TNT: How to Tweak a Block Cipher

In this paper, we propose Tweak-aNd-Tweak (minimal amsmath wasysym amsfonts amssymb amsbsy mathrsfs upgreek -69pt document$\mathsf {TNT}$documentTNT for short) mode, which builds a tweakable block cipher from three independent block ciphers. minimal amsmath wasysym amsfonts amssymb amsbsy mathrsfs upgreek -69pt document$\mathsf {TNT}$documentTNT handles the tweak input by simply XOR-ing the unmodified tweak into the internal state of block ciphers twice. Due to its simplicity, minimal amsmath wasysym amsfonts amssymb amsbsy mathrsfs upgreek -69pt document$\mathsf {TNT}$documentTNT can also be viewed as a way of turning a block cipher into a tweakable block cipher by dividing the block cipher into three chunks, and adding the tweak at the two cutting points only. minimal amsmath wasysym amsfonts amssymb amsbsy mathrsfs upgreek -69pt document$\mathsf {TNT}$documentTNT is proven to be of beyond-birthday-bound minimal amsmath wasysym amsfonts amssymb amsbsy mathrsfs upgreek -69pt document$2^{2n/3}$document22n/3 security, under the assumption that the three chunks are independent secure n-bit SPRPs. It clearly brings minimum possible overhead to both software and hardware implementations. To demonstrate this, an instantiation named TNT-AES with minimal amsmath wasysym amsfonts amssymb amsbsy mathrsfs upgreek -69pt document$6$document6, minimal amsmath wasysym amsfonts amssymb amsbsy mathrsfs upgreek -69pt document$6$document6, minimal amsmath wasysym amsfonts amssymb amsbsy mathrsfs upgreek -69pt document$6$document6 rounds of AES as the underlying block ciphers is proposed. Besides the inherent proven security bound and tweak-independent rekeying feature of the minimal amsmath wasysym amsfonts amssymb amsbsy mathrsfs upgreek -69pt document$\mathsf {TNT}$documentTNT mode, the performance of TNT-AES is comparable with all existing TBCs designed through modular methods.