What is a tweakable block cipher? Pretty simple question - but I can't seem to find much information about it.


What exactly is a tweakable block cipher?
How do they differ from traditional block ciphers?
What is the 'tweak'?  Is it just a sequence of bytes? Does it have any special qualities?
Are tweakable block ciphers more suited to any particular situation?
How does Twofish (a traditional block cipher) compare to Threefish (a tweakable block cipher)?
A block cipher is a family of permutations where the key selects a particular permutation from that family. With a tweakable bockcipher both key and tweak are used to select a permuation. So tweak and key are pretty similar.

The main difference are the security and performance requirements for a tweak:


Changing a key can be expensive, changing a tweak must be cheap.
Being secure when using attacker chosen, or at least related keys are not primary security properties of a cipher. Typically they're analyzed assuming a randomly chosen secret key. Related key attacks are rather academic. For example AES is still considered secure despite related key attacks against it.

Related or attacker chosen tweaks must still be secure. The tweak is often a counter, so tweaks are often related.


If you look at Threefish, tweak and key are pretty much treated in the same way. Changing either is cheap, and it doesn't suffer from related key attacks.

If on the other hand you'd take AES-256 and use part of the key as tweak, that wouldn't work well. Rekeying AES has a cost, and it suffers from related key attacks.



One application of tweakable block ciphers is disk encryption. You encrypt each block with the same key, but a tweak that corresponds to the block index. Currently we usually don't use a tweakable block cipher for this, but rather XTS mode, which turns a normal block cipher into a tweakable block cipher.

Such a tweak counter mode(not sure if it has a standard name) is generally nice. It's quite simple, similar to ECB. It's parallelizable and doesn't suffer from ECB's weaknesses. It also doesn't fail as catastrophically as CTR mode when a key(or key-iv pair) is reused.