What are advantages/disadvantages of an invertible tweak schedule in a tweakable block cipher?

Question

I have been doing research on a tweakable block cipher called BipBip. This is a rather niche cipher so I'll give a few facts about it for background before asking my question:

The structure is based on the decryptor. This is because BipBip's main purpose is to be used in Cryptographic Capability Computing which requires a cipher to encrypt and decrypt 64-bit pointers, and the pointers will be decrypted much more often than encrypted. The latency of the encryptor, to the writers of the paper, does not matter. They only care about the latency of the decryptor. They write:

Low-latency tweakable block ciphers like Mantis [BJK+ 16] or Qarma [Ava17] have a low latency for encryption and decryption. One ingredient that makes this possible is their simple and structured tweak schedule. However, in the case of BipBip, we only require ultra-low latency for decryption. Therefore, from a performance perspective, there is no issue with using a non-linear tweak schedule with high diffusion. In contrast, using a non-linear tweak schedule is an opportunity to lower the latency compared to using a simple and structured tweak schedule, since non-linearity paired with good diffusion in the tweak schedule can significantly contribute to the cryptographic strength of the cipher.

In the rounds of the tweak schedule there is a function called χ (chi) that is defined by:

What is very interesting about this function is that it makes use of an AND gate, making it non-invertible. This, in turn, makes the entire tweak schedule non-invertible, which means it has to run completely before encryption can begin. This causes the latency of the encryptor to be 3x longer than the decryptor.

My question is, if they chose an invertible option without an AND gate which allowed for significantly less latency of the encryptor, would the security be affected? Are there advantages or disadvantages to a non-invertible scheduler? We could apply this question in reverse to other block ciphers: what if AES had a non-invertible key schedule? Would it have increased security, and if so, would it be worth the latency trade-off?

If anyone can provide links to papers or references that would also be extremely helpful!

Answer 1

An invertible tweak schedule in a tweakable block cypher allows the decryption process to reverse the tweaks applied during encryption, ensuring that both encryption and decryption are consistent and efficient. This can simplify the overall design and improve security by making it easier to analyze and verify the cryptographic properties. However, the main disadvantage is that ensuring invertibility can introduce complexity in the tweak schedule design, potentially leading to increased implementation difficulty and higher computational overhead.

Answer 2

After reading through multiple sources and help from Samuel Neves comment, I have figured out that the $\chi$ function is actually invertible.

This paper goes in depth as to a simple one-line equation that can be used to find the inverse mapping of $\chi$. It should be possible to implement this into the tweak schedule.

It seems that the BipBip authors are completely unaware of this, as the invertibility of their tweak schedule is never mentioned throughout the paper. However, it clearly shows in their latency benchmarks, which show the encryptor being much slower as a direct result of having to run the tweak schedule in it's entirety.

Invertibility has much faster latency, allowing a tweak schedule to run in parallel with the datapath of the encryptor. I plan on writing a paper that covers this latency difference in much more detail. I will also attempt to propose an inverse tweak schedule to allow BipBip's encryptor to have a similar latency to the decryptor.

Non-invertibility seems to not have an effect on security, and now that I know $\chi$ is actually invertible, BipBip's tweak schedule has no reason to be non-invertible, and it simply makes the encryption slower.