tweakable block cipher and ideal block cipher

Question

Can the set of block ciphers obtained from a tweakable block cipher (using distinct tweaks) be considered as the set of ideal block ciphers ?

Answer 1

I'll write down the definitions for tweakable block ciphers and ideal block ciphers, and hopefully the distinction becomes more clear.

A tweakable block cipher is a function $E:\mathsf{K}\times\mathsf{T}\times\mathsf{X}\to\mathsf{X}$, where $\mathsf{K}$ is the set of keys, $\mathsf{T}$ the set of tweaks, and $\mathsf{X}$ the inputs. In particular, it should be the case that if you fix a key $K\in\mathsf{K}$ and tweak $T\in\mathsf{T}$, that $E(K,T,\cdot)$ is a permutation over $\mathsf{X}$. A regular block cipher is just a tweakable block cipher with only one tweak.

With a tweakable block cipher, you generate the key as you normally would with a block cipher, but now you're given access to a family of permutations via the tweak input, instead of just one permutation as with regular block ciphers. So $E(K,T_1,\cdot)$ and $E(K,T_2,\cdot)$ should give you access to different permutations. In fact, the security requirement of a tweakable block cipher says that each of those permutations $E(K,T_1,\cdot)$, $E(K,T_2,\cdot)$, $\ldots$, should 'look' independent of each other, and behave like ideal permutations (an ideal permutation is one which is generated uniformly at random from the set of all permutations over $\mathsf{X}$).

Now an ideal block cipher is a mathematical object. It has the same syntax as regular block ciphers, namely it takes a key and gives you an ideal permutation per key, but there is no tweak input. In some sense you could consider ideal block ciphers to be a tweakable analogue to ideal permutations, since now you're given a family of ideal permutations to access. And in fact, in the security definition for tweakable block ciphers, you will be comparing your tweakable block cipher to a family of permutations. Therefore, in some sense you could say that a tweakable block cipher gives you the same functionality as an ideal block cipher, but the biggest difference is that a tweakable block cipher needs a uniformly generated key in order for it to work properly, whereas an ideal block cipher does not: it is an ideal mathematical object.