6
$\begingroup$

GOST cipher , Hight cipher and SEA cipher use key addition based on modular arithmetic addition (module key size $\boxplus$) compared to many ciphers which use arithmetic addition modulo 2 ( $\oplus$). GOST round function

HIGHT round function

SEA round function

Q.1 what is the difference between two operations in term of security evaluation and performance across software and hardware ?

Q.2 why do not we see lots of ciphers apply $\boxplus$ in key addition ? is it because of lack in mathematical proof?

Improve this question
$\endgroup$
7
  • 3
    $\begingroup$ $\boxplus$ in Speck, TEA, XTEA,RC6,RC4, CAST, IDEA, TwoFish,.. $\endgroup$
    – kelalaka
    Commented Feb 16, 2019 at 11:27
  • 2
    $\begingroup$ correct , except for Speck. $\endgroup$
    – hardyrama
    Commented Feb 16, 2019 at 12:21
  • 3
    $\begingroup$ Critically, $\forall(A,B,C)$ it holds $(A\oplus B)\oplus C=A\oplus(B\oplus C)$ and $(A\boxplus B)\boxplus C=A\boxplus(B\boxplus C)$, but (most often) $(A\oplus B)\boxplus C\ne A\oplus(B\boxplus C)$ and $(A\boxplus B)\oplus C\ne A\boxplus(B\oplus C)$. $\endgroup$
    – fgrieu ♦
    Commented Feb 16, 2019 at 21:45
  • 2
    $\begingroup$ If I recall, Twofish only used it because the LEA instruction could be used to optimize the key addition and the PHT in only a single instruction. They would have went with XOR if it weren't for that since XOR traditionally requires a less complex circuit to implement (no need for full adders). $\endgroup$
    – forest
    Commented Feb 17, 2019 at 12:13
  • 1
    $\begingroup$ I was going to point you to this earlier similar question I remembered seeing here, but it turns out it's also yours. :/ $\endgroup$
    – Ilmari Karonen
    Commented Feb 18, 2019 at 10:20

1 Answer 1

Reset to default
7
$\begingroup$

As pointed out in the comments, one attraction of mixing $\oplus$ and $\boxplus$ is that it makes cryptanalysis harder due to non-associativity.

The differential properties of $\boxplus$ were analysed here and you can find out more by chasing citations to this paper. Massey's PHT (Pseudo Hadamard Transform) is also of interest and was used in SAFER and Twofish.

In terms of key addition using $\boxplus$, the diffusion is slower than XOR when there is no carry, with no added benefits and that is probably why it is not used widely. And the somewhat annoying fact that during decryption, to undo addition of $k$ you must subtract it.

Improve this answer
$\endgroup$
4
  • 1
    $\begingroup$ The "somewhat annoying fact" is indeed annoying in permutation-substitution ciphers like AES, but not in Feistel ciphers. $\endgroup$
    – fgrieu ♦
    Commented Feb 17, 2019 at 23:08
  • $\begingroup$ @fgrieu, yes you're right. $\endgroup$
    – kodlu
    Commented Feb 17, 2019 at 23:09
  • $\begingroup$ i am wondering does $\boxplus$ key addition provide more security in single key differential attack than $\oplus$ as it will include the key part in analysis? $\endgroup$
    – hardyrama
    Commented Feb 18, 2019 at 10:52
  • 1
    $\begingroup$ Also, $\boxplus$ is more painful in HW implementations as it requires more latency, due to carry, and more gates. $\endgroup$
    – Ruggero
    Commented Feb 18, 2019 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.