A block cipher is a family of permutations where the key selects a particular permutation from that family. With a tweakable block cipher both key and tweak are used to select a permutation. Tweak and key are related concepts.

The main difference are the security and performance requirements for a tweak:

  • Changing a key can be expensive, changing a tweak must be cheap.

  • Being secure when using attacker chosen keys, or related keys, are not primary security properties of a block cipher. Typically they're analyzed assuming a randomly chosen secret key. Related key attacks are rather academic. For example AES is still considered secure despite related key attacks against it.

  • Related or attacker chosen tweaks must still be secure. The tweak is often a counter, so tweaks are often related.

One application of tweakable block ciphers is disk encryption. You encrypt each block with the same key, but a tweak that corresponds to the block index. Currently we usually don't use a tweakable block cipher for this, but rather XTS mode, which turns a normal block cipher into a tweakable block cipher.

Thank you to CodesInChaos for providing this excellent, simple explanation.

history | show excerpt | excerpt history