1
$\begingroup$

NIST published methods for Format-Preserving Encryption and there is a link in the document giving examples for FF1 methods.

I am confused by the value of R given in the examples. $R$ is the output of PRF, and it should be 16 bytes. But all the $R$ values listed in the file are 32 bytes. Why is that?


For example, Page 1 , Round #0 , Step 6.ii:

R is [ 195, 184, 41, 161, 232, 100, 43, 120, 204, 41, 148, 123, 59, 147, 219, 99, 1, 2, 1, 0, 0, 10, 10, 5, 0, 0, 0, 10, 0, 0, 0, 0]

The first 16 bytes is actually the output of PRF with the given arguments and I have implemented this, but the remaining 16 bytes (starting from 1, 2, ...) is actually the same as the value of $P$ given in Step 5:

P is [ 1, 2, 1, 0, 0, 10, 10, 5, 0, 0, 0, 10, 0, 0, 0, 0 ].

What is actually going on here?

$\endgroup$
  • $\begingroup$ Now I am confident that the R values listed in the FF1 samples are actually wrong. Only the first 16 bytes should be listed there (which is actually the correct value). By the way, I also found another typo in Sample #3, where plaintext <0123456789abcdefghi>(Page 22) is encrypted and then decrypted to <01234567809abcdefgh> (Page 32). $\endgroup$ – longcpp Apr 18 '16 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.