9 votes

Format Preserving Hash Function

A standard credit card number has limited entropy. Per ISO/IEC 7812 the first 6 digits are fixed for a given card issuer, and the simplest prudent assumption is they are known to attackers. The last ...
fgrieu's user avatar
  • 141k
8 votes
Accepted

Does Format Preserving Encryption have significant advantages over a randomly generated lookup table?

any other considerations? Yes. In many common use cases the mapping table needs to be retained. That map changes each time a number is added; that's a backup / continuity of service headache. The ...
fgrieu's user avatar
  • 141k
8 votes
Accepted

Can you help me understand Format Preserving Encryption?

I cannot understand what is the difference with monoalphabetic substitution and what is the security offered. A monoalphabetic cipher applies to individual symbols of the plaintext. But an FPE ...
Luis Casillas's user avatar
5 votes
Accepted

Are small domain keyed permutations inherently unsafe?

No, small domain keyed permutations are not inherently unsafe, for some definition of unsafe adapted to the inherent limitations of a small domain. We can construct keyed permutation with a small ...
fgrieu's user avatar
  • 141k
3 votes
Accepted

Are there on-line ways to use a block cipher to generate unique $n$ bits that guarantee collision-freeness for $2^n$ times?

Are there on-line ways to use a block cipher to generate unique $n$ bits that guarantee collision-freeness for $2^n$ times? The obvious way to do this is select a Format Preserving Encryption mode of ...
poncho's user avatar
  • 147k
3 votes

which en/decrypt algorithm should use for small byte array that result have same length

result have same length as input array If you insist on this, then you must lose some security. At the very least, there's no room for a given value to be encrypted in two different ways. This means ...
Gilles 'SO- stop being evil''s user avatar
3 votes
Accepted

Is a naive 27bit FPE algorithm using AES-CTR insecure?

FFX supports information in arbitrary radix (aka base) beyond 2 of binary, and multiple allowed lengths. I'll restrict to Radix = 2 and Lengths = {27} , that is plaintext(s) of n = 27 bits. Because a ...
fgrieu's user avatar
  • 141k
2 votes

Encrypting a string as smaller pieces vs. encrypting it as a whole

(1) correct a mistake here: set S = {AA,AB,AC,BA,BB,BC,CA,CB,CC} = {0,1,2,3,4,5,6,7,8,9} should be set S = {AA,AB,AC,BA,BB,BC,CA,CB,CC} = {0,1,2,3,4,5,6,7,8} (2) According to your example. I ...
Leo.W's user avatar
  • 318
2 votes
Accepted

Is this the correct procedure for cycle walking using an FPE?

Yes, what you're describing is the correct way to cycle walk with FPE. In your case, the value you're encrypting is ten bits, so the largest possible ciphertext is 1024. You'll only need to cycle ...
pg1989's user avatar
  • 4,636
2 votes

How to encrypt email address using FPE?

Preserving the format of an email address (see RFC 5322 § 3.4.1) when encrypting it is quite easy. All you have to do is encode the ciphertext in base64 and prepend it to something like ...
forest's user avatar
  • 15.3k
2 votes

Is there a construction for a variable length block cipher that uses a fixed length one?

Yes, there is standard work on this. You should see "On the Construction of Variable-Input-Ciphers" by Bellare-Rogaway (PDF). They give definitions and constructions.
Yehuda Lindell's user avatar
2 votes
Accepted

Does the timing of cycle-walking pose a threat?

Your intuition is correct: the timing channel in cycle walking does not affect the pseudorandom permutation (PRP) security of a format-preserving encryption scheme built using cycle walking. More ...
pg1989's user avatar
  • 4,636
2 votes
Accepted

Splitting text before Format Preserving Encryption operation

I'd strictly perform FF1 on the entire postal code. That means converting the code to a number in the range $\big[0,26\cdot10\cdot26\cdot10\cdot26\cdot10\big)$ and then encrypting, decrypting and ...
Maarten Bodewes's user avatar
  • 92.6k
2 votes
Accepted

The modes of encryption that preserve the format

I'm aware of only one official specification: NIST SP 800-38G, and recommend to ignore it. Rather, consider NIST SP 800-38Gr1-draft, still unofficial, if something next to a rubber stamp is badly ...
fgrieu's user avatar
  • 141k
2 votes

