1
$\begingroup$

I want to prove the security of a Tweakable Block Cipher in CBC Mode

How does one prove the security of a Tweakable block cipher (ie Threefish) in CBC mode with a random IV and a constant (public) tweak?

In the case of Threefish, does the tweak need to take any prescribed form?

$\endgroup$
8
  • 3
    $\begingroup$ If the tweak is constant, don’t you essentially have a standard block cipher? $\endgroup$ – K.G. Mar 27 at 20:42
  • 1
    $\begingroup$ Any attack against a tweakable block cipher with a non-secret constant tweak is an attack against the tweakable block cipher, obviously. If you read the Skein submission, you will find that the security of Skein depends on Threefish being a (tweakable) block cipher. So the designers of Threefish obviously intended this. $\endgroup$ – K.G. Mar 29 at 9:38
  • 2
    $\begingroup$ I wrote Bruce how Threefish should be used in e.g. CBC mode but at the time I presume they were more interested in the actual competition. I got some attention because at that time I send them the adjusted test vectors before they published them, generated from my own independent implementation (there was a little issue with little endian for 128 bit values in their initial implementation). One of the questions was if the full number of rounds was required (80 from the top of my head).... $\endgroup$ – Maarten Bodewes Mar 29 at 10:29
  • 2
    $\begingroup$ The ideal functionality for a tweakable block cipher is that the tweak selects a random permutation that is independent from all other permutations selectable by the tweak. A tweakable block cipher tries to be indistinguishable from that functionality and a random permutation is the ideal functionality for a regular block cipher. $\endgroup$ – SEJPM Mar 29 at 12:25
  • 2
    $\begingroup$ I think the problem here is that CBC is hardly a good mode for it. You might be able to use the previous ciphertext block as tweak, but is that still CBC? Anyway, I think that @K.G. more or less answered the question: a tweakable block cipher with a constant tweak is just a block cipher, and the security of CBC holds, with all the advantages and disadvantages of CBC. $\endgroup$ – Maarten Bodewes Mar 29 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.