscovered and published by Biham and Shamir. As they found out, DES's S-boxes &ndash; which are precisely the part of DES prople suspected to contain a backdoor &ndash; were surprisingly resistent to differential cryptanalysis.

As it turned out, the S-boxes were designed to to repel this type of attack. In theory, since the NSA knew about differential cryptanalysis but the general public didn't, they could have chosen S-boxes that were exceptionally vulnerable to it. That would have been a backdoor.

Another example would be the use of apparent trapdoor functions with a known inverse.

To see how this could be exploited, suppose nobody knew about RSA. Define $R(X)$ as the RSA encryption of $X$ with a certain public key and design a cipher that generates the stream $$R(1\times K) || R(2\times K) || R(3\times K) || \cdots$$ where $K$ is the secret key for your stream cipher.

If you know the associated private key, you can easily compute $R^{-1}$. Now, if you know enough plain- and ciphertext to figure out part of the stream &ndash; let's say $R(1\times K)$ &ndash; all you have to do is apply $R^{-1}$ to figure out $K$.

Nobody will be able detect the vulnerability without essentially discovering RSA.