The XOR operator seems to be a frequently used building block inside many cryptographic primitives. As far as I can see, its most desirable properties seem be that for the XOR of two bits $a\oplus b=c$:
- The information is preserved. Either $a$ or $b$ can be recovered from $c$ and the other bit.
- The information is hidden. An adversary can not learn anything about $a$ or $b$ from $c$ alone.
Neither AND nor OR has these properties but XNOR does. It seems like any cryptographic application using XOR could be constructed equivalently with XNOR, without incurring any loss in security. One possible reason to prefer XOR might be that XOR is equivalent to addition modulo 2, whereas XNOR would be addition plus 1 modulo 2, but this seems to be entirely mathematical, and I'm not sure if it actually results in any additional hardware complexity in practice.
Is the choice of XOR then an arbitrary one, made for historical reasons, or is there any tangible underlying motivation for using it over XNOR?