Can the set of block ciphers obtained from a tweakable block cipher (using distinct tweaks) be considered as the set of ideal block ciphers ?
-
$\begingroup$ To make sure I understand the question correctly, you're saying you have a concrete tweakable block cipher, say E(K,T,X), where K is the key input, T the tweak input , and X the plaintext, and you're asking whether E(K,T1,X), E(K,T2,X), ..., E(K,TN,X) is a set of ideal block ciphers? At best you can say that that set is computationally indistinguishable from as many independent, uniformly distributed random permutations. $\endgroup$– pxdnrMay 19, 2016 at 17:51
-
$\begingroup$ Thanks @pxdnr A tweakable block cipher is as you have described it. What are the requirement/method to conclude on the fact that they should be (or not) the set of ideal block cipher ? $\endgroup$– Dingo13May 20, 2016 at 7:50
1 Answer
I'll write down the definitions for tweakable block ciphers and ideal block ciphers, and hopefully the distinction becomes more clear.
A tweakable block cipher is a function $E:\mathsf{K}\times\mathsf{T}\times\mathsf{X}\to\mathsf{X}$, where $\mathsf{K}$ is the set of keys, $\mathsf{T}$ the set of tweaks, and $\mathsf{X}$ the inputs. In particular, it should be the case that if you fix a key $K\in\mathsf{K}$ and tweak $T\in\mathsf{T}$, that $E(K,T,\cdot)$ is a permutation over $\mathsf{X}$. A regular block cipher is just a tweakable block cipher with only one tweak.
With a tweakable block cipher, you generate the key as you normally would with a block cipher, but now you're given access to a family of permutations via the tweak input, instead of just one permutation as with regular block ciphers. So $E(K,T_1,\cdot)$ and $E(K,T_2,\cdot)$ should give you access to different permutations. In fact, the security requirement of a tweakable block cipher says that each of those permutations $E(K,T_1,\cdot)$, $E(K,T_2,\cdot)$, $\ldots$, should 'look' independent of each other, and behave like ideal permutations (an ideal permutation is one which is generated uniformly at random from the set of all permutations over $\mathsf{X}$).
Now an ideal block cipher is a mathematical object. It has the same syntax as regular block ciphers, namely it takes a key and gives you an ideal permutation per key, but there is no tweak input. In some sense you could consider ideal block ciphers to be a tweakable analogue to ideal permutations, since now you're given a family of ideal permutations to access. And in fact, in the security definition for tweakable block ciphers, you will be comparing your tweakable block cipher to a family of permutations. Therefore, in some sense you could say that a tweakable block cipher gives you the same functionality as an ideal block cipher, but the biggest difference is that a tweakable block cipher needs a uniformly generated key in order for it to work properly, whereas an ideal block cipher does not: it is an ideal mathematical object.
-
$\begingroup$ Thanks again. I admit that I don't understand very well. The only thing that I understand here is that we have to distinguish between a concrete object and an ideal object. Can we say that a tweakable block cipher for a given wteak is indifferentiable from an ideal cipher ? If the response is yes, can we conclude that the set of ciphers obtained with distincts tweaks is indifferentiable from the set of ideal ciphers ? $\endgroup$– Dingo13May 20, 2016 at 15:36