Cycle-walking FPE has a (nearly) unbounded upper-bound on latency. Breaking the 122 bits into two 61-bit halves and using AES as the round function for a Feist

Cycle-walking FPE has a (nearly) unbounded upper-bound on latency. Breaking the 122 bits into two 61-bit halves and using AES as the round function for a Feistel cipher gives you a constant 3-encryption latency instead of the expected 64-encryption average latency of the cycle-walking format preserving encryption. Alternatively, use AES in VIL mode ( https://cseweb.ucsd.edu/~mihir/papers/lpe.pdf https://cseweb.ucsd.edu/~mihir/papers/lpe.pdf ).