I'm a bit confused after reading several articles that seem to provide conflicting information. Basically I was wondering if AES by itself can be used as an FPE? And if so is this something computationally prohibitive, or something reasonable to do. Furthermore how can we use AES by itself + cycle walking?
According to this paper it says one of the methods for FPE is
5.2 Cycle walking Method "The cycle walking works by encrypting the plaintext by repeatedly applying AES or 3DES until the cipher text becomes in acceptable range. The duration for ciphering is not deterministic. "
If this is the case, what is the general construct for this (I.e. how to set up your AES encryptor, key, IV, mode etc)
In that paper they also have a table that summarizes the speed of this method compared to others.
But in another article it is stated that it would be prohibitively expensive to use cyclewalking alone since it would take many iterations to get a value in the desired range.
"So, why can't we just use cycle-walking? Because it only works well if the block size is approximately right—if the size of the valid set is a lot smaller than the block size of the cipher, then you have to do a lot of iterations in order to get an in-range result. So, you can't use a 64-bit block cipher in order to encrypt an SSN because you end up having to do a prohibitive number if iterations; you need to use L-R to construct a block cipher of approximately the right size and then use cycle-walking to shave off the last few values."
I'm not sure if the result 1500 milliseconds in the comparison table above is considered prohibitive or not for such an encryption scheme.