# tweakable block cipher and ideal block cipher

Can the set of block ciphers obtained from a tweakable block cipher (using distinct tweaks) be considered as the set of ideal block ciphers ?

• To make sure I understand the question correctly, you're saying you have a concrete tweakable block cipher, say E(K,T,X), where K is the key input, T the tweak input , and X the plaintext, and you're asking whether E(K,T1,X), E(K,T2,X), ..., E(K,TN,X) is a set of ideal block ciphers? At best you can say that that set is computationally indistinguishable from as many independent, uniformly distributed random permutations. – pxdnr May 19 '16 at 17:51
• Thanks @pxdnr A tweakable block cipher is as you have described it. What are the requirement/method to conclude on the fact that they should be (or not) the set of ideal block cipher ? – Dingo13 May 20 '16 at 7:50

A tweakable block cipher is a function $E:\mathsf{K}\times\mathsf{T}\times\mathsf{X}\to\mathsf{X}$, where $\mathsf{K}$ is the set of keys, $\mathsf{T}$ the set of tweaks, and $\mathsf{X}$ the inputs. In particular, it should be the case that if you fix a key $K\in\mathsf{K}$ and tweak $T\in\mathsf{T}$, that $E(K,T,\cdot)$ is a permutation over $\mathsf{X}$. A regular block cipher is just a tweakable block cipher with only one tweak.
With a tweakable block cipher, you generate the key as you normally would with a block cipher, but now you're given access to a family of permutations via the tweak input, instead of just one permutation as with regular block ciphers. So $E(K,T_1,\cdot)$ and $E(K,T_2,\cdot)$ should give you access to different permutations. In fact, the security requirement of a tweakable block cipher says that each of those permutations $E(K,T_1,\cdot)$, $E(K,T_2,\cdot)$, $\ldots$, should 'look' independent of each other, and behave like ideal permutations (an ideal permutation is one which is generated uniformly at random from the set of all permutations over $\mathsf{X}$).