An attack on $\mathrm{6}$ rounds of Khazad

We suggest new attacks on the $64$-bit block cipher Khazad. These attacks use some structural properties of its round function. As a result we find $14$ new classes of weak keys for $5$ and $6$ rounds of Khazad. Particularly we show that Khazad has $7$ classes of weak keys for $5$ and $6$ rounds such that the cardinality of each class is $2^{64}$. The time complexity of weak keys recovering is $2^{35}$ $\mathrm{S}$-box lookups for $5$ rounds and $2^{43}$ $\mathrm{S}$-box lookups for $6$ rounds. The corresponding data complexity is $2^{32}$ chosen plaintexts.