# symmetric encryption with fixed size

What I basically need is a way to encrypt and decrypt symmetrically an ID which is a string. Both version of the ID will live and work in different domain and I need a way to switch domain without hold in memory a mapping table. My requirements are:

• both kind of IDs must be human readble (alphanumeric).
• plain IDs have fixed length
• encrypted IDs must have fixed length (not necessarily the same of plain IDs)

abc123 ==== encrypt ====> as78ads89dfs ==== decrypt ====> abc123 23kop2 ==== encrypt ====> jfdsdfsg8dsf ==== decrypt ====> 23kop2 ...

is there any way to obtain this with some combination of encryption and encoding?

thank you all

• About any normal symmetric cipher will do this for you, although you may need to rebase the result after encryption as a modern cipher will output any byte values, not just digits. This requirement seems missing from your question (and hence the answer from SEJPM). – Maarten Bodewes Dec 1 '17 at 23:33

Let $E_k$ denote any length-preserving authenticated encryption scheme, such as AES-GCM. These will usually add a fixed overhead of 12+16=28 bytes.

Now I shall assume that you know how to generate and manage keys for the above cipher and that you know how to generate nonces for the cipher.

Let $m$ be the maximal length your plaintext will ever have, in bytes. Define $m'=m+1$, this the length of the messages after encoding and the amount of data which will be fed into $E_k$.

The encoding itself is very easy: Take an $n$-byte message, append a 0x01 byte and $m-n$ 0x00 bytes. For decoding you start from the end of the message, go over all the 0x00 bytes until you hit the 0x01 byte. You throw away anything starting at (and including) the 0x01 byte.

So the overall flow would go like

0xBEEF     ==> encode ==> 0xBEEF010000 ==> AE-encrypt ==> nonce ||ciphertext ||tag  ==> AE-decrypt ==> 0xBEEF010000 ==> decode ==> 0xBEEF