Ok but, in reply to that tweet, one point keccak.team make, which seems valid for non-classified cryptanalysis, is that researchers don't invest time in trying to analyse ARX because the propagation of addition makes it too complicated.

One thing I got from that is that ARX designs are less likely to be broken, not because they are necessarily more secure, but because ARX is often less analysed than designs which yield more concise mathematical representations.

I think there's an implication here of "less likely to be broken by public research".

Exactly, ARX's less analyzed complexity is a potential information asymmetry arbitrage for serious attackers.

That would be getting causality backwards.

I have no idea what you mean.

Shots fired indeed, although the 132-character argument is a bit of a straw man; the original argument was that using ARX operations in cryptographic primitives makes it harder to analyze the primitive, regardless of whether the actual weakness is in a boolean or an ARX operation.

Agreed. No contradiction. keccak.team does not say ARX is broken, only harder to analyze (and slow in HW, and getting obsoleted).

Well, AND and OR "lose information" more than XOR

x.0 is 0 and x+1 is 1 (to use combinational logic notation)

Now XOR(x,y) depend on x and y and there are no values that cause the other value to be ignored

I also think the point they make about speed is kinda picking at straws, it's valid for an FPGA, but not so much for a CPU