Is there any survey with the state of art treatment of format-preserving encryption for small domains (i.e. 2^20 for example)? I believe that Stalling's and Rogaway's surveys are out of date due to recent attacks on Feistel networks over small domains. Is it true that currently there is no working provably secure efficient solution for this task?

OK I just have dived into the literature, and there are a few things which I found (maybe it would be useful for others):

  1. It is true that 10 rounds for FF1 and 8 for FF3 are not enough to hide some statistical dependencies. Maybe more rounds would save the situation.
  2. There are some specific attacks on FF3 tweak schedule. It can be fixed easily.
  3. There are some interesting algorithms for tweakable block cipher (FEA-1, FEA-2) with arbitrary domains of type {0, 1}^n. Combining this cipher with cycle walking technique could work. But there is a lack of analysis of these new type of primitives, and attention from the community is required.

So currently there are NO provably secure algorithm for FPE on "middle-sized" domains ~2^20 - 2^50 (FEA-2 is an exception, but there were very little attention to this kind of primitive)



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.