  This paper introduces the XOR-OR-AND normal form (XNF) for logical formulas.
It is a generalization of the well-known Conjunctive Normal Form (CNF) where
literals are replaced by XORs of literals. As a first theoretic result, we show
that every formula is equisatisfiable to a formula in 2-XNF, i.e., a formula in
XNF where each disjunction involves at most two XORs of literals. Subsequently,
we present an algorithm which converts Boolean polynomials efficiently from
their Algebraic Normal Form (ANF) to formulas in 2-XNF. Experiments with the
cipher ASCON-128 show that cryptographic problems, which by design are based
strongly on XOR-operations, can be represented using far fewer variables and
clauses in 2-XNF than in CNF. In order to take advantage of this compact
representation, new SAT solvers based on input formulas in 2-XNF need to be
designed. By taking inspiration from graph-based 2-CNF SAT solving, we devise a
new DPLL-based SAT solver for formulas in 2-XNF. Among others, we present
advanced pre- and in-processing techniques. Finally, we give timings for random
2-XNF instances and instances related to key recovery attacks on round reduced
ASCON-128, where our solver outperforms state-of-the-art alternative solving
approaches.
