Re: [Cfrg] Analysis of ipcrypt?

[Russ Housley <[e-mail]>]

DKG:
> 
> On Thu 2018-02-22 18:30:36 -0500, Russ Housley wrote:
>> 
>> It sounds like you want a simple and straightforward way to obfuscate IPv4 addresses.
>> 
>> AES is very widely implemented.  You can find libraries for every platform.  So, something like this may do it for you:
>> 
>> 	k = rand()  /* 128 bits; fresh key for each dataset */
>> 
>> 	for each ipv4addr in dataset:
>> 		plain = ipv4addr || ipv4addr || ipv4addr || ipv4addr
>> 		obfuscated_ipv4addr = trunc32(AES_128_Encrypt(k, plain))
> 
> This approach doesn't allow inverting the address if needed.  aiui, the
> use case for ipcrypt and other format-preserving encryption is attack
> detection and mitigation via anomaly detection, based on packet
> captures, but with phased destruction of the IP addresses.

Paul's description did not say that inversions was a requirement.  And, if you know the AES key, the work factor is _at_most_ 2^32 AES block operations.  That is within reach on my laptop.

The FF1 and FF3 solutions are fine solutions.  If the number of times that one has to remove the obfuscation is very low, then the lower encrypt cost of the above algorithm may be desirable.

Russ