Crypto Operations

The CipherTrust Manager supports the following crypto operations:

Symmetric Encryption

Symmetric encryption uses AES, TDES, or AES-GCM (with or without authentication data).

A variety of modes and key sizes are supported. Operations can be chained to encrypt a stream of data, split over multiple requests.

Asymmetric Encryption

Asymmetric encryption uses RSA keys. A variety of paddings are supported.

Asymmetric Sign and Verify

MAC and MAC Verify

Format Preserving Encryption

Format–Preserving Encryption is a special type of encryption that keeps the output of the algorithm in the same format and length as the input. This can be important when the result is stored in a database that expects a certain format. A common use case is for Credit Card Numbers, zip codes, telephone numbers, names, addresses etc. 

Normally FPE algorithms limit the size of the data that can be encrypted to a number based on the size of the alphabet. Selecting the "alphabet" determines two things - how long your input can be - and what characters will be encrypted and which ones will be left in place.

The algorithm handles ASCII chars Ox20 through Ox7E. Apart from ASCII, other characters are supported through unicode character set.

The FPE implementation also supports inputs that are longer than the limits imposed above. However using the API this way is more complicated and additional parameters must be passed.

Unicode

The Unicode charset must be present on the server and its the size should be greater than 10 and less than 256 characters. The number of characters provided in the character set will be treated as cardinality for the input data.

This table provides the cardinality size and the corresponding IV/block-size for the FPE/AES/UNICODE usage. In FPE/AES/UNICODE, the cardinality and IV/block-size is defined in character length.