Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Pretty simple question - but I can't seem to find much information about it.

  • What exactly is a tweakable block cipher?
  • How do they differ from traditional block ciphers?
  • What is the 'tweak'? Is it just a sequence of bytes? Does it have any special qualities?
  • Are tweakable block ciphers more suited to any particular situation?
  • How does Twofish (a traditional block cipher) compare to Threefish (a tweakable block cipher)?
share|improve this question
    
A major reference is: cs.berkeley.edu/~daw/papers/tweak-crypto02.pdf –  Mok-Kong Shen Jan 31 '13 at 17:02
    
Thanks @Mok-KongShen - I'd seen that - but I was hoping for a more simplified explanation (if such an explanation exists). Wikipedia has 5 sentences on the topic - whereas that PDF is quite in depth. I was looking for something in between. –  hunter Jan 31 '13 at 17:12
add comment

1 Answer 1

up vote 12 down vote accepted

A block cipher is a family of permutations where the key selects a particular permutation from that family. With a tweakable bockcipher both key and tweak are used to select a permuation. So tweak and key are pretty similar.

The main difference are the security and performance requirements for a tweak:

  • Changing a key can be expensive, changing a tweak must be cheap.
  • Being secure when using attacker chosen, or at least related keys are not primary security properties of a cipher. Typically they're analyzed assuming a randomly chosen secret key. Related key attacks are rather academic. For example AES is still considered secure despite related key attacks against it.

    Related or attacker chosen tweaks must still be secure. The tweak is often a counter, so tweaks are often related.

If you look at Threefish, tweak and key are pretty much treated in the same way. Changing either is cheap, and it doesn't suffer from related key attacks.

If on the other hand you'd take AES-256 and use part of the key as tweak, that wouldn't work well. Rekeying AES has a cost, and it suffers from related key attacks.


One application of tweakable block ciphers is disk encryption. You encrypt each block with the same key, but a tweak that corresponds to the block index. Currently we usually don't use a tweakable block cipher for this, but rather XTS mode, which turns a normal block cipher into a tweakable block cipher.

Such a tweak counter mode(not sure if it has a standard name) is generally nice. It's quite simple, similar to ECB. It's parallelizable and doesn't suffer from ECB's weaknesses. It also doesn't fail as catastrophically as CTR mode when a key(or key-iv pair) is reused.

share|improve this answer
    
Great explanation. So the tweak can be updated for each block? Does that mean that it should be, or simply can be? I've read that for Threefish the tweak is always 128-bits. If it were to be updated for each block, I assume it would always be derived from the same source, ie, hash(originalValue + indexOfBlock) (as an example example)? Would it make any sense to use Threefish in CBC mode? –  hunter Jan 31 '13 at 18:51
2  
The typical use is to use the block number as tweak. No need for hashing. Skein puts the counter into Threefish's tweak, together with a bit of additional information, such as a flag for the last block. When used as disk encryption, XTS simply uses the counter as tweak. You can use Threefish with constant tweak in CBC or any other conventional mode. A tweakable block cipher supports additional chaining modes compared to a normal block cipher, but can be used anywhere a normal block cipher is used. –  CodesInChaos Jan 31 '13 at 18:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.