# What is the difference between a dual cipher and a tweak?

I have looked at the idea of dual ciphers but I cannot convince myself I really understand them. I think I just need a very simple worked example.

I was given the definition: Two ciphers $E$ and $E′$ are dual ciphers if they are isomorphic, i.e. if there exist invertible transformations $f(⋅)$, $g(⋅)$, $h(⋅)$ such that $\forall \ P$ and $K$ $$f(E_K(P))=E′_{g(K)}(h(P))$$ However, this is not easy for me to follow. I think $E$ is the encryption method (in my case below, $[(P \times K_1)+ K_2] \bmod26$). Yet looking at the definition it seems $f(.)$ is the cipher, is that right? And $P$ and $K$ are the plaintext and cipher key respectively. But I really don't understand what $g(K)$ and $h(P)$ are, or how to derive them.

Let's say my encryption cipher is: $C = [(P \times K_1)+ K_2] \bmod26$

1. How do I make a dual cipher of it? A very simple one is fine. If my cipher is not suitable, would you give an equally simple one that can have a dual cipher?
2. In my dual cipher from $.1$, what are my $g(K)$ and $h(P)$?
3. What could I do to this cipher to makes it a tweak but not a dual cipher?
4. How do I show my tweak is not a dual cipher?

This has been bugging me for a while so a simple example would be very much appreciated. I have posted similar questions but the answers are too difficult for my age and level.

## 2 Answers

So, an obvious way to build a dual cipher is to make it the same cipher: $h = id$, $g = id$, $f=id$. But that probably doesn't help your understanding.

I will a slightly less trivial example of a very simple dual cipher for your $E_{K_1, K_2}(P) = [(P \cdot K_1) + K_2]\ mod\ 26$.

$E'_{K_1,K_2}(P) = [((P+5)\cdot K_1) + K_2]\ mod\ 26$

which is dual for $h(x) = x-5$, $g = id$, $f = id$.

You could also pick

$E''_{K_1,K_2}(P) = [((P+5)\cdot K_1) + K_2]\ mod\ 13$ which is still dual for $f(x) = x\ mod\ 13$.

So two ciphers are dual if you can ANY $h, g$ and $f$ such that the above equations hold.

Now, what is the difference between this and a tweak? A tweakable block cipher has an extra input which can be public but will still changes the permutation the cipher uses. That means that

$E_{K_1, K_2}(P, t) = [((P + t) \cdot K_1) + K_2]\ mod\ 26$

could be considered a tweakable block cipher but as we saw earlier all these ciphers are dual.

• Sorry, but what is $id$? And here I see $h(x)$ and not $h(P)$. Are they the same? I am asking because when I sub in $P = P+5$ I get the same result. And is $f(x)$ the actual cipher method? In your example, is $x = ([P+5].K_1)K_2$? I am still confused because I suddenly see $x$ when there is none shown in the ciphers. Looking at your cipher, $E''$, it seems $h(P) = P+5$ but what are $g(K_1)$ and $g(K_2)$ equal to in the dual cipher? – Red Book 1 Feb 14 '18 at 9:55
• $id$ is the identity function $id(x) = x$. This means it does nothing. – Elias Feb 14 '18 at 10:31
• $h(x) = x - 5$ is a function definition, it doesn't matter what $x$ is called. $h(y) = y - 5$ is the same function. – Elias Feb 14 '18 at 10:32
• $f$ can be any function, not necessarily a block cipher. I'm not sure what you mean by "actual cipher method". – Elias Feb 14 '18 at 10:32
• I see. So $h(P) = P + 5$ is correct? And does $g(K_1) = K_1$ and $g(K_2) = K_2$? If this is right, is this not always the case? I mean, how could we change $g(K_i)$ for two ciphers to remain dual? By 'actual cipher' I just meant the whole process of encryption, i.e. in my original cipher it would be $[(P.K_1)+K_2] \bmod 26$. And in this case, what is $f(x)$? – Red Book 1 Feb 14 '18 at 11:50

For distinct tweaks $t \ne \tau$, the ciphers $E_{k,t}$ and $E_{k,\tau}$ should appear to be independent uniform random permutations for uniform random $k$. For example, you could think of it like having a single-bit tweakable block cipher where $E_{k,0} = \operatorname{AES256}_{k_0}$ and $E_{k,1} = \operatorname{Serpent256}_{k_1}$, where $k_0$ and $k_1$ are like magic independent uniform random bit strings somehow both deterministically derived from $k$.

For dual ciphers $E \ne E'$, $E_k$ and $E'_k$ are very much not independent—there is a deterministic relation between them for every $k$, namely $f(E_k(p)) = E'_{g(k)}(h(p))$ for some deterministic functions $f$, $g$, and $h$.