0
$\begingroup$

I tried to understand the inner working of XTS. What I understood is that it is applying the tweak two times: once on the plaintext and once on the output.

What is the benefit of applying the tweak on the cipher text also?

$\endgroup$
1
$\begingroup$

XTS works by encrypting each plaintext block with XEX, and specifies which tweak to use. The benefit of applying the tweak to the blockcipher output is that it makes XEX secure against chosen-ciphertext attacks.

If T is the tweak and E is the underlying blockcipher, we could consider a variant of XEX without the second application of the tweak: $\mathsf{XEX}_\mathsf{weak}(T, X) = E(h(T) \oplus X)$ (where $h$ is the keyed function used to "hash" the tweak and $E$ is the blockcipher). Then decryption would be $\mathsf{XEX}_\mathsf{weak}^{-1}(T, Y) = E^{-1}(Y) \oplus h(T)$. But this would imply that for any T, Y, and Y', $\mathsf{XEX}_\mathsf{weak}^{-1}(T, Y') \oplus \mathsf{XEX}_\mathsf{weak}^{-1}(T, Y) = E^{-1}(Y) \oplus E^{-1}(Y)$ --- the $h(T)$ terms cancel out because of the way XOR works. This is a problem because the right-hand side doesn't depend on the tweak; tweakable ciphers should look like a family of unrelated random permutations, one permutation for each tweak, but the above equality is structural and predictable.

So if an attacker were to change the first two blocks of each sector to Y and Y', he could guarantee that the corresponding two plaintext blocks would always XOR to the same constant. It's hard to see how this would result in a practical attack (although I'm sure someone imaginative could find a contrived example). That being said, in crypto we generally try to avoid saying things like, "Oh, that'll never matter" and instead try to make algorithms that remain secure regardless of context. Plus, you can't be sure you've found all the attacks unless you prove that none exist. Applying the second tweak lets us prove that there are no efficient chosen-ciphertext or chosen-plaintext attacks against XEX.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.