Package: ubiq-security-fpe
Format Preserving Encryption in PythonAn implementation of the NIST-approved FF1 algorithm in Python.This implementation conforms (as best as possible) toDraft SP 800-38G Rev. 1. The implementation passes all tests
specified by NIST in their Cryptographic Standards and Guidelinesexamples for FF1DocumentationSee thePython API docs.InstallationUsing the package manager:You may want to make sure you are running the latest version of pip3 by
first executing$pip3install--upgradepipYou don't need this source code unless you want to modify the package. If you just want to use the package, install from PyPi using pip3, a package manager for Python3.$pip3install--upgradeubiq_security_fpeInstalling from source:From within the cloned git repository directory, Install from source with:$ cd ubiq-fpe-python
$ pip3 install -r requirements.txt
$ python3 setup.py installYou may need to run the python3 commands above using sudo.TestingTo run the tests:$python3-munittestubiq_security_fpe/*test.py-vRequirementsPython 3.5+About alphabets and the radix parameterThe interfaces operate on strings, and the radix parameter determines which
characters are valid within those strings, i.e. the alphabet. For example, if
your radix is 10, then the alphabet for your plain text consists of the
characters in the string "0123456789". If your radix is 16, then the
alphabet is the characters in the string "0123456789abcdef".More concretely, if you want to encrypt, say, a 16 digit number grouped into
4 groups of 4 using a-as a delimiter as in0123-4567-8901-2345, then you
would need a radix of at least 11, and you would need to translate the-character to ana(as that is the value that follows9) prior to the
encryption. Conversely, you would need to translate anato a-after
decryption.This mapping of user inputs to alphabets defined by the radix is not performed
by the library and must be done prior to calling the encrypt and after calling
the decrypt functions.A radix of up to 36 is supported, and the alphabet for a radix of 36 is
"0123456789abcdefghijklmnopqrstuvwxyz".TweaksTweaks are very much like Initialization Vectors (IVs) in "traditional"
encryption algorithms. For FF1, the minimun and maximum allowed lengths of
the tweak may be specified by the user, and any tweak length between those
values may be used.Plain/ciphertext input lengthsFor FF1, the minimum length is determined by the inequality:radixminlen>= 1000000or:minlen >= 6 / log10radixThus, the minimum length is determined by the radix and is automatically
calculated from it.For FF1, the maximum input length is232ExamplesTheunit test codeprovides the best
and simplest example of how to use the interfaces.FF1/**@keyisabytearraywhoselengthmustbe16,24,or32*@twkisanoptionalbytearraythatcanbeusedfortheFF1context*@twk_min_lenisaconstraintthatcanbeappliedforthetweakduring*theencryptordecryptcalls*@twk_max_lenisaconstraintthatcanbeappliedforthetweakduring*theencryptordecryptcalls*@radixistheradixforthetextstring*@alphaisthecharactersettousewhenperfomingtheFPEencryption*/ctx=ff1.Context(bytes(key),bytes(twk),twk_min_len,twk_max_len,radix,alpha)/**@ptistheplaintextstringwherethecharacterscorrespondtothe*alphacharactersetandtheradixvalue*@tweakisanoptionalbytearraythatwilloverridethetwkvalue*suppliedintheContextfunction.Ifsupplieditmustbeconstrainedto*thetwk_min_lenandtwk_max_lenvalues*/ct=ctx.Encrypt(pt,tweak)out=ctx.Decrypt(ct,tweak)