If I use XTS-AES and treat the tweak as a nonce/IV would the result be considered nonce-misuse-resistant?
I'm thinking of something like the following AEAD-like scheme:
enc(encKey, macKey, plaintext, aad): tweak = ... # 128 bits, generated like an IV or nonce # pad the plaintext to handle shorter-than-16-byte inputs # as well as determine the plaintext length after decryption a = AES-XTS(encKey, tweak, pad(plaintext)) b = tweak || a return b || MAC([aad, b], macKey)
A tweak collision seems to only disclose whether the same plaintext was encrypted with the same key and the same tweak, which matches the definition of nonce-misuse-resistance I see here and differs from Rogaway's description of AES-SIV's properties in that the collision is apparent even if the AAD differs.
My motivation is looking for a nonce-misuse-resistant scheme that is NIST-approved. Having many existing implementations is also a benefit.