1
$\begingroup$

In this paper Alzette "ARX-box" is presented and on page 9 authors claim about XORing round constants:

They also break additive patterns that could arise on the left branch due to the chain of modular addition it would have without said constant additions.

Round constant is "c":

x ← x + (y ≫ 31)
y ← y ⊕ (x ≫ 24)
x ← x ⊕ c
x ← x + (y ≫ 17)
y ← y ⊕ (x ≫ 17)
x ← x ⊕ c
x ← x + (y ≫ 0)
y ← y ⊕ (x ≫ 31)
x ← x ⊕ c
x ← x + (y ≫ 24)
y ← y ⊕ (x ≫ 16)
x ← x ⊕ c

I have been playing in ArxPy with Alzette (scaled down) and removing those constants did not change anything in XOR differential search.

Interestingly in "Rotational Cryptanalysis of ARX Revisited" paper it is shown that chain of additions has lower rotational probability, but constants would prevent rotational cryptanalysis anyway.

What are those additive patterns and why many other ARX (like Threefish) do not care about them?

Improve this question
$\endgroup$
2
  • $\begingroup$ One of the obvious patterns is the fixed point at zero. Someone more familiar than me with the design of ARX algorithms could probably comment more in depth. $\endgroup$
    – bk2204
    Commented Sep 8, 2022 at 21:40
  • $\begingroup$ @bk2204 Well yes, but that is not the point here. Point is in "additive patterns" which could be caused by chain of modular addition. Constant could be applied to "y", which would not break chain of modular additions, but still prevent fixed points, rotational cryptanalysis, break symmetry, and so on. $\endgroup$
    – LightBit
    Commented Sep 9, 2022 at 10:13

1 Answer 1

Reset to default
1
$\begingroup$

I have emailed authors of Alzette. Aleksei Udovenko answered and explained that

it might foster e.g. additive differences (modular subtraction) propagation

and

additive differences would have better chances to pass through the ARX-box with high probabilities, which would require much more analysis.

So it is not necessary that "additive patterns" would be a problem. It is just precaution and so far I'm unaware of cryptanalysis that would exploit that.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.