# Tag Info

12

A block cipher is a family of permutations where the key selects a particular permutation from that family. With a tweakable bockcipher both key and tweak are used to select a permuation. So tweak and key are pretty similar. The main difference are the security and performance requirements for a tweak: Changing a key can be expensive, changing a tweak ...

6

Well, whether it is a secure tweakable block cipher depends on how resistant (E,D) are to related key attacks; that's not a standard assumption for block ciphers. For example, this would not be a secure tweakable block cipher with 3DES; because every 8th bit is ignored, the attacker can effectively test the value of the 7 adjacent bits (except for the 7 ...

2

So you want to use EAX with a block cipher with a 56-bit key. Presumably, this is for a good reason. Your idea is to include a (long!) fixed string in the OMAC to slow down nonce creation. Since the attacker must know the nonce to test if a key is correct, this should also slow down a brute force attack. Instead of modifying EAX, you could use EAX in a ...

2

There are a couple of related concepts here: Tweakable blockciphers and format-preserving encryption (FPE). It turns out that tweakable blockciphers provide a very natural way of obtaining FPE, but they have other uses as well. As the blog discusses, sometimes we want, say, encrypted credit card numbers to themselves look like credit card numbers. That is, ...

2

When talking about encryption with block ciphers, you should distinguish block cipher itself from the mode of operation that employs the block cipher. Block cipher takes an input $P$ of fixed length $n$ and transforms it under key $K$ (and possibly under other parameters such as tweak $T$) to output $C$ of the same length $n$:  E:\; P \xrightarrow{K(,T)} ...

1

Tweak per message offers good security like IV per message . Basically a tweakable block cipher with same tweak for all messages is same as non-tweakable block cipher. It is deterministic in nature and not considered secure enough in itself. You need to apply a mode of encryption that has been designed for non-tweakable block ciphers to make it secure.

1

First let's very precisely look at a tweakless blockcipher to fully understand it: A regular blockcipher $E_k(x)$ with blocksize $n$ and key size $k$ is a permutation of the input block. What do I mean with that? Let's first tackle the word permutation here. Often a permutation means re-arranging elements within a set. So the set of all permutations of ...

1

To expand / generalize @poncho's reply, given a block cipher $(E,D)$ with keylength $n$, you can make a new one $(E',D')$ with key length $n+1$, which ignores the last bit of the key and just runs $(E,D)$. If $(E,D)$ is a secure PRP, then so is $(E',D')$. But plugging $(E',D')$ into the OP's construction does not yield a secure tweakable block cipher. To see ...

Only top voted, non community-wiki answers of a minimum length are eligible