9
votes
Format Preserving Hash Function
A standard credit card number has limited entropy. Per ISO/IEC 7812 the first 6 digits are fixed for a given card issuer, and the simplest prudent assumption is they are known to attackers. The last ...
- 145k
8
votes
Accepted
Can you help me understand Format Preserving Encryption?
I cannot understand what is the difference with monoalphabetic substitution and what is the security offered.
A monoalphabetic cipher applies to individual symbols of the plaintext. But an FPE ...
- 14.7k
8
votes
Accepted
Does Format Preserving Encryption have significant advantages over a randomly generated lookup table?
any other considerations?
Yes.
In many common use cases the mapping table needs to be retained. That map changes each time a number is added; that's a backup / continuity of service headache.
The ...
- 145k
5
votes
Accepted
Are small domain keyed permutations inherently unsafe?
No, small domain keyed permutations are not inherently unsafe, for some definition of unsafe adapted to the inherent limitations of a small domain. We can construct keyed permutation with a small ...
- 145k
3
votes
Accepted
Are there on-line ways to use a block cipher to generate unique $n$ bits that guarantee collision-freeness for $2^n$ times?
Are there on-line ways to use a block cipher to generate unique $n$ bits that guarantee collision-freeness for $2^n$ times?
The obvious way to do this is select a Format Preserving Encryption mode of ...
- 151k
3
votes
which en/decrypt algorithm should use for small byte array that result have same length
result have same length as input array
If you insist on this, then you must lose some security.
At the very least, there's no room for a given value to be encrypted in two different ways. This means ...
3
votes
Accepted
Is a naive 27bit FPE algorithm using AES-CTR insecure?
FFX supports information in arbitrary radix (aka base) beyond 2 of binary, and multiple allowed lengths. I'll restrict to Radix = 2 and Lengths = {27} , that is plaintext(s) of n = 27 bits.
Because a ...
- 145k
3
votes
Accepted
Very small domains in FF1 or similar
You can use a modified affine cipher chain. It's the type of design I developed initially when trying to find a way to scramble database IDs, or name-based / time-based GUIDs without introducing ...
- 1,122
2
votes
How to encrypt email address using FPE?
Preserving the format of an email address (see RFC 5322 § 3.4.1) when encrypting it is quite easy. All you have to do is encode the ciphertext in base64 and prepend it to something like ...
- 15.5k
2
votes
Is there a construction for a variable length block cipher that uses a fixed length one?
Yes, there is standard work on this. You should see "On the Construction of Variable-Input-Ciphers" by Bellare-Rogaway (PDF). They give definitions and constructions.
- 28.2k
2
votes
Accepted
Does the timing of cycle-walking pose a threat?
Your intuition is correct: the timing channel in cycle walking does not affect the pseudorandom permutation (PRP) security of a format-preserving encryption scheme built using cycle walking.
More ...
- 4,716
2
votes
Accepted
Splitting text before Format Preserving Encryption operation
I'd strictly perform FF1 on the entire postal code. That means converting the code to a number in the range $\big[0,26\cdot10\cdot26\cdot10\cdot26\cdot10\big)$ and then encrypting, decrypting and ...
- 94.5k
2
votes
Accepted
The modes of encryption that preserve the format
I'm aware of only one official specification: NIST SP 800-38G, and recommend to ignore it. Rather, consider NIST SP 800-38Gr1-draft, still unofficial, if something next to a rubber stamp is badly ...
- 145k
2
votes
Integrity of format preserving Encryption
The non-malleability of FPE is not a property that can be universally or even most of the time relied on to provide strong integrity protection, as the answer you're quoting points at when it says ...
- 14.7k
2
votes
Is there any block-cipher, format-preserving or similar encryption method with known cycle size? (without short-cut, with known source/runtime vars)
CAUTION: The following matches the requirement "no short-cut in computing $m_i$ is allowed. It always either require the knowledge of $m_{i-1}$ or $m_{i+1}$. Given two messages $m_i$, $m_j$ ...
