FF1
More info
- Creator
- Mihir Bellare, Phillip Rogaway, Terence Spies (FFX)
- Released
- 2016
- Type
- Format-preserving encryption mode
- Spec
- NIST SP 800-38G
NIST's standard method for encrypting a number or string so the result has the same length and alphabet as the input.
Under the hood it is an unbalanced ten-round Feistel network with an AES-based round function. The input is split into two halves over an arbitrary radix — ten digits, 26 letters, whatever the field holds — and each round adds AES output modulo that radix. A tweak of any length is mixed in, so the same card number encrypts differently in different tables.
FF1 descends from FFX, proposed by Bellare, Rogaway and Spies in 2010, and was standardised in SP 800-38G in 2016. Its weak spot is small domains: a four-digit field has only 10,000 possible values, at which point a lookup table goes a long way. The 2019 draft revision therefore demands at least a million possible inputs. Anyone planning to protect PIN codes this way has misunderstood something.