3
$\begingroup$

Consider a KPA attack, where the attacker gets known plain text and the corresponding cipher text. Since the encryption algorithm is known, he can brute force all possibilities of key bits. What is the implication of having additional tweak on brute forcing the algorithm?

Is this correct to say that now the attacker must try $2^k * 2^t$ possibilities, thus increasing the effort required to break the algorithm and so making it more secure? (where k is number of bits in key and t is number of bits in tweak).

Edit: Assuming tweak is kept secret . And also that my application prepends the tweak string to the plain text while encrypting it , $AES_K(Tweak || plain ) $. Is my above assumption correct ?

Edit 2 : The AES in above is being used as a PRF in Luby Rackoff Construction like any other Format Preserving Encryption mode. So the AES is not exactly an encryption of the plain text but right half of the Feistel Network .(Honestly apologize for multiple edits)

Improve this question
$\endgroup$
3
  • $\begingroup$ decrypting the ciphertext should produce the plaintext exactly, no number of tweaks will change that otherwise decrypting would need to be a $2^t$ operation $\endgroup$
    – ratchet freak
    Jan 8, 2014 at 13:04
  • $\begingroup$ Your definition of tweak is weird. It's closer to an IV than to a tweakable blockcipher. $\endgroup$
    – CodesInChaos
    Jan 9, 2014 at 10:35
  • $\begingroup$ ^^ More than that, since you're demanding your tweak be kept secret its arguably just more key material. That said, sounds like a plausible use for the 'secret message number' mandated by the CAESAR competition. $\endgroup$
    – Cryptographeur
    Jan 9, 2014 at 11:27

2 Answers 2

Reset to default
2
$\begingroup$

First of all, your use of the word "tweak" is a bit unusual. Typically a tweak is another key-like input to a block-cipher, not part of the plaintext. With an actual tweak like in Threefish an unknown tweak can act like a key. In fact Threefish treats key and tweak the same. For other tweakable block-ciphers that may be different since the security properties required from a tweak and a key are different.

For your use of "tweak" the following attacks apply:

Known plaintext attack:

Attacker takes the ciphertext, iterates over all keys and decrypts it. Compares the decrypted plaintext to the actual plaintext, if this succeeds this is a candidate key. Try key on some more blocks to confirm it.

Ciphertext only attack:

Attacker takes two ciphertexts, iterates over all keys and decrypts them. If the "tweak" part of both decryption is the same, it's a candidate key. They then try the key on a few additional blocks to confirm it.

Improve this answer
$\endgroup$
1
  • $\begingroup$ i have added more details in my question . $\endgroup$
    – sashank
    Jan 9, 2014 at 14:36
5
$\begingroup$

The tweak is generally not secret, i.e. the adversary knows it (perhaps even chooses it, depending on the attack model) and thus doesn't have to try to guess it. So no, tweaks don't increase the effort to brute force a cipher ... unless of course the tweak is kept secret, in which case it may or may not increase the required effort, depending on how the tweak is mixed into the cipher state.

Improve this answer
$\endgroup$
1
  • $\begingroup$ i have edited my question accordingly. so can you tell if tweak has an implication ? $\endgroup$
    – sashank
    Jan 9, 2014 at 3:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.