This question is rather simple.

I've recently read the paper
"Automated Analysis and Synthesis of Authenticated Encryption Schemes".

On page 17 of this paper the authors provide three figures of encryption modes for
tweakable block ciphers. However all I can see is that the box representing the block cipher
only has one input and one output, as opposed to two for tweakable block ciphers.

Question: How can I translate the figures into the standard description of modes?

Standard description means something like $C_1=E_K(M_1\oplus C_0)$ for CBC.

For everyone not sure which figure is meant, here are the figures in question:

Figure in question from cited paper, p. 17

  • $\begingroup$ I think the tweak (e.g. just a counter) is already supposed to be in there, otherwise scheme 2 would violate CPA (if $M_1 = M_3$ it would clearly show up as $C_1 = C_3$, and authentication would be vulnerable for similar reasons). $\endgroup$
    – Maarten Bodewes
    Jul 23, 2015 at 14:47
  • $\begingroup$ So personally I would go for something like $C_1 = E_{k,1}(M_1 \oplus C_0)$ $\endgroup$
    – Maarten Bodewes
    Jul 23, 2015 at 14:55


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.