Showing papers on "Format-preserving encryption published in 2009"
04 Nov 2009
TL;DR: In this article, two flavors of unbalanced Feistel networks can be used for achieving FPE, and new security results for each of them are presented, showing that the timing information that may be divulged by cycle walking is not a damaging thing to leak.
Abstract: Format-preserving encryption (FPE) encrypts a plaintext of some specified format into a ciphertext of identical format--for example, encrypting a valid credit-card number into a valid credit-card number. The problem has been known for some time, but it has lacked a fully general and rigorous treatment. We provide one, starting off by formally defining FPE and security goals for it. We investigate the natural approach for achieving FPE on complex domains, the "rank-then-encipher" approach, and explore what it can and cannot do. We describe two flavors of unbalanced Feistel networks that can be used for achieving FPE, and we prove new security results for each. We revisit the cycle-walking approach for enciphering on a non-sparse subset of an encipherable domain, showing that the timing information that may be divulged by cycle walking is not a damaging thing to leak.
219 citations
Patent•
29 Apr 2009
TL;DR: In this article, the key requests in a data processing system may include identifiers such as user names, policy names, and application names, along with validity period information indicating when corresponding keys are valid.
Abstract: Key requests in a data processing system may include identifiers such as user names, policy names, and application names The identifiers may also include validity period information indicating when corresponding keys are valid When fulfilling a key request, a key server may use identifier information from the key request in determining which key access policies to apply and may use the identifier in determining whether an applicable policy has been satisfied When a key request is authorized, the key server may generate a key by applying a one-way function to a root secret and the identifier Validity period information for use by a decryption engine may be embedded in data items that include redundant information Application testing can be facilitated by populating a test database with data that has been encrypted using a format-preserving encryption algorithm Parts of a data string may be selectively encrypted based on their sensitivity
130 citations
Patent•
30 Oct 2009
TL;DR: In this article, a plaintext string may be converted to ciphertext by repeated application of a format-preserving encryption cryptographic algorithm, and the resulting version of the string was analyzed to determine whether desired string constraints have been satisfied.
Abstract: Format preserving encryption (FPE) cryptographic engines are provided for performing encryption and decryption on strings. A plaintext string may be converted to ciphertext by repeated application of a format preserving encryption cryptographic algorithm. Following each application of the format preserving cryptographic algorithm, the resulting version of the string may be analyzed to determine whether desired string constraints have been satisfied. If the string constraints have not been satisfied, further applications of the format preserving cryptographic algorithm may be performed. If the string constraints have been satisfied, the current version of the string may be used as an output for the cryptographic engine.
34 citations
Posted Content•
TL;DR: In this paper, the authors formally define FPE and security goals for it, and investigate the natural approach for achieving FPE on complex domains, the "rank-then-encipher" approach, and explore what it can and cannot do.
Abstract: Format-preserving encryption (FPE) encrypts a plaintext of some specified format into a ciphertext of identical format—for example, encrypting a valid credit-card number into a valid creditcard number. The problem has been known for some time, but it has lacked a fully general and rigorous treatment. We provide one, starting off by formally defining FPE and security goals for it. We investigate the natural approach for achieving FPE on complex domains, the “rank-then-encipher” approach, and explore what it can and cannot do. We describe two flavors of unbalanced Feistel networks that can be used for achieving FPE, and we prove new security results for each. We revisit the cycle-walking approach for enciphering on a non-sparse subset of an encipherable domain, showing that the timing information that may be divulged by cycle walking is not a damaging thing to leak.
16 citations