Can the set of block ciphers obtained from a tweakable block cipher (using distinct tweaks) be considered as the set of ideal block ciphers ?

  • $\begingroup$ To make sure I understand the question correctly, you're saying you have a concrete tweakable block cipher, say E(K,T,X), where K is the key input, T the tweak input , and X the plaintext, and you're asking whether E(K,T1,X), E(K,T2,X), ..., E(K,TN,X) is a set of ideal block ciphers? At best you can say that that set is computationally indistinguishable from as many independent, uniformly distributed random permutations. $\endgroup$ – pxdnr May 19 '16 at 17:51
  • $\begingroup$ Thanks @pxdnr A tweakable block cipher is as you have described it. What are the requirement/method to conclude on the fact that they should be (or not) the set of ideal block cipher ? $\endgroup$ – Dingo13 May 20 '16 at 7:50

I'll write down the definitions for tweakable block ciphers and ideal block ciphers, and hopefully the distinction becomes more clear.

A tweakable block cipher is a function $E:\mathsf{K}\times\mathsf{T}\times\mathsf{X}\to\mathsf{X}$, where $\mathsf{K}$ is the set of keys, $\mathsf{T}$ the set of tweaks, and $\mathsf{X}$ the inputs. In particular, it should be the case that if you fix a key $K\in\mathsf{K}$ and tweak $T\in\mathsf{T}$, that $E(K,T,\cdot)$ is a permutation over $\mathsf{X}$. A regular block cipher is just a tweakable block cipher with only one tweak.

With a tweakable block cipher, you generate the key as you normally would with a block cipher, but now you're given access to a family of permutations via the tweak input, instead of just one permutation as with regular block ciphers. So $E(K,T_1,\cdot)$ and $E(K,T_2,\cdot)$ should give you access to different permutations. In fact, the security requirement of a tweakable block cipher says that each of those permutations $E(K,T_1,\cdot)$, $E(K,T_2,\cdot)$, $\ldots$, should 'look' independent of each other, and behave like ideal permutations (an ideal permutation is one which is generated uniformly at random from the set of all permutations over $\mathsf{X}$).

Now an ideal block cipher is a mathematical object. It has the same syntax as regular block ciphers, namely it takes a key and gives you an ideal permutation per key, but there is no tweak input. In some sense you could consider ideal block ciphers to be a tweakable analogue to ideal permutations, since now you're given a family of ideal permutations to access. And in fact, in the security definition for tweakable block ciphers, you will be comparing your tweakable block cipher to a family of permutations. Therefore, in some sense you could say that a tweakable block cipher gives you the same functionality as an ideal block cipher, but the biggest difference is that a tweakable block cipher needs a uniformly generated key in order for it to work properly, whereas an ideal block cipher does not: it is an ideal mathematical object.

| improve this answer | |
  • $\begingroup$ Thanks again. I admit that I don't understand very well. The only thing that I understand here is that we have to distinguish between a concrete object and an ideal object. Can we say that a tweakable block cipher for a given wteak is indifferentiable from an ideal cipher ? If the response is yes, can we conclude that the set of ciphers obtained with distincts tweaks is indifferentiable from the set of ideal ciphers ? $\endgroup$ – Dingo13 May 20 '16 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.