Rotational cryptanalysis
An attack on ciphers built from addition, rotation and XOR, where simplicity turns out to be the weakness.
ARX (add, rotate, XOR) is fast in software and needs no lookup tables, which is why ChaCha20 and Salsa20 use it. The weakness is that rotation and XOR preserve structure in pairs of inputs, while addition modulo 2n only scrambles it randomly.
Dmitry Khovratovich and Ivica Nikolić described the attack in 2010. It exploits pairs of inputs that are rotated copies of each other, which can keep a difference pattern alive through several rounds with high probability. The lesson is a dry one: anyone designing a cipher from three simple operations should expect someone else to count them too.