# What is the benefit of applying the tweak a second time using XTS?

I tried to understand the inner working of XTS. What I understood is that it is applying the tweak two times: once on the plaintext and once on the output.

What is the benefit of applying the tweak on the cipher text also?

If T is the tweak and E is the underlying blockcipher, we could consider a variant of XEX without the second application of the tweak: $\mathsf{XEX}_\mathsf{weak}(T, X) = E(h(T) \oplus X)$ (where $h$ is the keyed function used to "hash" the tweak and $E$ is the blockcipher). Then decryption would be $\mathsf{XEX}_\mathsf{weak}^{-1}(T, Y) = E^{-1}(Y) \oplus h(T)$. But this would imply that for any T, Y, and Y', $\mathsf{XEX}_\mathsf{weak}^{-1}(T, Y') \oplus \mathsf{XEX}_\mathsf{weak}^{-1}(T, Y) = E^{-1}(Y) \oplus E^{-1}(Y)$ --- the $h(T)$ terms cancel out because of the way XOR works. This is a problem because the right-hand side doesn't depend on the tweak; tweakable ciphers should look like a family of unrelated random permutations, one permutation for each tweak, but the above equality is structural and predictable.