# AES encryption for pairwise identifiers

I'd like to map a random ID of 16 bytes (sourceID) to another random ID of 16 bytes (targetID).

The operation should:

• only be reversible by me
• be deterministic

There are about 1 million source ID's that need to be mapped. The target ID is public, while the source ID is private.

I was thinking of using AES with ECB to map the source ID to target ID.

mapID(sourceID, key) = targetID

What is the likelihood of someone being able to reverse the process if they only have the targetID?

Is this a terrible Idea?

No, this is not a terrible idea, this is an idea that is often used.

Basically you've described the main use of a symmetric block cipher for exactly the block size of AES. AES is fully deterministic and not reversible without the key.

A block cipher is a Pseudo Random Permutation (PRP) - basically a map - from a set of all possible plaintext to a pseudo-randomly ordered set of all possible ciphertext. The possible plaintext and ciphertext consist of all possible values for the given block size, in this case 128 bits. This maps perfectly with your input and output size.

Beware that:

• source ID's will always map to the same target ID's, even in time;
• an attacker can see from identical target ID's that the same source ID was used;
• if an attacker can change the target ID then it will decrypt to a random source ID;
• if an attacker can switch known target ID's the reversed source ID's will be switched as well.

If above can lead to problems depends on your use case / threat model.

• One way to mitigate the third issue (modified target IDs decrypting to random source IDs) would be to limit the range of valid source IDs to, say, those less than $2^{32}$. The probability of a modified target ID decrypting to a valid source ID would then be one in $2^{96}$, which should be negligible for most purposes. Jun 11 '16 at 13:36

Here is an example encoder / decoder of pairwise IDs that we use in OpenID Connect, based on AES/CBC/PKCS5Padding encryption.