# Is XTS-AES a NIST-approved nonce-misuse-resistant AES mode?

If I use XTS-AES and treat the tweak as a nonce/IV would the result be considered nonce-misuse-resistant?

I'm thinking of something like the following AEAD-like scheme:

enc(encKey, macKey, plaintext, aad):
tweak = ... # 128 bits, generated like an IV or nonce

# pad the plaintext to handle shorter-than-16-byte inputs
# as well as determine the plaintext length after decryption
b = tweak || a
return b || MAC([aad, b], macKey)


A tweak collision seems to only disclose whether the same plaintext was encrypted with the same key and the same tweak, which matches the definition of nonce-misuse-resistance I see here and differs from Rogaway's description of AES-SIV's properties in that the collision is apparent even if the AAD differs.

My motivation is looking for a nonce-misuse-resistant scheme that is NIST-approved. Having many existing implementations is also a benefit.

• There is none. Sorry. You will have to go outside your comfort zone of NIST approval and risk furrowed eyebrows in an audit by US federal bureaucrats! – Squeamish Ossifrage Jun 3 '18 at 22:49
• @SqueamishOssifrage: actually, I believe FF1 or FF3 from nvlpubs.nist.gov/nistpubs/SpecialPublications/… would count as 'nonce-misuse-resistant' schemes (with the nonce being used as the tweak). – poncho Jun 3 '18 at 23:13