# Applying differential cryptanalysis to ciphers with addition mod $2^{32}$

I am studying differential analysis and have a question.

Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ (Plaintext $m_1$ xor with key $K_1$, then result goes into an S-BOX, the output of which is xor'd with $K_2$). This case is very simple. Using the main property of XOR we can get differential that independent from KEY.

How do we can get such differential if instead of XOR we use addition modulo $2^{32}$? When using XOR, we have $(m_1 \oplus k_1) \oplus ( m_2 \oplus k_1 ) = m_1 \oplus m_2$. What operation need apply to get rid of the key when using addition modulo $2^{32}$?

-
@user8911, thank you for the fix. –  vakoroteev Nov 21 '13 at 9:35
Actually, for the differential cryptanalysis it does not matter what sort of difference you use, you only need that it propagates deterministically through linear transformations (whatever linearity means). In this case you use a difference modulo $2^{32}$: $$A \boxminus B \equiv (A-B)\pmod{2^{32}}.$$
You compute the differential distribution table for $S$ in the same way, but replace $\oplus$ with $\boxminus$.