- 145k
2
votes
Accepted
Cryptographically obfuscating IP addresses while preserving locality
Here is an ad-hoc Format Preserving Encryption scheme based on a hash (e.g SHA-256) and a secret key string such that:
It remains possible to identify using the standard rules that a scrambled ...
- 145k
2
votes
Accepted
FPE Limitations and Scope of FPE
Do you think the format preserving encryption(FPE) schemes have any limitation with respect to other conventional block ciphers?
Actually, one can view an FPE scheme as a generalization of a ...
- 151k
2
votes
Accepted
What is the best way to pseudonymise IP addresses while retaining the ability to identify those that share a subnet?
After some more searching (thanks for the pointer in the comments) I came across the Crypto-PAn scheme (often spelled without the hyphen as CryptoPAn), which was described/developed for precisely this ...
- 181
2
votes
How internal functions are defined for FF3?
From 4.1 Representation of Character Strings of the NIST SP 800 38G Rev 1 draft spec that was mentioned in the comments:
The data inputs and outputs to the FF1 and FF3-1 encryption 286 and decryption ...
- 94.5k
2
votes
Lightweight length preserving encryption
Most symmetric modes of encryption - i.e. block ciphers in a mode of operation or stream ciphers - do not require overhead other than a nonce and an optional authentication tag. Using RSA or ECDSA or ...
- 94.5k
2
votes
Format-Preserving Encryption with FF3 Algorithm - Minimum Length Constraints
The restrictions against small input in FF3 are for security reasons: it's required that the domain size is at least one million (in NIST SP 800-38G rev. 1 draft; one hundred in the original NIST SP ...
- 145k
2
votes
Accepted
Is there authenticated format-preserving encryption?
Authenticated encryption demands that it should be hard for the adversary to find valid encryptions (ciphertexts that decrypt without error).
But if an encryption scheme is length-preserving, every ...
- 14.5k
1
vote
Are small domain keyed permutations inherently unsafe?
Since "small" is relative, conceptually we could use the AES with say 256 bit key and 128 bit blocksize. All of the below are impractical but illustrate the point:
Building a codebook given ...
- 23.7k
1
vote
Publicly verify that a a ticket was issued by an authority with around 8 digits
Format Preserving Encryption would work fine. The change I would make is not using it as a 'checksum', but instead just taking the ticket number (which may be a value between 0 and, say, 699) and FPE ...
- 151k
1
vote
FPE Limitations and Scope of FPE
Limitations (also present in a normal block cipher like AES)
One limitation of Format Preserving Encryption is that it's deterministic: the same plaintext always leads to the same ciphertext. And by ...
- 145k
1
vote
Accepted
One way text→text function
Problem with the question's original solution is that the substitution table is the same at each index, and the better part of the key. It can thus be determined from examples. Problem with the "...
- 145k
1
vote
Accepted
Unbalanced numeric Feistel network implementation
Does the implementation follow accurately the described network generalization?
No. The Feistel network analyzed in the paper assumes independent round functions, but the code does not give that.
The ...
- 145k
1
vote
Want to generate numeric coupon codes?
I have an almost identical requirement for location identifiers I use in a custom inventory system. I have a 35-bit code, which is displayed as 7 5-bit elements, which need to be human readable and ...
- 13.2k
1
vote
Accepted
Format Preserving Encyption question
The questions you're getting confused by are, indeed, confusing, but I think I figured out what's going on. Imagine a scenario where:
A company want to issue exactly 10,000 numbered coupons;
They are ...
- 14.7k
1
vote
Format Preserving Encyption question
Not sure if I am correct about this, but let me give it my best.
I do get that encoding numbers from 0 to 9999 you get 10000 possible encodings, what I don't get is that how to you get 20 digit ...
- 23
Only top scored, non community-wiki answers of a minimum length are eligible