What is the name of the mode in which we simply change the tweak for each block without the need for complex chaining modes? Is this mode secure?
Are there any other recommended modes for native tweakable block cipher like Threefish?
$\begingroup$
$\endgroup$
9
-
$\begingroup$ Isn't the mode simply called TBC mode? I can easily find a paper on TBC and TAE (authenticated) modes. $\endgroup$– Maarten Bodewes ♦Mar 23, 2020 at 22:56
-
$\begingroup$ @MaartenBodewes As far as I know, TBC stands for Tweakable Block Cipher. It is not a mode. Also papers that i have found uses a chaining mode (cipher of a block is used as a tweak for the next block). Finally, not only me asking for that mode's name. In the following link, you may find a correct answer stating clearly "not sure if it has a standard name" link $\endgroup$– m.nasimMar 24, 2020 at 17:51
-
$\begingroup$ additional point to clarify my point of view. Threefish could be used in ECB mode or any other standard mode. Threefish still TBC, not a normal block cipher. $\endgroup$– m.nasimMar 24, 2020 at 19:24
-
$\begingroup$ What do you need that CTR mode doesn't have? I hope you're using encrypt-then-mac authentication, not relying on limited malleability instead of authentication. $\endgroup$– Future SecurityMar 30, 2020 at 15:19
-
$\begingroup$ @Future Security Tweakable ciphers already deploy a tweak with the key, why not using it as a counter given that changing tweak is cheap in terms of CPU time $\endgroup$– m.nasimMar 30, 2020 at 15:41
|
Show 4 more comments
2 Answers
$\begingroup$
$\endgroup$
3
What is the name of the mode in which we simply change the tweak for each block without the need for complex chaining modes? Is this mode secure?
Yes, if you do it right it's IND\$-CPA secure but not IND-CCA (and thus not AE-secure). In particular you'd need a CTR-like counter in your tweak (ie block counter + nonce / IV) and then each message block would be encrypted by a unique random permutation which is only ever evaluated on one input, thus its output is indistinguishable from a random string (and thus IND\$-CPA secure).
You can see that this is not CCA-secure because an adversary can just ask for encryptions of $0^{2n}$ and $1^{2n}$ in a challenge query and then for their decryption query only modify the second block of the challenge ciphertext. That one will yield a randomized "message" upon decryption but the first block still contains $0^n$ or $1^n$.
This is actually almost exactly how OCB3 does message encryption (though it first constructs a TBC from a regular block cipher).
Are there any other recommended modes for native tweakable block cipher like Threefish?
There's also CTRT and an SIV-scheme based on that (paper here) which uses the nonce as the block input and the counter as the tweak-input to generate a keystream. This is actually quite nice for getting a variable-output-length PRF out of a TBC that accepts full-block message inputs (also the IND\$-CPA security is ~$\frac{q^2}{2^{t+n}}$ instead of regular CTR's ~$\frac{q^2}{2^n}$ for block-size $n$ and tweak-size $t$).
There's also the authenticated encryption scheme McOE (which builds on TBCs) which has the nice property that even for nonce-reusing adversaries it only leaks the length of the common prefix for same-nonce messages - while being an online encryption scheme that can stream the message and operate in constant memory unlike the SIV-like schemes.
Notation and Notions: $0^n,1^n$ are n-bit strings of all $0$ bits or all $1$ bits.
AE-security is called CCA3 in this answer, intuitively it means that you cannot distinguish the outputs of the encryption oracle from random strings and that you cannot come up with a ciphertext that you didn't get verbatim from the encryption oracle that will decrypt without error.
IND\$-CPA is not to be confused with IND-CPA and is a stronger notion that requires encryptions to be indistinguishable from random strings of the same length (so it's AE-security without the decryption oracle).
-
-
$\begingroup$ Well, I found that AE-Secure is IND-CCA secure and provide authentication. Is this right? $\endgroup$– m.nasimMar 30, 2020 at 1:18
-
$\begingroup$ @m.nasim I edited to add explanations for IND\$-CPA and AE-security and why the scheme is not even CCA. $\endgroup$– SEJPMMar 30, 2020 at 11:20
$\begingroup$
$\endgroup$
1
Many people want a "seekable cipher", which implies that they can't use chaining modes.(a) (b) So far I've seen 3 ways to build such a cipher:
answered Mar 28, 2020 at 22:23
-
$\begingroup$ Thank you @David, this is why i am asking for TBC. as SEJPM said, i was plainning to use the tweak as a counter. however, i would not use a nonce at all. Threefish provides 1024 bit key. Long enough not to need additional security from the tweak. $\endgroup$– m.nasimMar 30, 2020 at 1:06