Format-Preserving Encryption (FPE) in ‘FIPS Approved’ Mode

June 17, 2016 •Mark Minnoch

The FIPS 140-2 Implementation Guidance (A.10) now includes vendor affirmation requirements for the format-preserving encryption schemes (FF1, FF3) specified in SP 800-38G.

As its name Vertical_Lock_Short

suggests, format-preserving encryption transforms plaintext to ciphertext of the same format and length. For example, format-preserving encryption may be used for a legacy application that needs to protect 16-digit credit card numbers and 9-digit social security numbers in a database without having to change their storage allocations. FPE has saved a lot of headaches in these use cases, as you can imagine.

For ‘FIPS Approved’ operation, until Cryptographic Algorithm Validation Program (CAVP) testing becomes available specifically for FPE, vendors will need to complete CAVP testing for the underlying AES algorithm, make documentation updates, and affirm compliance to SP 800-38G. Alternatively, SafeLogic can help you strategize and complete this process as easily as possible.

If you have a customer requirement to provide format-preserving encryption with FIPS 140-2 validation, then please contact us today.

Mark Minnoch

Mark Minnoch was a Technical Account Manager for SafeLogic.

CryptoComply• FIPS-approved• FF1• format-preserving encryption• Mark Minnoch• FF3• cryptographic module• CMVP• NIST 800-38• cryptography• CAVP• Industry News• FIPS 140• Mark• format-preserving• NIST• Advisories• RapidCert• testing• AES• Encryption• FPE• National Institute of Standards and Technology• Implementation Guidance

Back to posts

FIPS 140

Cybersecurity Compliance

Technology

The SafeLogic Blog

Format-Preserving Encryption (FPE) in ‘FIPS Approved’ Mode

Mark Minnoch

Popular Posts

Search for posts

Tags