6

Background. PBKDF2 has a stupid design where generating two blocks of output costs the legitimate user twice as much as generating one block of output, without necessarily putting additional cost on the adversary's task of confirming a password guess. This is because each block of PBKDF2 output is generated by iterating the PRF on distinct initial inputs, ...


6

They are somewhat similar. A nonce is a more general concept which might occur in modes of operations or protocols whereas a tweak almost always refers to a tweakable blockcipher. A nonce is a number that must be used only once. Of course there are now nonce-misuse resistant constructions which decrease the impact of accidental nonce reuse but in general ...


6

There are a couple of related concepts here: Tweakable blockciphers and format-preserving encryption (FPE). It turns out that tweakable blockciphers provide a very natural way of obtaining FPE, but they have other uses as well. As the blog discusses, sometimes we want, say, encrypted credit card numbers to themselves look like credit card numbers. That is, ...


4

First let's very precisely look at a tweakless blockcipher to fully understand it: A regular blockcipher $E_k(x)$ with blocksize $n$ and key size $k$ is a permutation of the input block. What do I mean with that? Let's first tackle the word permutation here. Often a permutation means re-arranging elements within a set. So the set of all permutations of ...


4

To emphasize that this isn't a generically good construction, we can show that AES with that tweak method is insecure (!). This observation is based on a simple 1 round differential characteristic; it starts off with a differential in one of the bytes, and a carefully chosen differential in the tweak. With this initial differential, after the AddRoundKey ...


4

This construction isn't generically secure, you need to analyze it for each blockcipher you want to use it with to see if it's secure. For example, consider a block cipher that simply xors the key into the state between rounds. In that case your construction is equivalent to xoring the tweak into the key. This has several consequences: Since we generally ...


3

The way it is defined in the paper "Tweakable Block Ciphers" by Moses Liskov, Ronald L. Rivest and David Wagner: A tweakable block cipher should also be secure, meaning that even if an adversary has control of the tweak input, we want the tweakable block cipher to remain secure. Furthermore: For this operator, we call the new (second) input a ...


3

Suppose the tweakable cipher uses a secret key $k$ and a secret tweak $t$, then syntactically you can regard $K=(k, t)$ as the total secret key. So, in this case, the 'tweakable cipher' is just an ordinary block cipher, with a longer key. In order to get a notion different from the usual block cipher, you'll need the tweak to be non-secret.


3

This is outside the goal of tweakable block ciphers. For a counterexample, the following is an example of a secure (if inefficient) tweakable block cipher in the paper introducing tweakable block ciphers as Theorem 1 (p. 35): $$\widetilde E_K(T, M) = E_K(T \oplus E_K(M)),$$ where $E_K(M)$ is a block cipher. If you know $K$, $M$, and $C = \widetilde E_K(T, ...


3

When talking about encryption with block ciphers, you should distinguish block cipher itself from the mode of operation that employs the block cipher. Block cipher takes an input $P$ of fixed length $n$ and transforms it under key $K$ (and possibly under other parameters such as tweak $T$) to output $C$ of the same length $n$: $$ E:\; P \xrightarrow{K(,T)} ...


3

The tweak is a service that the encryption method provides for you. What it allows you to do is provide context separation for various encryptions using the same key. Here's the problem that it is trying to help with: suppose you use the same key to encrypt a number of items; for example, suppose you're encrypting all the items in one column of a database ...


2

So you want to use EAX with a block cipher with a 56-bit key. Presumably, this is for a good reason. Your idea is to include a (long!) fixed string in the OMAC to slow down nonce creation. Since the attacker must know the nonce to test if a key is correct, this should also slow down a brute force attack. Instead of modifying EAX, you could use EAX in a ...


2

Key wrapping and tweakable encryption are actually quite different topics. Key wrapping is more commonly related to keys forage and key archive. Key wrapping This is fancy terminology for encryption key with another key. In key wrapping you have a master key that is used to protect one or more keys. It is generally impossible for (computationally ...


