2
$\begingroup$

Since tweaks are like IV,Salt for block cipher inputs . Should they be unique for each message ?

If they are to be unique per message then what is the advantage of giving tweak directly into the message than giving IV ?

Edit : Is there a way in which we need not give unique tweak per message but get same security levels as giving unique IV per message ? as there are many ways of providing a tweak .

|improve this question
$\endgroup$
  • 1
    $\begingroup$ A tweakable blockcipher is just a building block. You can use many modes of operation on top, which have varying security properties. If you set the tweak to a constant you can use the normal modes. For some modes you'd use a unique tweak for each block in a message, but reuse the tweak across messages, relying on traditional IVs for different messages. $\endgroup$ – CodesInChaos Feb 11 '14 at 16:30
1
$\begingroup$

Tweak per message offers good security like IV per message .

Basically a tweakable block cipher with same tweak for all messages is same as non-tweakable block cipher. It is deterministic in nature and not considered secure enough in itself. You need to apply a mode of encryption that has been designed for non-tweakable block ciphers to make it secure.

|improve this answer
$\endgroup$
  • $\begingroup$ That makes little sense. You can still use CBC mode with a tweakable block cipher. $\endgroup$ – CodesInChaos Feb 11 '14 at 16:31
  • $\begingroup$ well that is not the point , the TBC can be used in any mode, it is just a block cipher with additional input tweak , for all practical purposes its block cipher and can be used in any mode . $\endgroup$ – sashank Feb 12 '14 at 2:04
  • $\begingroup$ @CodesInChaos reworded, now OK? $\endgroup$ – Maarten Bodewes♦ Feb 12 '14 at 14:35
0
$\begingroup$

The short answer: Tweaks and IVs play very different roles, so it's not really meaningful to compare them. If you view an encryption algorithm as a black box that takes, say, an IV and a plaintext and produces a ciphertext, there aren't any tweaks in sight. It's not until you break open the black box and look inside that you might start seeing tweaks (and tweakable blockciphers).

The longer answer: Tweakable blockciphers, like regular blockciphers, are a tool that cryptographers can use to build other algorithms (i.e., they are used in some mode of operation). They are almost never used directly.

How the underlying tweakable blockcipher gets used depends on the algorithm in question. For example, in OCB encryption, the message is split into blocks and each block is enciphered using a different tweak (the first half of the tweak is set to the IV, the second half is incremented with each block). In contrast, the Skein hash function (one of the SHA3 finalists) allows internal tweak values to be repeated when hashing different messages. This is fine --- tweakable blockciphers are just a tool, and can be used in different ways.

These details, however, can be safely hidden from a programmer who just needs to use OCB to encrypt things (or Skein to hash things). He doesn't even need to know what a "tweak" is! In contrast, he'd better know something about IVs --- in particular, that he shouldn't use the same IV twice with the same key when using OCB.

So to summarize:

  1. A tweak is one of the input values of a tweakable blockcipher. TBCs are used under the hood in various algorithms. The algorithm will specify exactly where the tweak comes from and how it's used. None of this needs to be visible to a programmer using the algorithm.
  2. IVs are usually used as inputs to a "higher level" algorithm. Some algorithms may require a random IV, others will just require that each IV is different, but usually the IV is under the control of the programmer.

This distinction between IVs and tweaks can get a bit blurred when it comes to full-disk encryption, because so-called "wideblock" disk encryption algorithms really do use a TBC directly. In this case, the tweak is set to the IV (which is set to the disk sector ID being encrypted).

That being said, at a high level, they play analogous roles in their respective domains: tweaks provide variability to blockciphers (allowing them to process a given n-bit block in different ways) while IVs provide variability to encryption algorithms (allowing them to encrypt a given message differently each time).

|improve this answer
$\endgroup$
  • $\begingroup$ if the developer does not need to know about tweak , how is the tweak generated/provisioned/provided as input to encryption algorithm , how is the same tweak provided again to decryption algorithm run in a different machine ? $\endgroup$ – sashank Feb 11 '14 at 4:46
  • $\begingroup$ It depends on the algorithm. For encryption algorithms, such as OCB, tweak values are usually derived from the IV. $\endgroup$ – Seth Feb 11 '14 at 5:03
  • $\begingroup$ Tweaks are designed to provide randomness to block ciphers directly rather than using the block cipher in some mode. I cannot agree for few things in the answer. 1. "Tweaks are never used directly", check out the different modes of FPE, tweaks are given directly by the user. 2."None of these needs to be visible to a programmer...", same check FPE. Now with this its appropriate to ask the comparison if its more secure to use a block cipher + IV per message or use a block cipher + same tweak for all messages ! $\endgroup$ – sashank Feb 11 '14 at 5:08
  • $\begingroup$ @Seth OCB is a mode of operation, it does not have a tweak $\endgroup$ – Richie Frame Feb 11 '14 at 9:27
  • $\begingroup$ @RichieFrame Yes, and this was precisely my point: that tweaks belong to tweakable blockciphers and IVs belong to modes of operation. I've edited the part of my answer that talks about OCB to hopefully make this more clear. $\endgroup$ – Seth Feb 11 '14 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.