Is it possible to decrypt the entire message with one half of the key in this example? In this scheme, a 256 bit key is split into two 128 bit sub-keys. Message blocks are 256 bits and are also split into two sub-blocks. Before encryption, each sub-block is xor'd with it's partner and then xor'd with the opposite sub-key, in order to link the entire key to both blocks.

From the example below:

sub_aes_key1 = a
sub_aes_key2 = b
sub_block_1  = w
sub_block_2  = x
ciphertxt_1  = y = aes(message= sub_block_1 ^ sub_block_2 ^ sub_key_2, key = sub_key_1)
ciphertxt_2  = z = aes(message= sub_block_2 ^ sub_block_1 ^ sub_key_1, key = sub_key_2)


Essentially, the crux of my question is whether or not the hypothetical Susan, who somehow aquired one half of the key, would be able to infer the rest of the text. I'd also like to know if there are any other obvious vulnerabilities to this variant if you can see them.


  Pseudocode example


function func_1(a, b):
 encrypt message "a" with key "b"

function func_2(a, b)
 decrypt message "a" with key "b"

John knows:
a, b = 255, 100
c, d =  83,  97
w, x =  86, 205      (b XOR c XOR d), (a XOR c XOR d) #
y, z =  44, 196      func_1(w, a),      func_1(x, b)

Susan knows:
a, b = ___, 100
c, d = ___, ___
w, x = ___, 205      ???,               func_2(z, b)
y, z =  44, 196 

a = c ^ d ^ x   =   ___ ^ ___ ^ 205
d = a ^ c ^ x   =   ___ ^ ___ ^ 205
c = b ^ d ^ w   =   100 ^ ___ ^ ___
w = b ^ c ^ d   =   100 ^ ___ ^ ___
There are two major problems with this method.

The first problem is that Susan is likely to be able to recover significant amount of data from a series of such blocks.

For example, if Susan knows $subkey_1$, then she could recover the value $subblock_1 \oplus subblock_2 \oplus subkey_2$; if a single block is encrypted with this key, she can't deduce anything from this (as she has no information about $subkey_2$; however if multiple blocks are encrypted with the same key, then she can exclusive or the values, obtaining the value $subblock_1 \oplus subblock_2 \oplus subblock_3 \oplus subblock_4$; if she has a guess about the encrypted data, this is likely to reveal more.

The second problem is that someone with the entire key is unable to uniquely decrypt.

Here's why: someone with the encrypt key could decrypt $ciphertxt_1$ to compute $subblock_1 \oplus subblock_2 \oplus subkey_2$, and thus recover $subblock_1 \oplus subblock_2$

And, they could decrypt $ciphertxt_2$ to recover $subblock_2 \oplus subblock_1$

At this point, they have the value $subblock_1 \oplus subblock_2$, howqever without any further information, they cannot recover either the values $subblock_1$ or the value $subblock_2$.  Yes, if the decryptor had some side information about either of those values, he could determine the other; however we generally don't assume that the legitimate decryptor has such side information.

Hence, this method makes things possible for the attacker, and not possible for the legimate user.