# How to use AES correctly in BPS Format Preserving Encryption

I have several questions on using AES 128bit in the BPS format preserving encryption

Which modes are acceptable? (Should the block cipher used at each round be deterministic (ECB) or probabilistic (CBC, CTR etc)

What IV to set? Can I set it to the constant zero?

AES is directly used as a block cipher without a mode of operation in BC / BPS.

This would be identical to ECB mode for one block or CBC mode for one block and a zero IV in the case that the block cipher itself is not directly available. In that case you should not pad or remove a full block of padding if padding cannot be avoided. CTR of one block with a zero IV/nonce would also work.

But basically the answer to "what modes are acceptable" is: none. In that case the IV is also not applicable. The tweak can be seen as a specific kind of IV. Likewise you could see BC itself as a mode of operation for the block cipher.

• Indeed, since AES is used as a raw block cipher in BPS, AES does not need an IV. But if we use BPS repeatedly, in order to make it secure, BPS needs a different tweak at each use, and an IV could be used to define (the initial value of) that tweak (which, when enciphering multiple symbols, could be much like the counter in AES-CTR).
– fgrieu
Commented Oct 1, 2015 at 8:57
• I'm implementing this in C# and I'm as far as calculating the first round, and the result from AES encryption returns a byte array of 16 bytes. What is the proper way to perform the modular addition with L or R? (They are currently integers) (i.e. what to convert the AES byte array to? I tried converting to BigInteger but it yields a large negative number) Should I continue with the modular addition or do you think I'm doing something wrong? Commented Oct 2, 2015 at 19:46
• @erotavlas Could you make that questions on SO? Note that BigInteger is little endian, and that it doesn't matter too much for the lower bytes if you are adding a negative number (think about it). Commented Oct 2, 2015 at 20:37
• @MaartenBodewes Do you know of any alternative crypto forums (outside StackExchange) where people check each others algorithms or implementations? Does anything like that exist? Do you think trying to contact the authors of the papers for test vectors is worth a shot? Commented Oct 2, 2015 at 23:12
• @erotavlas Yes, if I cannot find test vectors I do contact the authors. If you are polite they normally are more than happy to help. I do normally point to this site as well, in the hope they join up. Commented Oct 2, 2015 at 23:46