Re: [Cfrg] Analysis of ipcrypt?

Have you looked at FFX?  That has much stronger claims than those for
ipcrypt and it doesn't suffer the problem DKG described with Russ'
simple scheme.  It's a fair bit more computationally expensive though
- it uses a Feistel network with a decent number of iterations, which
means that the PRF (typically AES) needs to be run more often than you
might think.

On Thu, Feb 22, 2018 at 1:03 PM, Paul Hoffman <paul.hoffman@icann.org> wrote:
> Greetings. ipcrypt is a format-preserving cipher for IPv4 addresses. It has a 32-bit blocksize for input and output, and 128-bit blocksize for the key. It was developed by Jean-Philippe Aumasson and is described at:
>    https://github.com/veorq/ipcrypt
> There doesn't appear to be any formal paper describing the algorithm, but the Python and Go code is trivial to follow.
>
> This algorithm is now being considered by a few different projects that want to obfuscate IPv4 addresses. Has anyone analyzed the algorithm? I could not find analyses, but certainly could have missed them.
>
> For a project I'm on, ipcrypt is attractive if an attacker cannot derive the 128-bit random key without a lot (maybe 2^80ish) effort. For cases in common use, assume that the attacker has 2^24 known plaintext/ciphertext pairs under a single 128-bit random key. For additional ciphertexts, how much effort must the attacker expend to get the key in order to decrypt additional unknown ciphertexts?
>
> (Note that there are other options for this use case, which have different positive and negative features. What we'd like to know is how good is ipcrypt if we chose it.)
>
> --Paul Hoffman
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>