Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

The proofs and security of block ciphers constructed especially of Luby Rackoff Constructions and Feistel Networks is based on the number of queries and round functions. The security measure is always based on the probability with which the attacker can distinguish the randomness in the cipher text. For example Patarin's proof says the encryption can be distinguished in O($ m^2/2^{(l/2)}$) where m is number of queries and l is length of input bits.

But in general the bigger the key length it is considered as good against brute force and adding tweaks is considered provides additional randomness. Then why is the security measure not involving the key length or tweak length ? or is there a security measure that involves key and tweak ?

share|improve this question
With most modes the tweak isn't secret. It's typically known by the adversary and sometimes even chosen by them. For example with disk encrytion, you often use a tweakable blockcipher in an ECB like mode where the tweak is the block index. (AES-XTS is essentially a tweakable blockcipher). –  CodesInChaos Jan 8 at 15:52
add comment

1 Answer

Generally speaking, in proofs of security for Feistel ciphers with various numbers of randomly selected round functions, the secret 'key' is the set of round functions. Thus, when Patarin or whoever gives upper bounds on the Adversarial advantage for distinguishing a Feistel cipher with $k$ rounds from a random permutation, the key 'length' (i.e. the size of the key space) is implicit in $k$, the number of rounds. Keep in mind that many of the bounds (e.g. of Patarin) are information theoretic, so brute force isn't really an option -- that is, even someone with an infinitely powerful computer would not be able to distinguish the Feistel cipher from a random permutation better than the relevant bound.

Tweaks are not commonly included mostly because tweakable block ciphers are a recent innovation.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.