Optimally Secure Tweakable Blockciphers

We consider the generic design of a tweakable blockcipher from one or more evaluations of a classical blockcipher, in such a way that all input and output wires are of size n bits. As a first contribution, we show that any tweakable blockcipher with one primitive call and arbitrary linear preand postprocessing functions can be distinguished from an ideal one with an attack complexity of about 2. Next, we introduce the tweakable blockcipher F̃ [1]. It consists of one multiplication and one blockcipher call with tweak-dependent key, and achieves 2 security. Finally, we introduce F̃ [2], which makes two blockcipher calls, one of which with tweak-dependent key, and achieves optimal 2 security. Both schemes are more efficient than all existing beyond birthday bound tweakable blockciphers known to date, as long as one blockcipher key renewal is cheaper than one blockcipher evaluation plus one universal hash evaluation.