Clause 3: Terms and definitions

What the clause requires

The clause defines eight terms: block, ciphertext, encryption algorithm, key, plaintext, tweak, tweakable block cipher and tweakey. A tweakey is the concatenation of the key and the tweak inputs, and the tweak is explicitly non-secret.

What the public text does not state

• Whether the amendment adds, removes or redefines a term

What it means for you

The vocabulary is the part of the standard a policy writer can use immediately. The distinction that carries the most weight is between the key and the tweak. The key is secret. The tweak is not. The tweakey is the two joined together, and the document uses that word whenever it means the combined input.

That distinction has a policy consequence. A procedure that treats every input to the cipher as key material will over-protect the tweak and may make the wrong call about logging, rotation and separation. A procedure that treats the tweak as a nonce and assumes it can be any length will miss the key floor in clause 5.

The definitions are quoted by number in the standard, so the record keeps the numbers. When you write an internal glossary, cite 3.6 for tweak and 3.8 for tweakey rather than paraphrasing the words into something the engineering team will not recognise. Only the terms themselves are kept verbatim, as the house rule allows.

Evidence to keep

What an auditor or a customer is likely to ask for

Artefact	Owner	Why it matters
Internal glossary or policy annex with the eight terms and their clause numbers	ISMS manager	Shows the organisation uses the standard vocabulary in its own documents.
Key management procedure that separates key material from public tweak values	Security operations	The definition has a control consequence, and the procedure is where it shows.
Design note explaining the tweakey split for each implementation	Engineering	Makes the key and tweak lengths explicit rather than implied.

How to verify it

Search the policy for the word tweak. If it appears only in an engineering document and never in the key management procedure, the vocabulary has not reached the control.

Dates

The kit plan for clause 3 sets the evidence review at 17 June 2027, 90 days before the estimated publication date of 15 September 2027.

Cross references

• 4 Symbols
• 5 Requirements on the usage of tweakable block ciphers

Where this comes from