# $\boxplus$- key addition vs $\oplus$- key addition

GOST cipher , Hight cipher and SEA cipher use key addition based on modular arithmetic addition (module key size $$\boxplus$$) compared to many ciphers which use arithmetic addition modulo 2 ( $$\oplus$$).

Q.1 what is the difference between two operations in term of security evaluation and performance across software and hardware ?

Q.2 why do not we see lots of ciphers apply $$\boxplus$$ in key addition ? is it because of lack in mathematical proof?

• $\boxplus$ in Speck, TEA, XTEA,RC6,RC4, CAST, IDEA, TwoFish,.. Feb 16, 2019 at 11:27
• correct , except for Speck. Feb 16, 2019 at 12:21
• Critically, $\forall(A,B,C)$ it holds $(A\oplus B)\oplus C=A\oplus(B\oplus C)$ and $(A\boxplus B)\boxplus C=A\boxplus(B\boxplus C)$, but (most often) $(A\oplus B)\boxplus C\ne A\oplus(B\boxplus C)$ and $(A\boxplus B)\oplus C\ne A\boxplus(B\oplus C)$.
– fgrieu
Feb 16, 2019 at 21:45
• If I recall, Twofish only used it because the LEA instruction could be used to optimize the key addition and the PHT in only a single instruction. They would have went with XOR if it weren't for that since XOR traditionally requires a less complex circuit to implement (no need for full adders). Feb 17, 2019 at 12:13
• I was going to point you to this earlier similar question I remembered seeing here, but it turns out it's also yours. :/ Feb 18, 2019 at 10:20

As pointed out in the comments, one attraction of mixing $$\oplus$$ and $$\boxplus$$ is that it makes cryptanalysis harder due to non-associativity.
The differential properties of $$\boxplus$$ were analysed here and you can find out more by chasing citations to this paper. Massey's PHT (Pseudo Hadamard Transform) is also of interest and was used in SAFER and Twofish.
In terms of key addition using $$\boxplus$$, the diffusion is slower than XOR when there is no carry, with no added benefits and that is probably why it is not used widely. And the somewhat annoying fact that during decryption, to undo addition of $$k$$ you must subtract it.
• i am wondering does $\boxplus$ key addition provide more security in single key differential attack than $\oplus$ as it will include the key part in analysis? Feb 18, 2019 at 10:52
• Also, $\boxplus$ is more painful in HW implementations as it requires more latency, due to carry, and more gates. Feb 18, 2019 at 14:11