Three Third Generation Attacks on the Format Preserving Encryption Scheme FF3

Format-Preserving Encryption (FPE) schemes accept plaintexts from any finite set of values (such as social security numbers or birth dates) and produce ciphertexts that belong to the same set. They are extremely useful in practice since they make it possible to encrypt existing databases or communication packets without changing their format. Due to industry demand, NIST had standardized in 2016 two such encryption schemes called FF1 and FF3. They immediately attracted considerable cryptanalytic attention with decreasing attack complexities. The best currently known attack on the Feistel construction FF3 has data and memory complexity of O(N) and time complexity of O(N), where the input belongs to a domain of size N ×N . In this paper, we present and experimentally verify three improved attacks on FF3. Our best attack achieves the tradeoff curve D = M = Õ(N2−t), T = Õ(N) for all t ≤ 0.5. In particular, we can reduce the data and memory complexities to the more practical Õ(N), and at the same time, reduce the time complexity to Õ(N). We also identify another attack vector against FPE schemes, the relateddomain attack. We show how one can mount powerful attacks when the adversary is given access to the encryption under the same key in different domains, and show how to apply it to efficiently distinguish FF3 and FF3-1 instances. ? The first author is supported in part by Len Blavatnik and the Blavatnik Family foundation and by the Blavatnik ICRC. ?? The second author was supported in part by the Center for Cyber, Law, and Policy in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office and by the Israeli Science Foundation through grants No. 880/18 and 3380/19. ? ? ? The third author was supported by the European Research Council under the ERC starting grant agreement n. 757731 (LightCrypt) and by the BIU Center for Research in Applied Cryptography and Cyber Security in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office. † The fourth author is a member of CPIIS.