# $\boxplus$- key addition vs $\oplus$- key addition

GOST cipher , Hight cipher and SEA cipher use key addition based on modular arithmetic addition (module key size $$\boxplus$$) compared to many ciphers which use arithmetic addition modulo 2 ( $$\oplus$$).   Q.1 what is the difference between two operations in term of security evaluation and performance across software and hardware ?

Q.2 why do not we see lots of ciphers apply $$\boxplus$$ in key addition ? is it because of lack in mathematical proof?

• $\boxplus$ in Speck, TEA, XTEA,RC6,RC4, CAST, IDEA, TwoFish,.. – kelalaka Feb 16 '19 at 11:27
• correct , except for Speck. – hardyrama Feb 16 '19 at 12:21
• Critically, $\forall(A,B,C)$ it holds $(A\oplus B)\oplus C=A\oplus(B\oplus C)$ and $(A\boxplus B)\boxplus C=A\boxplus(B\boxplus C)$, but (most often) $(A\oplus B)\boxplus C\ne A\oplus(B\boxplus C)$ and $(A\boxplus B)\oplus C\ne A\boxplus(B\oplus C)$. – fgrieu Feb 16 '19 at 21:45
• If I recall, Twofish only used it because the LEA instruction could be used to optimize the key addition and the PHT in only a single instruction. They would have went with XOR if it weren't for that since XOR traditionally requires a less complex circuit to implement (no need for full adders). – forest Feb 17 '19 at 12:13
• I was going to point you to this earlier similar question I remembered seeing here, but it turns out it's also yours. :/ – Ilmari Karonen Feb 18 '19 at 10:20

As pointed out in the comments, one attraction of mixing $$\oplus$$ and $$\boxplus$$ is that it makes cryptanalysis harder due to non-associativity.
The differential properties of $$\boxplus$$ were analysed here and you can find out more by chasing citations to this paper. Massey's PHT (Pseudo Hadamard Transform) is also of interest and was used in SAFER and Twofish.
In terms of key addition using $$\boxplus$$, the diffusion is slower than XOR when there is no carry, with no added benefits and that is probably why it is not used widely. And the somewhat annoying fact that during decryption, to undo addition of $$k$$ you must subtract it.
• i am wondering does $\boxplus$ key addition provide more security in single key differential attack than $\oplus$ as it will include the key part in analysis? – hardyrama Feb 18 '19 at 10:52
• Also, $\boxplus$ is more painful in HW implementations as it requires more latency, due to carry, and more gates. – Ruggero Feb 18 '19 at 14:11