1

In this paper Alzette "ARX-box" is presented and on page 9 authors claim about XORing round constants:

They also break additive patterns that could arise on the left branch due to the chain of modular addition it would have without said constant additions.

Round constant is "c":

x ← x + (y ≫ 31)
y ← y ⊕ (x ≫ 24)
x ← x ⊕ c
x ← x + (y ≫ 17)
y ← y ⊕ (x ≫ 17)
x ← x ⊕ c
x ← x + (y ≫ 0)
y ← y ⊕ (x ≫ 31)
x ← x ⊕ c
x ← x + (y ≫ 24)
y ← y ⊕ (x ≫ 16)
x ← x ⊕ c

I have been playing in ArxPy with Alzette (scaled down) and removing those constants did not change anything in XOR differential search.

Interestingly in "Rotational Cryptanalysis of ARX Revisited" paper it is shown that chain of additions has lower rotational probability, but constants would prevent rotational cryptanalysis anyway.

What are those additive patterns and why many other ARX (like Threefish) do not care about them?

LightBit
  • 1,741
  • 14
  • 28

1 Answers1

1

I have emailed authors of Alzette. Aleksei Udovenko answered and explained that

it might foster e.g. additive differences (modular subtraction) propagation

and

additive differences would have better chances to pass through the ARX-box with high probabilities, which would require much more analysis.

So it is not necessary that "additive patterns" would be a problem. It is just precaution and so far I'm unaware of cryptanalysis that would exploit that.

LightBit
  • 1,741
  • 14
  • 28