A block cipher encryption device for encrypting a data unit plaintext into blocks of ciphertexts, said data unit plaintext being assigned a tweak value and being divided into one or more plaintext blocks, the block cipher encryption device comprising for processing a single plaintext block ( P j) of the one or more plaintext blocks: - a combinatorial function unit (82-j) associated with each plaintext block, said combinatorial function unit (82-j) being configured to determine a tweak block value (T j) by applying a combinatorial function between a value derived from said tweak value and a function of a block index assigned to said plaintext block ( P j); wherein the block cipher encryption device further comprises, in association with each plaintext block: - a first masking unit (83-j) configured to determine a masked value ( M j ( T j)) by applying a data masking algorithm to the tweak block value ( T j) determined by the combinatorial function unit (82- j) associated with said plaintext block ( P j) - a first XOR unit (85-j) configured to determine an intermediate plaintext block ( IP j) by applying an XOR operation between said masked value ( M j ( T j)) and said plaintext block ( P j); - a block cipher encryption unit (86- j) configured to determine an intermediate ciphertext block ( IC j) by encrypting said intermediate plaintext block using a block cipher and a data encryption key; - a second XOR unit (87- j) configured to determine a ciphertext block ( C j) by applying an XOR operation between said masked value ( M j ( T j)) and said intermediate ciphertext block (IC j); wherein the block cipher encryption device further comprises: - a tweak encryption unit configured to determine an encrypted tweak value by encrypting said tweak value using said block cipher and a tweak encryption key, said value derived from said tweak value being equal to said encrypted tweak value. - a combinatorial function unit (82-j) associated with each plaintext block, said combinatorial function unit (82-j) being configured to determine a tweak block value (T j) by applying a combinatorial function between a value derived from said tweak value and a function of a block index assigned to said plaintext block ( P j); wherein the block cipher encryption device further comprises, in association with each plaintext block: - a first masking unit (83-j) configured to determine a masked value ( M j ( T j)) by applying a data masking algorithm to the tweak block value ( T j) determined by the combinatorial function unit (82- j) associated with said plaintext block ( P j) - a first XOR unit (85-j) configured to determine an intermediate plaintext block ( IP j) by applying an XOR operation between said masked value ( M j ( T j)) and said plaintext block ( P j); - a block cipher encryption unit (86- j) configured to determine an intermediate ciphertext block ( IC j) by encrypting said intermediate plaintext block using a block cipher and a data encryption key; - a second XOR unit (87- j) configured to determine a ciphertext block ( C j) by applying an XOR operation between said masked value ( M j ( T j)) and said intermediate ciphertext block (IC j); - a tweak encryption unit configured to determine an encrypted tweak value by encrypting said tweak value using said block cipher and a tweak encryption key, said value derived from said tweak value being equal to said encrypted tweak value.