We describe a block-cipher mode of operation, EME, that turns an n-bit block cipher into a tweakable enciphering scheme that acts on strings of mn bits, where m 2 [1::n]. The mode is parallelizable, but as serial-ecient as the non-parallelizable mode CMC . EME can be used to solve the disk-sector encryption problem. The algorithm entails two layers of ECB encryption and a \lightweight mixing" in between. We prove EME secure, in the reduction-based sense of modern cryptography. We motivate some of the design choices in EME by showing that a few simple modi cations of this mode are insecure.