1
$\begingroup$

What is the name of the mode in which we simply change the tweak for each block without the need for complex chaining modes? Is this mode secure?

Are there any other recommended modes for native tweakable block cipher like Threefish?

$\endgroup$
  • $\begingroup$ Isn't the mode simply called TBC mode? I can easily find a paper on TBC and TAE (authenticated) modes. $\endgroup$ – Maarten Bodewes Mar 23 at 22:56
  • $\begingroup$ @MaartenBodewes As far as I know, TBC stands for Tweakable Block Cipher. It is not a mode. Also papers that i have found uses a chaining mode (cipher of a block is used as a tweak for the next block). Finally, not only me asking for that mode's name. In the following link, you may find a correct answer stating clearly "not sure if it has a standard name" link $\endgroup$ – m.nasim Mar 24 at 17:51
  • $\begingroup$ additional point to clarify my point of view. Threefish could be used in ECB mode or any other standard mode. Threefish still TBC, not a normal block cipher. $\endgroup$ – m.nasim Mar 24 at 19:24
  • $\begingroup$ What do you need that CTR mode doesn't have? I hope you're using encrypt-then-mac authentication, not relying on limited malleability instead of authentication. $\endgroup$ – Future Security Mar 30 at 15:19
  • $\begingroup$ @Future Security Tweakable ciphers already deploy a tweak with the key, why not using it as a counter given that changing tweak is cheap in terms of CPU time $\endgroup$ – m.nasim Mar 30 at 15:41
0
$\begingroup$

What is the name of the mode in which we simply change the tweak for each block without the need for complex chaining modes? Is this mode secure?

Yes, if you do it right it's IND\$-CPA secure but not IND-CCA (and thus not AE-secure). In particular you'd need a CTR-like counter in your tweak (ie block counter + nonce / IV) and then each message block would be encrypted by a unique random permutation which is only ever evaluated on one input, thus its output is indistinguishable from a random string (and thus IND\$-CPA secure).

You can see that this is not CCA-secure because an adversary can just ask for encryptions of $0^{2n}$ and $1^{2n}$ in a challenge query and then for their decryption query only modify the second block of the challenge ciphertext. That one will yield a randomized "message" upon decryption but the first block still contains $0^n$ or $1^n$.

This is actually almost exactly how OCB3 does message encryption (though it first constructs a TBC from a regular block cipher).

Are there any other recommended modes for native tweakable block cipher like Threefish?

There's also CTRT and an SIV-scheme based on that (paper here) which uses the nonce as the block input and the counter as the tweak-input to generate a keystream. This is actually quite nice for getting a variable-output-length PRF out of a TBC that accepts full-block message inputs (also the IND\$-CPA security is ~$\frac{q^2}{2^{t+n}}$ instead of regular CTR's ~$\frac{q^2}{2^n}$ for block-size $n$ and tweak-size $t$).

There's also the authenticated encryption scheme McOE (which builds on TBCs) which has the nice property that even for nonce-reusing adversaries it only leaks the length of the common prefix for same-nonce messages - while being an online encryption scheme that can stream the message and operate in constant memory unlike the SIV-like schemes.


Notation and Notions: $0^n,1^n$ are n-bit strings of all $0$ bits or all $1$ bits.
AE-security is called CCA3 in this answer, intuitively it means that you cannot distinguish the outputs of the encryption oracle from random strings and that you cannot come up with a ciphertext that you didn't get verbatim from the encryption oracle that will decrypt without error.
IND\$-CPA is not to be confused with IND-CPA and is a stronger notion that requires encryptions to be indistinguishable from random strings of the same length (so it's AE-security without the decryption oracle).

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thank you very much. Actually, i had to search for IND-XXX. I found this link which was asked by you :). Two more questions please, why did you say that "it is not secure against Chosen Ciphertext Attack". And what is AE-Secure? $\endgroup$ – m.nasim Mar 30 at 1:03
  • $\begingroup$ Well, I found that AE-Secure is IND-CCA secure and provide authentication. Is this right? $\endgroup$ – m.nasim Mar 30 at 1:18
  • $\begingroup$ @m.nasim I edited to add explanations for IND\$-CPA and AE-security and why the scheme is not even CCA. $\endgroup$ – SEJPM Mar 30 at 11:20
0
$\begingroup$

Many people want a "seekable cipher", which implies that they can't use chaining modes.(a) (b) So far I've seen 3 ways to build such a cipher:

  • XTS: "XEX-based tweaked-codebook mode with ciphertext stealing (XTS)" is used in most modern "full-disk encryption" systems. (c)

  • CTR: "Counter mode (CTR)" (d)

  • OCB "Offset Codebook Mode (OCB)" (e)

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thank you @David, this is why i am asking for TBC. as SEJPM said, i was plainning to use the tweak as a counter. however, i would not use a nonce at all. Threefish provides 1024 bit key. Long enough not to need additional security from the tweak. $\endgroup$ – m.nasim Mar 30 at 1:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.