Can 64-bit “PRINCEcore” practically be brute forced? There is a cipher called PRINCE proposed in ASIACRYPT two years ago.

See the paper: “PRINCE – A Low-latency Block Cipher for
Pervasive Computing Applications”

The cipher divides the 128-bit key into 64-bit k0 and k1. If I remove the key whitening at the beginning and end. Then the cipher is stripped down to PRINCEcore which only uses 64-bit k1. Is brute forcing the PRINCEcore practical? 

Some clarifications:


I dont worry about side channel attacks or fault attacks.
I have seen several attacks on PRINCE (and also PRINCEcore), but they are not significantly better than brute force.
PRINCEcore is a 64-bit block cipher with a 64-bit key $k_1$. PRINCE is a 64-bit block cipher with a 128-bit key $k_0||k_1$ built from PRINCEcore as
$$\operatorname{PRINCE}((k_0||k_1),x)=\operatorname{PRINCEcore}(k_1,(x\oplus k_0))\oplus P(k_0)$$ where $P(k_0)$ is given as $(k_0\ggg1)\oplus(k_0\gg63)$ which I read as: rotate the 64-bit $k_0$ right by one bit, then replace the rightmost bit by its XOR with the second leftmost one; making $P$ a mapping.

That extension from PRINCEcore to PRINCE is reminescent of the extension from DES to DESX, analyzed by Joe Kilian and Phillip Rogaway in How to protect DES against exhaustive key search (an analysis of DESX). At least, that construction greatly improves the resistance to exhaustive key search, and I do not see that PRINCE could be practically brute-forced with work commensurate to brute-force of PRINCEcore (that is, near $2^{63}$ encryptions).

Note: The best motivation I can find for $P$ is that the rotation it contains avoids a cancellation of $k_0$ in some common operating modes, like OFB, CBC, CFB.. However, by rotating the output of PRINCE, we can cancel that rotation. And the single-bit XOR in $P$ does not seem to add much security.