A Parallelizable Enciphering Mode

We describe a block-cipher mode of operation, EME, that turns an n-bit block cipher intoa tweakable enciphering scheme that acts on strings of mn bits, where m ∈ [1..n]. The mode isparallelizable, but as serial-efficient as the non-parallelizable mode CMC [6]. EME can be usedto solve the disk-sector encryption problem. The algorithm entails two layers of ECB encryptionand a “lightweight mixing” in between. We prove EME secure, in the reduction-based sense ofmodern cryptography. We motivate some of the design choices in EME by showing that a fewsimple modifications of this mode are insecure.