Security of a parallelizable block cipher mode This is the scheme of a parallelizable block cipher mode of operation:


$IV$ is the initialization vector.
$BN$ is the zero-based index number of a block in a stream of data.
$BT$ is the tweak that is used in the encryption process of each block.
$K$ is the key.
$PT$ is a plaintext block.
$CT$ is a ciphertext block.


Encryption and decryption are as follows:


$BT = IV \boxplus BN$
$CT = \mathrm{Encrypt}(K, PT \oplus BT)$
$PT = \mathrm{Decrypt}(K, CT) \oplus BT$


What is obvious to me about this scheme:


It is parallelizable.
It does not suffer from the drawbacks of ECB mode.
There is no cascading effect as seen in CBC, PCBC, and OFB modes of operation.


Are there any security drawbacks with this scheme?

Update: I've considered the criticism and now $BT = \mathrm{Encrypt}(K, IV \boxplus BN)$. What impact does this have on the security?
One of the basic security requirements of a block cipher mode of operation is that it is indistinguishable under chosen plaintext attack (IND-CPA).  Essentially, this means that, if an attacker chooses two messages $m_A$ and $m_B$ and the defender randomly returns either $\text{Encrypt}(K, m_A)$ or $\text{Encrypt}(K, m_B)$ (with $K$ kept secret from the attacker), the attacker should be unable to determine whether the defender chose $m_A$ or $m_B$.

This scheme is not secure under that definition.  Here's how an attacker can win (assume $n$ is the block size).


The attacker submits $m_A = 0^n \| 0^n$ (two zero blocks) and $m_B = 0^n \| 0^{n-1}\|1$ (a zero block, and a block that is all zeros except the last bit).
If the defender chooses $m_A$, it will return $E(K, 0^n \oplus BT_0) \| E(K, 0^n \oplus BT_1) = E(K, IV) \| E(K, IV \oplus (0^{n-1} \| 1))$.  In other words, the output blocks will be different.
If the defender chooses $m_B$, it will return $E(K, 0^n \oplus BT_0) \| E(K, (0^{n-1}\|1) \oplus BT_1)$, where $E$ is the block cipher.  This simplifies to $E(K, 0^n \oplus IV \oplus 0^n) \| E(K, (0^{n-1}\|1) \oplus IV \oplus (0^{n-1}\|1)) = E(K, IV) \| E(K, IV)$.  In other words, the output blocks will be the same.


The attacker can easily distinguish which plaintext the defender chose.  This violates IND-CPA, which often leads to vulnerabilities in real-world systems.

Counter mode seems to offer similar benefits without the security problems: parallelizable, random access, etc.