Integrity of format preserving Encryption

The non-malleability of FPE is not a property that can be universally or even most of the time relied on to provide strong integrity protection, as the answer you're quoting points at when it says ...
Luis Casillas's user avatar
2 votes

Is there any block-cipher, format-preserving or similar encryption method with known cycle size? (without short-cut, with known source/runtime vars)

CAUTION: The following matches the requirement "no short-cut in computing $m_i$ is allowed. It always either require the knowledge of $m_{i-1}$ or $m_{i+1}$. Given two messages $m_i$, $m_j$ ...
fgrieu's user avatar
  • 141k
2 votes

How internal functions are defined for FF3?

From 4.1 Representation of Character Strings of the NIST SP 800 38G Rev 1 draft spec that was mentioned in the comments: The data inputs and outputs to the FF1 and FF3-1 encryption 286 and decryption ...
Maarten Bodewes's user avatar
  • 92.6k
2 votes
Accepted

FPE Limitations and Scope of FPE

Do you think the format preserving encryption(FPE) schemes have any limitation with respect to other conventional block ciphers? Actually, one can view an FPE scheme as a generalization of a ...
poncho's user avatar
  • 147k
2 votes
Accepted

Cryptographically obfuscating IP addresses while preserving locality

Here is an ad-hoc Format Preserving Encryption scheme based on a hash (e.g SHA-256) and a secret key string such that: It remains possible to identify using the standard rules that a scrambled ...
fgrieu's user avatar
  • 141k
2 votes
Accepted

Very small domains in FF1 or similar

You can use a modified affine cipher chain. It's the type of design I developed initially when trying to find a way to scramble database IDs, or name-based / time-based GUIDs without introducing ...
aiootp's user avatar
  • 773
2 votes

Lightweight length preserving encryption

Most symmetric modes of encryption - i.e. block ciphers in a mode of operation or stream ciphers - do not require overhead other than a nonce and an optional authentication tag. Using RSA or ECDSA or ...
Maarten Bodewes's user avatar
  • 92.6k
1 vote

Are small domain keyed permutations inherently unsafe?

Since "small" is relative, conceptually we could use the AES with say 256 bit key and 128 bit blocksize. All of the below are impractical but illustrate the point: Building a codebook given ...
kodlu's user avatar
  • 22.5k
1 vote

Publicly verify that a a ticket was issued by an authority with around 8 digits

Format Preserving Encryption would work fine. The change I would make is not using it as a 'checksum', but instead just taking the ticket number (which may be a value between 0 and, say, 699) and FPE ...
poncho's user avatar
  • 147k
1 vote
Accepted

What is the best way to pseudonymise IP addresses while retaining the ability to identify those that share a subnet?

After some more searching (thanks for the pointer in the comments) I came across the Crypto-PAn scheme (often spelled without the hyphen as CryptoPAn), which was described/developed for precisely this ...
Inkling's user avatar
  • 161
1 vote

FPE Limitations and Scope of FPE

Limitations (also present in a normal block cipher like AES) One limitation of Format Preserving Encryption is that it's deterministic: the same plaintext always leads to the same ciphertext. And by ...
fgrieu's user avatar
  • 141k
1 vote
Accepted

One way text→text function

Problem with the question's original solution is that the substitution table is the same at each index, and the better part of the key. It can thus be determined from examples. Problem with the "...
fgrieu's user avatar
  • 141k
1 vote
Accepted

Unbalanced numeric Feistel network implementation

Does the implementation follow accurately the described network generalization? No. The Feistel network analyzed in the paper assumes independent round functions, but the code does not give that. The ...
fgrieu's user avatar
  • 141k
1 vote
Accepted

Format Preserving Encyption question

The questions you're getting confused by are, indeed, confusing, but I think I figured out what's going on. Imagine a scenario where: A company want to issue exactly 10,000 numbered coupons; They are ...
Luis Casillas's user avatar
1 vote

Format Preserving Encyption question

Not sure if I am correct about this, but let me give it my best. I do get that encoding numbers from 0 to 9999 you get 10000 possible encodings, what I don't get is that how to you get 20 digit ...
A M's user avatar
  • 23

Only top scored, non community-wiki answers of a minimum length are eligible