In this question regarding integrity of FPE, the main point of the answer is that:

FFX is not malleable. [...] FFX can provide integrity protection in very limited circumstances.

So I was wondering, in practice how does one enforce integrity of the data? For instance if the systems stores credit card information and expects the correct format, it will be impossible to append a MAC or something like that.

What are the current best practices for FPE?

  • $\begingroup$ The notion of nonmalleable, Informally, in the context of encryption, the additional requirement is that given the ciphertext it is impossible to generate a different ciphertext so that the respective plaintexts are related. Under this definition, please re-read the second paragraph. $\endgroup$
    – kelalaka
    Commented Feb 25, 2020 at 17:59

1 Answer 1


The non-malleability of FPE is not a property that can be universally or even most of the time relied on to provide strong integrity protection, as the answer you're quoting points at when it says that "FFX can provide integrity protection in very limited circumstances" (my boldface). Such cases are the exception, not the rule.

For any cipher that produces ciphertexts no longer than the plaintexts, the best it can offer in terms of integrity is the very weak property that an attacker's forged ciphertexts will decrypt to pseudorandom plaintexts, which the attacker cannot in practice predict better than chance and thus exploit. This really isn't much, because the defender is unable to detect the forgeries, but most encryption-only modes don't even offer that much.

The exception that the answer you link to talks about is cases where plaintexts are redundantly coded—where the alphabet and length of the strings in which the messages are coded allows for $M$ distinct combinations, but there's only $N < M$ distinct valid messages and you can unambiguously distinguish these $N$ coded messages from the other $M - N$ invalid ones.

In that circumstance, if we encrypt messages with a non-malleable cipher, an attacker who forges a ciphertext only manages to hit upon one that decrypts to a valid plaintext with $N/M$ probability. In exceptional cases where $N/M$ is extremely small (say, $2^{-128}$) this could offer meaningful security, but if we're talking credit card numbers, which have a single checksum digit, it means an attacker's forgeries would be undetectable 10% of the time. Not good!

As for best practice, the thing I'd say that FPE should be avoided whenever you can, period. It's not designed to offer optimal security, but rather it's a compromise for situations where legacy issues prevent you from using optimal solutions.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.