8
votes
Accepted
Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?
Background.
PBKDF2 has a stupid design where generating two blocks of output costs the legitimate user twice as much as generating one block of output, without necessarily putting additional cost on ...
- 49.5k
6
votes
Difference between Tweak and nonce
They are somewhat similar. A nonce is a more general concept which might occur in modes of operations or protocols whereas a tweak almost always refers to a tweakable blockcipher.
A nonce is a number ...
- 4,933
3
votes
Accepted
Should a tweak value be secret like a key or visible like an IV?
The way it is defined in the paper "Tweakable Block Ciphers" by Moses Liskov, Ronald L. Rivest and David Wagner:
A tweakable block cipher should also be secure, meaning that even if an
adversary ...
- 94.5k
3
votes
Accepted
How to determine which tweak was used
This is outside the goal of tweakable block ciphers. For a counterexample, the following is an example of a secure (if inefficient) tweakable block cipher in the paper introducing tweakable block ...
- 49.5k
3
votes
Some simple questions about tweakable ciphers
Suppose the tweakable cipher uses a secret key $k$ and a secret tweak $t$, then syntactically you can regard $K=(k, t)$ as the total secret key. So, in this case, the 'tweakable cipher' is just an ...
- 858
2
votes
Accepted
Can tweaking a cipher have the same or similar effect as changing the key?
Well it'll change the output for sure. But it's not a great idea. I don't know what exact arrangements you have in mind, so I'll think of my own along those lines and throw some numbers at you:
...
- 15.7k
2
votes
What is the difference between a dual cipher and a tweak?
For distinct tweaks $t \ne \tau$, the ciphers $E_{k,t}$ and $E_{k,\tau}$ should appear to be independent uniform random permutations for uniform random $k$. For example, you could think of it like ...
- 49.5k
2
votes
Accepted
Why doesn't ChaCha use a 512bit key and xor parameters into it?
The obvious downside is there would be $2^{256}$ weak inputs (key-nonce-counter) due to ChaCha requiring constants to break symmetry (see this paper at 3.1 about NORX permutation based on ChaCha) and ...
- 1,702
2
votes
Accepted
Is the XOR two block ciphers still a block cipher?
Is the function defined by $\operatorname{Enc}(k_1,k_2,m) = E(k_1, m)\ \operatorname{XOR}\ E(k_2,m)$ guaranteed to have an inverse function $\operatorname{Dec}$?
We have a definition problem for &...
- 145k
2
votes
Backdoor Designer Key Recovery in LowMC-M
This would be done by a last round attack. The attacker would collect a crib of known pairs of inputs that differ by the plaintext difference (01010001101011 in your example). They would then run ...
- 26.4k
2
votes
Accepted
In what paper was OCB2 introduced?
You are correct: OCB2 was only named so after the fact. Confusingly, it was named OCB1 in the original 2004 paper.
You can find the OCB2 naming on the paper that introduces OCB3, The Software ...
- 12.8k
1
vote
Can the Threefish tweak block cipher have its fixed 128 bit tweak size extended to match the block size (256/512/1024)
You can extend tweak of Threefish, but that is significant modification and requires analysis. That would no longer be Threefish. It will probably decrease performance.
All subkeys (every key/tweak ...
- 1,702
1
vote
Accepted
Can MCOE AEAD mode be modified to work with Threefish tweak block cipher and generate intermediate tags
You can truncate tag (xoring MSB with LSB would not improve anything) to 128-bit to fit in tweak. It will reduce security of tag and limit number of blocks you can encrypt with same key to $2^{64}$ (...
- 1,702
1
vote
Accepted
Is tweakable block-cipher based on the Merkle-Damgård construction secure if $F$ is a PRP
Minematsu studied this construction, and some generalizations thereof, in Section 5 of Beyond-Birthday-Bound Security Based on Tweakable Block Cipher. Minematsu, however, uses a PRF to derive keys ...
- 12.8k
1
vote
Accepted
Some simple questions about tweakable ciphers
Are the tweaks always just a string of bits?
There is no reason that it has to be. Some algorithm designer could put a restriction on tweaks beyond just how many bits it can have.
Are they ...
- 3,333
1
vote
Accepted
What is the difference between a dual cipher and a tweak?
So, an obvious way to build a dual cipher is to make it the same cipher:
$h = id$, $g = id$, $f=id$. But that probably doesn't help your understanding.
I will a slightly less trivial example of a ...
- 4,933
1
vote
Is it possible for this tweakable block cipher scheme to be secure for more than $2^\frac{n}{2}$ blocks? $2^{n}$ blocks?
Abstractly, there is no $2^{l_X/2}$ limit on the security of a block cipher. The security claim is that the block cipher is indistinguishable from a random permutation which it may remain even after ...
- 32.4k
1
vote
Accepted
What is the difference between lightweight tweakable block cipher and tweakable block cipher?
In the case of SKINNY the first column in the comparison tables lists the area as GE value. GE is the "gate equivalent", I'll quote Wikopedia on this one:
A gate equivalent (GE) stands for a unit ...
- 94.5k
Only top scored, non community-wiki answers of a minimum length are eligible