2

I'll write down the definitions for tweakable block ciphers and ideal block ciphers, and hopefully the distinction becomes more clear. A tweakable block cipher is a function $E:\mathsf{K}\times\mathsf{T}\times\mathsf{X}\to\mathsf{X}$, where $\mathsf{K}$ is the set of keys, $\mathsf{T}$ the set of tweaks, and $\mathsf{X}$ the inputs. In particular, it should ...


2

Well it'll change the output for sure. But it's not a great idea. I don't know what exact arrangements you have in mind, so I'll think of my own along those lines and throw some numbers at you: Possible number of 128 bit keys = 2^128 ~ 10^38 Possible number of ShiftRows tweaks = P(4!,10) ~ 10^13 -> 42 bits So better than I expected (42 bits) but still ...


2

For distinct tweaks $t \ne \tau$, the ciphers $E_{k,t}$ and $E_{k,\tau}$ should appear to be independent uniform random permutations for uniform random $k$. For example, you could think of it like having a single-bit tweakable block cipher where $E_{k,0} = \operatorname{AES256}_{k_0}$ and $E_{k,1} = \operatorname{Serpent256}_{k_1}$, where $k_0$ and $k_1$ ...


2

This would be done by a last round attack. The attacker would collect a crib of known pairs of inputs that differ by the plaintext difference (01010001101011 in your example). They would then run through $2^{16}$ guesses for the last round key, for each guess they would be able calculate the difference between each pair in round $r-1$ (by running just one ...


2

You are correct: OCB2 was only named so after the fact. Confusingly, it was named OCB1 in the original 2004 paper. You can find the OCB2 naming on the paper that introduces OCB3, The Software Performance of Authenticated-Encryption Modes: Integrated AE schemes were invented to improve performance of composed ones, but it has not been clear if they do. In ...


1

Minematsu studied this construction, and some generalizations thereof, in Section 5 of Beyond-Birthday-Bound Security Based on Tweakable Block Cipher. Minematsu, however, uses a PRF to derive keys instead of the block cipher. The idea is simple: the tweakable SPRP security of this construction, for $q$ queries distributed arbitrarily over $t \le q$ ...


1

Are the tweaks always just a string of bits? There is no reason that it has to be. Some algorithm designer could put a restriction on tweaks beyond just how many bits it can have. Are they usually shorter than the key? It may be a challenge to design fast ciphers with very long tweaks. If a tweakable block cipher isn't faster than deriving a new key ...


1

So, an obvious way to build a dual cipher is to make it the same cipher: $h = id$, $g = id$, $f=id$. But that probably doesn't help your understanding. I will a slightly less trivial example of a very simple dual cipher for your $E_{K_1, K_2}(P) = [(P \cdot K_1) + K_2]\ mod\ 26$. $E'_{K_1,K_2}(P) = [((P+5)\cdot K_1) + K_2]\ mod\ 26$ which is dual for $h(...


1

Abstractly, there is no $2^{l_X/2}$ limit on the security of a block cipher. The security claim is that the block cipher is indistinguishable from a random permutation which it may remain even after the adversary has seen all its inputs and outputs (for a particular key). Similarly, there is no reason a tweakable block cipher needs to become insecure after a ...


1

In the case of SKINNY the first column in the comparison tables lists the area as GE value. GE is the "gate equivalent", I'll quote Wikopedia on this one: A gate equivalent (GE) stands for a unit of measure which allows to specify manufacturing-technology-independent complexity of digital electronic circuits. For today's CMOS technologies, the silicon ...


1

Key wrapping Key wrapping is used to... wrap keys :) One example: Suppose you want to encrypt a byte array with a public key algorithm like RSA. Since RSA is slow you would rather choose a random key for a symmetric block algorithm like AES, then encrypt the byte array with AES and just encrypt the AES key with RSA. Now the question is, how to encrypt the ...


1

Tweak per message offers good security like IV per message . Basically a tweakable block cipher with same tweak for all messages is same as non-tweakable block cipher. It is deterministic in nature and not considered secure enough in itself. You need to apply a mode of encryption that has been designed for non-tweakable block ciphers to make it secure.


Only top voted, non community-wiki answers of a minimum length are eligible