I want to anonymise the initials of experiment participants by giving each a pseudonymic set of initials, by encrypting their true initials. Their initials are only two or three letters in length.

These are data from individual human experiment participants that I publish online and in scientific journals. The convention (from a more innocent time) is to inset each participant's initials in a graph of their data. Using Github I will publish all the code and anonymised data, excepting the key (more background: https://plus.google.com/+AlexHolcombe/posts/1sNgTnnAtYz). Symmetric encryption seems fine.

Is there a suitable algorithm simple enough to quickly implement in the R statistical language? I came across the Vignere cipher, which seems to be exactly what I need, but I know almost nothing about cryptography so perhaps that is naive. http://www.counton.org/explorer/codebreaking/vigenere-cipher.php

  • $\begingroup$ Is "a symmetric encoding" in the sense of symmetric encryption vs. PKE, or something else? $\hspace{.91 in}$ $\endgroup$ – user991 Apr 22 '15 at 5:09
  • $\begingroup$ @RickyDemer I meant symmetric encryption as opposed to PKE and with just one key, very very simple. $\endgroup$ – Alex Holcombe Apr 22 '15 at 5:14
  • $\begingroup$ How many letters long are the initials? $\;$ $\endgroup$ – user991 Apr 22 '15 at 5:24
  • 1
    $\begingroup$ If for example there was only one patient with 3-letters ID, s/he is not going to like your "I think it is ok to preserve their length".$\;$ Formally, you want Format Preserving Encryption on the set of 2-or-3-letters blobs, which has 26⋅26⋅27 elements. This is so small that a table of 18252 at-least-15-bit values implementing a pseudo-random permutation is feasible, and might be the simplest. $\endgroup$ – fgrieu Apr 22 '15 at 5:57
  • 2
    $\begingroup$ 1) Why use encryption at all? I'd rather use a lookup table/tokenization. 2) If you want to use crypto, why use format-preserving-encryption? 2) Anonymizing data sets is hard. It's often possible to correlate data from different sources to deanonymize such data. $\endgroup$ – CodesInChaos Apr 22 '15 at 8:58

It seems you want some sort of anonymization, and you already jump to a conclusion with encrypting symbols. Maybe you should step away of that for a moment, and ask yourself what your actual goal is.

  • Encryption is useful, if you want to be able to reverse that process. If you don't hashing is a better choice in general.
  • Your set is small enough that you can just create a lookup table on the fly with a random number generator of your choice, as fgrieu already pointed out.

Instead of focusing on how to anonymize the initials, you might want to have a closer look on the anonymization of the actual data, if there is more than a single measurement for each participant. Aggregation of data can reveal information, that you wouldn't have imagined before. Simple pseudonymization might only work for those with common features and expose those with rare combinations. E.g. gender + age in a group with mostly men will give some anonymity to the men, while women of a certain ag can be identified much easier.

In general, I would say it is a bad idea to publish the raw data from any experiment with real people, and don't rely on pseudonyms as anonymization. Only publish the final aggregated data, which shows what you want to state.

| improve this answer | |
  • $\begingroup$ Not enough space here to address these important issues! I do need to be able to reverse the process so that published results can be traced/audited back to the original untouched data. Often showing individual results is expected in my field (e.g. jov.arvojournals.org/data/Journals/JOV/933544/…), as combining across participants can yield patterns of results not true of any individual. My datasets do not contain demographics such as age or sex or medical characteristics, so identification danger not as critical, but the field needs to grapple more with this! $\endgroup$ – Alex Holcombe Apr 22 '15 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.