# Tag Info

21

A block cipher is a family of permutations where the key selects a particular permutation from that family. With a tweakable bockcipher both key and tweak are used to select a permuation. So tweak and key are pretty similar. The main difference are the security and performance requirements for a tweak: Changing a key can be expensive, changing a tweak ...

8

Well, whether it is a secure tweakable block cipher depends on how resistant (E,D) are to related key attacks; that's not a standard assumption for block ciphers. For example, this would not be a secure tweakable block cipher with 3DES; because every 8th bit is ignored, the attacker can effectively test the value of the 7 adjacent bits (except for the 7 ...

3

To expand / generalize @poncho's reply, given a block cipher $(E,D)$ with keylength $n$, you can make a new one $(E',D')$ with key length $n+1$, which ignores the last bit of the key and just runs $(E,D)$. If $(E,D)$ is a secure PRP, then so is $(E',D')$. But plugging $(E',D')$ into the OP's construction does not yield a secure tweakable block cipher. To see ...

3

There are a couple of related concepts here: Tweakable blockciphers and format-preserving encryption (FPE). It turns out that tweakable blockciphers provide a very natural way of obtaining FPE, but they have other uses as well. As the blog discusses, sometimes we want, say, encrypted credit card numbers to themselves look like credit card numbers. That is, ...

3

This construction isn't generically secure, you need to analyze it for each blockcipher you want to use it with to see if it's secure. For example, consider a block cipher that simply xors the key into the state between rounds. In that case your construction is equivalent to xoring the tweak into the key. This has several consequences: Since we generally ...

3

When talking about encryption with block ciphers, you should distinguish block cipher itself from the mode of operation that employs the block cipher. Block cipher takes an input $P$ of fixed length $n$ and transforms it under key $K$ (and possibly under other parameters such as tweak $T$) to output $C$ of the same length $n$:  E:\; P \xrightarrow{K(,T)} ...

2

So you want to use EAX with a block cipher with a 56-bit key. Presumably, this is for a good reason. Your idea is to include a (long!) fixed string in the OMAC to slow down nonce creation. Since the attacker must know the nonce to test if a key is correct, this should also slow down a brute force attack. Instead of modifying EAX, you could use EAX in a ...

2

To emphasize that this isn't a generically good construction, we can show that AES with that tweak method is insecure (!). This observation is based on a simple 1 round differential characteristic; it starts off with a differential in one of the bytes, and a carefully chosen differential in the tweak. With this initial differential, after the AddRoundKey ...

1

I'll write down the definitions for tweakable block ciphers and ideal block ciphers, and hopefully the distinction becomes more clear. A tweakable block cipher is a function $E:\mathsf{K}\times\mathsf{T}\times\mathsf{X}\to\mathsf{X}$, where $\mathsf{K}$ is the set of keys, $\mathsf{T}$ the set of tweaks, and $\mathsf{X}$ the inputs. In particular, it should ...

1

The tweak is a service that the encryption method provides for you. What it allows you to do is provide context separation for various encryptions using the same key. Here's the problem that it is trying to help with: suppose you use the same key to encrypt a number of items; for example, suppose you're encrypting all the items in one column of a database ...

1

Tweak per message offers good security like IV per message . Basically a tweakable block cipher with same tweak for all messages is same as non-tweakable block cipher. It is deterministic in nature and not considered secure enough in itself. You need to apply a mode of encryption that has been designed for non-tweakable block ciphers to make it secure.

1

First let's very precisely look at a tweakless blockcipher to fully understand it: A regular blockcipher $E_k(x)$ with blocksize $n$ and key size $k$ is a permutation of the input block. What do I mean with that? Let's first tackle the word permutation here. Often a permutation means re-arranging elements within a set. So the set of all permutations of ...

Only top voted, non community-wiki answers of a minimum length are eligible