Format Preserving Encryption
The FPE algorithm allows the user to perform encryption on well formatted data without affecting its format post encryption. The algorithm supports:
- CARD10 cardinality for digits in range 0 - 9
- CARD62 cardinality for digits in range 0 - 9, lowercase alphabets (a-z), and uppercase alphabets (A-Z).
Important Notes
For CARD10, the alphabets and special characters, if present in the input data, are retained after encryption when
NONEis selected in the FPE Encryption Format field in local mode. For remote mode, encryption is not supported for such cases.CARD 62 is supported in local mode.
FPE formats are not supported for CARD62.
For CARD62, special characters are retained after encryption.
Input data should have minimum two characters.
Base encoding of "B 16" is not recommended to be used with FPE as the output is always in readable format for which there is no need to perform B16 encoding.
FPE Related Information
The following table provides details of fields that are required for FPE.
| Field | Description |
|---|---|
| Key | Non-versioned AES Keys. Versioned key is not supported. |
| Block Size | MAXb • For CARD10 MAXb = 56 bytes • For CARD62 MAXb = 32 bytes |
| Cardinality | • CARD19 • CARD62 |
| IV | FPE accepts a HEX encoded MAXb integer. IV is always provided but is used only if the length of data exceeds MAXb (block size: 56 bytes for CARD10 and 32 bytes for CARD62). FPE breaks long data into MAXb integer blocks and uses block chaining algorithm similar to CBC mode to perform encryption. — a 56 bytes IV in hex encoded form having a cardinality 10 when data size is > 56 bytes — A valid value of IV for FPE can be a 112 characters hex encoded s-integers (0-9) 0401030003040604090301030705020505030507040108080102020704020702010304070400090105020603000002020906070004010200— A valid value of IV can be a 64 characters hex encoded s-integers (0-9) 0401030003040604090301030705020505030507040108080102020704020702. |
| Key Size (in bits) | • 128 •192 •256 |
| Identifier Strings | •FPE/AES/CARD10 • FPE/AES/CARD62 |
| FPE Format | The formats that the user may use to determine the structure of the output. Following formats are supported for FPE: • NONE - No format is applied with FPE. In this case, complete plaintext will be considered as an input for crypto operation. • FIRST_SIX - This format allows the user to keep intact the first six digits of the plaintext input. So, after encryption the first six digits of the output ciphertext will remain same as input plaintext and rest digits will be encrypted using FPE. • FIRST_SIX_LAST_FOUR - This format allows the user to keep intact the first six and last four digits of the plaintext input. So, after encryption the first six and last four digits of the output ciphertext will remain same as input plaintext and rest digits will be encrypted using FPE. • FIRST_TWO_LAST_FOUR- This format allows the user to keep intact the first two and last four digits of the plaintext input. So, after encryption the first two and last four digits of the output ciphertext will remain same as input plaintext and rest digits will be encrypted using FPE. • LAST_FOUR- This format allows the user to keep intact the last four digits of the plaintext input. So, after encryption the last four digits of the output ciphertext will remain same as input plaintext and rest digits will be encrypted using FPE. Note: The effective data length (excluding special characters) of input plaintext to be encrypted must be greater that the selected format but less than 56. If the data length is less than the selected format, then no encryption is performed. If the data length is greater than 56 then error is returned. For example, for the FIRST_SIX format, if the input plaintext is 12345678@#, then encryption will be performed on 78 after retaining the first six characters and the special characters @#. Suppose the input plaintext was 12345@#, then the encryption will not be performed on this, as the effective data to be encrypted is less than six even though the input plaintext has seven characters. |
| Tweak Algorithm | Allow caller specify a hashing algorithm to be applied to specified tweak data beforehand. Valid values are: • NONE •SHA1 •SHA256 Note: If NONE is selected in the FPE Encryption Format field then NONE, SHA1, and SHA256 options are available for Tweak Algorithm. If any encryption format is selected then only SHA1 and SHA256 options are available. |
| Tweak Data | Tweak data uses the tweakable cipher concept to protect against statistical attacks due to potentially small input/output space. It accepts any ASCII value for SHA1 and SHA 256 and any valid hex encoded value for “NONE” like "1111111111111111". If, tweak data algorithm is “NONE”, the value must be HEX encoded string representing 64 bit long (hence, HEX encoding will consume 16 characters.). If tweak data algorithm represents a SHA1/SHA256 argument then the tweak data need not be hex encoded string but any ASCII string. Note: These values can be entered when NONE is selected in the FPE Encryption Format field. |
| Replacement Values | If a database user attempts to access encrypted data to which they do not have decryption permission, the system returns an error message. You can specify the content of those permission–related errors using the replacement values feature. Refer to Error Replacement for details. |
Supported Data Types
CDP for MSSQL supports FPE of the following data types.
| Data Type | Data Types |
|---|---|
| BIGINT | SMALLINT |
| TINYINT | INT |
| CHAR | NCHAR |
| VARCHAR | NVARCHAR |
