Format preserving encryption has three modes FE1( FFX) , FE2(VAES) , FE3(BPS) . All of them are based on Feistel Networks .Can somebody explain how they differ from each other ?
$\begingroup$
$\endgroup$
2
-
$\begingroup$ It's even worse, FFX contains several different modes plus a bunch of parameters. $\endgroup$– CodesInChaosCommented Nov 8, 2013 at 13:26
-
$\begingroup$ And further, FPE is far from limited to these modes. $\endgroup$– fgrieu ♦Commented Sep 16, 2021 at 12:12
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
4
FF1, 2 and 3 are basically inspired by Luby-Rackoff constructions. At the core they differ in their round functions and key scheduling:
FF1 supports greater range of lengths and a tweak;
FF2 generates subkey for each iteration to thwart any side channel attacks;
FF3 has tweaks is split and used in rounding function, also the reverse the sub-strings of given input string while using in round function.
Both FF1, FF2 have 10 rounds while FF3 has only 8 rounds.
There is more information in the NIST's 800 38 G specification; note that FF2 has been withdrawn from it.
-
$\begingroup$ How do you decide which mode to use? $\endgroup$ Commented Apr 30, 2015 at 20:07
-
$\begingroup$ depends you need to pick on your requirements. you need greater range of lengths of formats or performance etc. $\endgroup$– sashankCommented May 1, 2015 at 16:38
-
$\begingroup$ It would be nice to know also the patent constraint on using these. HP holds patent for FF1 sub-components. I guess the use in commercial software is somehow limited. I don't know how - contacting HP to learn more. Will let you know. $\endgroup$ Commented Jul 31, 2016 at 8:31
-
$\begingroup$ if you want a non-patented solution , check this github.com/cisco/libfnr , not a standard though , Disclaimer: am the co-author of this scheme $\endgroup$– sashankCommented Aug 1, 2016 at 4:07