What are diffrences between tweak and nonce?
I only know that nonce is used only once but tweak can be used for more than one time.but still by this diffrence I can't diffrentiate tweak and nonce
1
-
2$\begingroup$ A very good explanation can be found in Introduction in https://people.eecs.berkeley.edu/~daw/papers/tweak-crypto02.pdf. $\endgroup$– rodentrabiesCommented Jun 21, 2017 at 8:50
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
They are somewhat similar. A nonce is a more general concept which might occur in modes of operations or protocols whereas a tweak almost always refers to a tweakable blockcipher.
A nonce is a number that must be used only once. Of course there are now nonce-misuse resistant constructions which decrease the impact of accidental nonce reuse but in general you lose security if you reuse a nonce.
A tweak on the other hand can quite naturally be reused. One of the original uses for a tweak was for disk encryption where the tweak would depend on the position on disk. This will make the same plaintext encrypted with the same key give different ciphertexts.
In a way a tweakable blockcipher allows using more simple modes of operation without nonces. You don't have to chain blocks in complicated modes anymore to make sure that blocks cannot be compared or replaced you simply use "ECB mode" with a different tweak for each position.
So they somehow accomplish the same goal but nonces do so on the mode-of-operation level and tweaks directly on the blockcipher level.
-
$\begingroup$ Is this accurate? If the cipher parameters remain the same at a particular disk position, then an adversary monitoring a disk location over time would be able to spot the difference when that location is updated. $\endgroup$– conchildCommented Jun 21, 2017 at 12:47
-
1$\begingroup$ But if nothing changes there will be no writes to the location so it will also stay the same. Am I misunderstanding what you're saying? $\endgroup$– EliasCommented Jun 21, 2017 at 15:08
-
1$\begingroup$ In general there are more things to consider for disk encryption see for example en.wikipedia.org/wiki/Disk_encryption_theory and en.wikipedia.org/wiki/IEEE_P1619 $\endgroup$– EliasCommented Jun 21, 2017 at 15:28