# implication of tweak on bruteforcing a block cipher

Consider a KPA attack, where the attacker gets known plain text and the corresponding cipher text. Since the encryption algorithm is known, he can brute force all possibilities of key bits. What is the implication of having additional tweak on brute forcing the algorithm?

Is this correct to say that now the attacker must try $2^k * 2^t$ possibilities, thus increasing the effort required to break the algorithm and so making it more secure? (where k is number of bits in key and t is number of bits in tweak).

Edit: Assuming tweak is kept secret . And also that my application prepends the tweak string to the plain text while encrypting it , $AES_K(Tweak || plain )$. Is my above assumption correct ?

Edit 2 : The AES in above is being used as a PRF in Luby Rackoff Construction like any other Format Preserving Encryption mode. So the AES is not exactly an encryption of the plain text but right half of the Feistel Network .(Honestly apologize for multiple edits)

• decrypting the ciphertext should produce the plaintext exactly, no number of tweaks will change that otherwise decrypting would need to be a $2^t$ operation Jan 8, 2014 at 13:04
• Your definition of tweak is weird. It's closer to an IV than to a tweakable blockcipher. Jan 9, 2014 at 10:35
• ^^ More than that, since you're demanding your tweak be kept secret its arguably just more key material. That said, sounds like a plausible use for the 'secret message number' mandated by the CAESAR competition. Jan 9, 2014 at 11:27

First of all, your use of the word "tweak" is a bit unusual. Typically a tweak is another key-like input to a block-cipher, not part of the plaintext. With an actual tweak like in Threefish an unknown tweak can act like a key. In fact Threefish treats key and tweak the same. For other tweakable block-ciphers that may be different since the security properties required from a tweak and a key are different.

For your use of "tweak" the following attacks apply:

Known plaintext attack:

Attacker takes the ciphertext, iterates over all keys and decrypts it. Compares the decrypted plaintext to the actual plaintext, if this succeeds this is a candidate key. Try key on some more blocks to confirm it.

Ciphertext only attack:

Attacker takes two ciphertexts, iterates over all keys and decrypts them. If the "tweak" part of both decryption is the same, it's a candidate key. They then try the key on a few additional blocks to confirm it.

• i have added more details in my question . Jan 9, 2014 at 14:36

The tweak is generally not secret, i.e. the adversary knows it (perhaps even chooses it, depending on the attack model) and thus doesn't have to try to guess it. So no, tweaks don't increase the effort to brute force a cipher ... unless of course the tweak is kept secret, in which case it may or may not increase the required effort, depending on how the tweak is mixed into the cipher state.

• i have edited my question accordingly. so can you tell if tweak has an implication ? Jan 9, 2014 at 3:44