Many moons ago, I was working with a team that was building a public-facing website. We originally built the system using auto-incrementing numeric primary keys as the public identifier for each piece of content that was collected. Word came down from on high that exposing this number was a risk -- it would reveal how many objects the system held, and the delta between any two object IDs and their post dates would reveal growth/adoption rate.
A senior colleague declared that using an XOR cipher would solve this problem. We'd take the object IDs as we always did and XOR them with a closely-guarded numeric key to create a public identifier. We'd reverse the process to get our original number.
In our case, the private IDs and the key were both unsigned 32-bit integers. And, as you might expect, two items created close to one another showed changes in their least significant bits, but no change in the most significant bits. I thought at the time that it would be trivially easy for an adversary to post a few objects in succession, notice that the LSBs changed while the MSBs remained static, and conclude that we were simply XORing an incrementing integer. But I always wondered what it would take for them to derive the key, and tear the whole facade down.
Is it possible, if an attacker can reason that the plaintext is a monotonically increasing integer, to derive the whole key?