30
$\begingroup$

Pretty simple question - but I can't seem to find much information about it.

  • What exactly is a tweakable block cipher?
  • How do they differ from traditional block ciphers?
  • What is the 'tweak'? Is it just a sequence of bytes? Does it have any special qualities?
  • Are tweakable block ciphers more suited to any particular situation?
  • How does Twofish (a traditional block cipher) compare to Threefish (a tweakable block cipher)?
| improve this question | |
$\endgroup$
  • 3
    $\begingroup$ A major reference is: cs.berkeley.edu/~daw/papers/tweak-crypto02.pdf $\endgroup$ – Mok-Kong Shen Jan 31 '13 at 17:02
  • 2
    $\begingroup$ Thanks @Mok-KongShen - I'd seen that - but I was hoping for a more simplified explanation (if such an explanation exists). Wikipedia has 5 sentences on the topic - whereas that PDF is quite in depth. I was looking for something in between. $\endgroup$ – hunter Jan 31 '13 at 17:12
33
$\begingroup$

A block cipher is a family of permutations where the key selects a particular permutation from that family. With a tweakable bockcipher both key and tweak are used to select a permuation. So tweak and key are pretty similar.

The main difference are the security and performance requirements for a tweak:

  • Changing a key can be expensive, changing a tweak must be cheap.

  • Being secure when using attacker chosen, or at least related keys are not primary security properties of a cipher. Typically they're analyzed assuming a randomly chosen secret key. Related key attacks are rather academic. For example AES is still considered secure despite related key attacks against it.

    Related or attacker chosen tweaks must still be secure. The tweak is often a counter, so tweaks are often related.

If you look at Threefish, tweak and key are pretty much treated in the same way. Changing either is cheap, and it doesn't suffer from related key attacks.

If on the other hand you'd take AES-256 and use part of the key as tweak, that wouldn't work well. Rekeying AES has a cost, and it suffers from related key attacks.

One application of tweakable block ciphers is disk encryption. You encrypt each block with the same key, but a tweak that corresponds to the block index. Currently we usually don't use a tweakable block cipher for this, but rather XTS mode, which turns a normal block cipher into a tweakable block cipher.

Such a tweak counter mode(not sure if it has a standard name) is generally nice. It's quite simple, similar to ECB. It's parallelizable and doesn't suffer from ECB's weaknesses. It also doesn't fail as catastrophically as CTR mode when a key(or key-iv pair) is reused.

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ Great explanation. So the tweak can be updated for each block? Does that mean that it should be, or simply can be? I've read that for Threefish the tweak is always 128-bits. If it were to be updated for each block, I assume it would always be derived from the same source, ie, hash(originalValue + indexOfBlock) (as an example example)? Would it make any sense to use Threefish in CBC mode? $\endgroup$ – hunter Jan 31 '13 at 18:51
  • 5
    $\begingroup$ The typical use is to use the block number as tweak. No need for hashing. Skein puts the counter into Threefish's tweak, together with a bit of additional information, such as a flag for the last block. When used as disk encryption, XTS simply uses the counter as tweak. You can use Threefish with constant tweak in CBC or any other conventional mode. A tweakable block cipher supports additional chaining modes compared to a normal block cipher, but can be used anywhere a normal block cipher is used. $\endgroup$ – CodesInChaos Jan 31 '13 at 18:58
  • 3
    $\begingroup$ Out of curiosity, what does it mean to say that "changing a key can be expensive"? What does Threefish do differently to AES that makes changing keys "cheap"? $\endgroup$ – Stephen Touset Oct 15 '14 at 19:34
  • 5
    $\begingroup$ @StephenTouset: Changing a key can be very expensive if there is a key expansion routine to calculate (eg AES), whereas tweaking the message need not be. A common method is to take a blockcipher $E_k(\cdot)$ and define the tweakable blockciphers $E^T_k(M):=H(T)\oplus E_k(M \oplus H(T))$ where H is some finite field multiplication with its own secret key (ie $H(T):=T\cdot K_2$). Thus the whole calculation consists of two xors and one finite field multiplication, whereas to tweak the key would require recomputing the whole AES key schedule [as well as opening you up to related key attacks]. $\endgroup$ – Cryptographeur Jan 14 '15 at 9:33
  • 2
    $\begingroup$ @pushpen.paul That's up to the user of the tweakable block-cipher. Often it is a public value, such as the index of the current block in a message. $\endgroup$ – CodesInChaos Jun 7 '17 at 7:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.