In tweakable block ciphers the tweak acts some ways like part of the key and in other ways, acts like an initialization vector.

Should the the tweak remain secret like the key or visible like the an initialization vector. Or perhaps this may differ from one algorithm to another?


1 Answer 1


The way it is defined in the paper "Tweakable Block Ciphers" by Moses Liskov, Ronald L. Rivest and David Wagner:

A tweakable block cipher should also be secure, meaning that even if an adversary has control of the tweak input, we want the tweakable block cipher to remain secure.


For this operator, we call the new (second) input a tweak" rather than a nonce" or initialization vector," but the intent is similar.

so it is intended to be similar to an IV or nonce, not to be similar to a secret key.

Although a higher level mode of operation could still define the tweak to be secret, it certainly isn't intended to be, and it is unclear what the advantage would be, given that the block cipher itself doesn't depend on it.

So the only reason why the tweak would need to be kept secret is that it itself contains information that needs to be kept secret for other uses.

  • $\begingroup$ This information is really readily available in the main paper about tweakable block ciphers. It may be a good idea to read that kind of information first. $\endgroup$
    – Maarten Bodewes
    Oct 25, 2018 at 0:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.