FPE preserves the length and format of the plaintext, so the ciphertext can't contain any more information than the plaintext has, unless the plaintext can be compressed. But assuming the plaintext isn't always very compressible, how is integrity of the ciphertext usually handled? I'm thinking that we can't add a MAC or similar since that would be additional information which wouldn't fit within the original format.
1
-
$\begingroup$ see also Format preserving encryption FFX and Integrity of format preserving Encryption $\endgroup$– MikeroCommented Oct 23 at 17:31
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Authenticated encryption demands that it should be hard for the adversary to find valid encryptions (ciphertexts that decrypt without error). But if an encryption scheme is length-preserving, every ciphertext is a valid encryption of some plaintext. Thus, the two requirements are incompatible.
The best you can hope for is that $\textsf{Enc}(K,\cdot)$ is (for each possible input length) indistinguishable from a totally random permutation. This implies that if you change the ciphertext $C=\textsf{Enc}(K,M)$ in any way, it will decrypt to something completely unrelated to $M$. Thus, you can achieve a kind of CCA property, but no authenticity.
