A protective silence

Their results indicate that not all bits but a few bits of subkeys can be recovered under the condition of fixing the first round rotation, and that a good distinguishing algorithm is