Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Few block cipher modes has additional parameter , tweaks , especially the ones that are format preserving .
Now the comments section of this blog entry says such tweaks can be used for BIN numbers, expiration dates etc of credit card numbers.
How can tweaks be used to enforce such checks ?
what other ways tweaks can be used ?
First let's very precisely look at a tweakless blockcipher to fully understand it:
What do I mean with that? Let's first tackle the word permutation here. Often a permutation means re-arranging elements within a set. So the set of all permutations of the set $\{0, 1, 2\}$ is:
$$\{\{0, 1, 2\}, \{0, 2, 1\}, \{1, 0, 2\}, \{1, 2, 0\}, \{2, 0, 1\}, \{2, 1, 0\}\}$$
In maths, a permutation function maps the input domain to the output domain by rearranging the input domain (note that this means that the input domain must be equal to the output domain). So for example if we have permutation $f : \{0, 1, 2\} \rightarrow \{0, 1, 2\}$, then that function will map every element of the input domain to an element of the output domain, by rearranging. So if we'd re-arrange the input domain to $\{2, 1, 0\}$, then $f(0) = 2, f(1) = 1, f(2) = 0$.
This means that function $f$ is entirely decided by which rearrangement you choose. This is where the key comes in, it determines what rearrangement is used.
To summarize, $E_k(x) : \{0,1\}^k\times\{0,1\}^n\rightarrow\{0,1\}^n$ takes a $n$-bit input string and a $k$ bit key, chooses a rearrangement of the set of all $n$-bit strings ($\{0,1\}^n$) determined by the key and looks up the input string in this rearranged set.
Please note that this is all quite abstract and that the sets we're talking about are huge. This means that in a real-world algorithm no sets are rearranged or even stored, they're just mental tools to describe what happens. As an example of how this could work, define $f(x) = 2-x$ and compare with the example above.
Now we understand a blockcipher knowing what a tweak does shouldn't be too hard. It functions namely exactly the same as the key: it determines the permutation used. You might now think: what is the difference between the key and the tweak? The answer lies in something we haven't covered yet: security.
Apart from the mathematical definition we saw above for a blockcipher, there is also a security aspect. For a $n$-bit input block there are $(2^n)!$ permutations possible, and obviously a $k$-bit key can not possibly choose every possible permutation. A secure blockcipher however is defined to be a function indistinguishable from a random oracle within some pre-defined work limit (the security parameter) if the input block may be chosen by an adversary (note that the key may not be chosen).
A secure tweakable blockcipher is defined to be a function indistinguishable from a random oracle within some pre-defined work limit if the input block and tweak may be chosen by an adversary (the tweak is also passed to the oracle, obviously).
In layman's terms, the key is secret - the tweak is not.
Actual applications for such a function are immense. Much more effecient modes of operation for encryption and authentication can be made with it (OCB3), hash constructions (BLAKE2, Skein), efficient full-disk encryption, etc.
The most important reason why it's useful is that you can overcome the limitations of the electronic code book. By using the tweak as a little counter you can make every single invocation of the blockcipher essentially an unique function unrelated to any previous calls. This is very comforting for security.
There are a couple of related concepts here: Tweakable blockciphers and format-preserving encryption (FPE). It turns out that tweakable blockciphers provide a very natural way of obtaining FPE, but they have other uses as well.
As the blog discusses, sometimes we want, say, encrypted credit card numbers to themselves look like credit card numbers. That is, we want encryption to be an invertible function that takes a 16-digit number and spits out a 16-digit number, and this function should essentially look random to anyone who doesn't know the secret key. In mathematical terms, we want encryption to be a pseudorandom permutation on the set of 16-digit numbers.
But sometimes this isn't enough. For various reasons, it's often the case that only part of your credit card number gets encrypted, while the rest (e.g., the BIN and the last four digits) gets stored in plaintext. This creates a problem: what if two cards share the same 8 encrypted digits? Then if one card is known, the other can be recovered by an attacer. Or worse, what if an attacker has an opportunity to build a dictionary mapping 8-digit plaintexts to 8-digit ciphertexts?
This is where tweaking comes in. Tweaking effectively gives us access to a lot of completely independent pseudorandom permutations --- one for each possible tweak value. So if we encrypt the 8 secret digits using the BIN as the tweak, then the attacks above are no longer a concern. From an attacker's perspective, the ciphertext Encrypt(BIN-1, 01234567) will appear independent of Encrypt(BIN-2, 01234567). This remains true even if BIN-1 is very similar to BIN-2, and even if the attacker knows both BIN-1 and BIN-2. And we don't need to restrict ourselves to BINs -- any cleartext data that can be encoded into a tweak may be used in this fashion.
As I mentioned earlier, FPE is just one use of tweakable blockciphers. Because tweakable blockciphers are so much more powerful than (regular) blockciphers, they are a very nice building block to use when designing other cryptographic algorithms (such as OCB).
