4 ms·

Yep we use that to e.g. construct stream ciphers for structure-preserving pseudonymization. Security proof is quite simple as well if you can assume the hash fu

Yep we use that to e.g. construct stream ciphers for structure-preserving pseudonymization. Security proof is quite simple as well if you can assume the hash function is secure. No one would use this for encryption though as it's quite slow compared to a modern stream cipher. We use it because there's (to my knowledge) no standardized stream cipher that provides output feedback mode (OFB) out-of-the-box.

ignoramous 5y ago
> ...structure-preserving pseudonymization Can you write about this a bit more, please (what does it mean)? Is it comparable to Tokenization (typically used to hide sensitive-date like credit card details, for example) [0], or to Homomorphic encryption [1]? [0] https://en.wikipedia.org/wiki/Tokenization_(data_security) https://en.wikipedia.org/wiki/Tokenization_(data_security) [1] https://people.csail.mit.edu/vinodv/FHE/FHE-refs.html https://people.csail.mit.edu/vinodv/FHE/FHE-refs.html
- ThePhysicist 5y ago
  Tokenization typically means that a third party keeps an association table, though it is possible to generate tokens cryptographically. Homomorphic encryption is something different again, though you could call this structure-preserving pseudonymization homomorphic as it preserves certain structural properties of the input data. It does not provide the same security guarantees as FHE though as the structure preservation weakens the encryption. For pseudonymization this is a tradeoff that can be worthwhile though.
tptacek 5y ago
Pretty much everybody uses this for encryption; the most popular stream cipher (qua stream cipher) in the world is Salsa20/ChaCha20, which is simply a keyed hash function run in counter mode.
0xdeadb00f 5y ago
> (to my knowledge) no standardized stream cipher that provides output feedback mode (OFB) out-of-the-box. I wasn't aware stream ciphers typically had different modes of operation like block ciphers did. Could you expand on this? I'm kind of interested.
- ThePhysicist 5y ago
  OFB means you feed the output of the cipher back to the input. Hence if you have two character sequences that share a prefix e.g. "abc123" and "abcxyz" the first three cipher stream bits will be identical and then deviate based on the feedback the cipher gets (assuming no IV and identical key). This is interesting for pseudonymization when you want to e.g. create cryptographically secure pseudonyms that preserve prefixes (think IP address pseudonyms that preserve subnet groupings).

ignoramous 5y ago

> ...structure-preserving pseudonymization Can you write about this a bit more, please (what does it mean)? Is it comparable to Tokenization (typically used to hide sensitive-date like credit card details, for example) [0], or to Homomorphic encryption [1]? [0] https://en.wikipedia.org/wiki/Tokenization_(data_security) https://en.wikipedia.org/wiki/Tokenization_(data_security) [1] https://people.csail.mit.edu/vinodv/FHE/FHE-refs.html https://people.csail.mit.edu/vinodv/FHE/FHE-refs.html

ThePhysicist 5y ago
Tokenization typically means that a third party keeps an association table, though it is possible to generate tokens cryptographically. Homomorphic encryption is something different again, though you could call this structure-preserving pseudonymization homomorphic as it preserves certain structural properties of the input data. It does not provide the same security guarantees as FHE though as the structure preservation weakens the encryption. For pseudonymization this is a tradeoff that can be worthwhile though.

tptacek 5y ago

Pretty much everybody uses this for encryption; the most popular stream cipher (qua stream cipher) in the world is Salsa20/ChaCha20, which is simply a keyed hash function run in counter mode.

0xdeadb00f 5y ago

> (to my knowledge) no standardized stream cipher that provides output feedback mode (OFB) out-of-the-box. I wasn't aware stream ciphers typically had different modes of operation like block ciphers did. Could you expand on this? I'm kind of interested.

ThePhysicist 5y ago
OFB means you feed the output of the cipher back to the input. Hence if you have two character sequences that share a prefix e.g. "abc123" and "abcxyz" the first three cipher stream bits will be identical and then deviate based on the feedback the cipher gets (assuming no IV and identical key). This is interesting for pseudonymization when you want to e.g. create cryptographically secure pseudonyms that preserve prefixes (think IP address pseudonyms that preserve subnet groupings).