algebraic attacks for mixed operations (mod 2 and mod 256) If a cipher has mixed operations, e.g $\oplus$ (addition mod $2$), and addition modulo $2^8$. How we we going to express them mathematically? Thanks in advance!
There is of course but because of carry bits there will be data-dependent "nonlinear" terms. If I do it for 2 bits you can get the idea. It gets unwieldy but you can easily write code to do it for longer bitlengths. The list below is an XOR table expressed as integers:

$$
\begin{array}{c|ccc}
\oplus &amp; 0 &amp; 1 &amp; 2 &amp; 3 \\
\hline
0 &amp; 0 &amp; 1 &amp; 2 &amp; 3 \\
1 &amp; 1 &amp; \color{red}0 &amp; 3 &amp; \color{red}2 \\
2 &amp; 2 &amp; 3 &amp; 0 &amp; 1 \\
3 &amp; 3 &amp; \color{red}2 &amp; 1 &amp; \color{red}0 \\
\end{array}
$$

while the table below is addition mod 4:
$$
\begin{array}{c|ccc}
+ &amp; 0 &amp; 1 &amp; 2 &amp; 3 \\
\hline
0 &amp; 0 &amp; 1 &amp; 2 &amp; 3 \\
1 &amp; 1 &amp; \color{green}2 &amp; 3 &amp; \color{green}0 \\
2 &amp; 2 &amp; 3 &amp; 0 &amp; 1 \\
3 &amp; 3 &amp; \color{green}0 &amp; 1 &amp; \color{green}2 \\
\end{array}
$$

Note that there are exactly 4 positions (in general for $n$ bits there will be $2^{n-1}+2^{n-2}+\cdots$ such positions) where the two operations differ, so relatively worse as $n$ increases) where the two differ. Can we express these positions in terms of integer properties?

The answer is: Let $x,y \in \mathbb{Z}_4,$ considered as an additive group. Then  the XOR operation on $x,y$ can be defined as

$$
x \oplus y = \begin{cases}
x + y + 2 ~(\text{mod } 4) &amp;
\text{if }   x \equiv 1 ~(\text{mod } 2)
\text{ and } y \equiv 1 ~(\text{mod } 2) \\
x + y ~(\text{mod } 4) &amp; \text{otherwise}.
\end{cases}
$$

The full answer has to do with the highest powers of $2$ dividing the two numbers within $\mathbb{Z}_{2^n},$ i.e., the subring and ideal structure.