# Format Preserving Encryption FF1 Samples

NIST published methods for Format-Preserving Encryption and there is a link in the document giving examples for FF1 methods.

I am confused by the value of R given in the examples. $R$ is the output of PRF, and it should be 16 bytes. But all the $R$ values listed in the file are 32 bytes. Why is that?

For example, Page 1 , Round #0 , Step 6.ii:

R is [ 195, 184, 41, 161, 232, 100, 43, 120, 204, 41, 148, 123, 59, 147, 219, 99, 1, 2, 1, 0, 0, 10, 10, 5, 0, 0, 0, 10, 0, 0, 0, 0]


The first 16 bytes is actually the output of PRF with the given arguments and I have implemented this, but the remaining 16 bytes (starting from 1, 2, ...) is actually the same as the value of $P$ given in Step 5:

P is [ 1, 2, 1, 0, 0, 10, 10, 5, 0, 0, 0, 10, 0, 0, 0, 0 ].


What is actually going on here?

• Now I am confident that the R values listed in the FF1 samples are actually wrong. Only the first 16 bytes should be listed there (which is actually the correct value). By the way, I also found another typo in Sample #3, where plaintext <0123456789abcdefghi>(Page 22) is encrypted and then decrypted to <01234567809abcdefgh> (Page 32). – longcpp Apr 18 '16 at 14:13