Abstract
In this paper we propose a tokenization algorithm of Reversible Hybrid type, as defined in PCI DSS guidelines for designing a tokenization solution, based on a block cipher with a secret key and (possibly public) additional input. We provide some formal proofs of security for it, which imply our algorithm satisfies the most significant security requirements described in PCI DSS tokenization guidelines. Finally, we give an instantiation with concrete cryptographic primitives and fixed length of the PAN, and we analyze its efficiency and security.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
References
Bellare, M., Ristenpart, T., Rogaway, P., Stegers, T.: Format-preserving encryption. In: Jacobson, M.J., Rijmen, V., Safavi-Naini, R. (eds.) Selected Areas in Cryptography–SAC 2009. Lecture Notes in Computer Science, vol. 5867, pp. 295–312. Springer, Heidelberg (2009)
Bellare, M., Rogaway, P., Spies, T.: The FFX mode of operation for format-preserving encryption (Draft 1.1). Manuscript (standards proposal) submitted to NIST (2010)
Black, J., Rogaway, P.: Ciphers with Arbitrary Finite Domains, pp. 114–130. Springer, New York (2002)
Brier, E., Peyrin, T., Stern, J.: BPS: a Format-Preserving Encryption proposal. Manuscript (standards proposal) submitted to NIST (2010)
Díaz-Santiago, S., Rodríguez-Henríquez, L.M., Chakraborty, D.: A cryptographic study of tokenization systems. Int. J. Inf. Secur. 15(4), 413–432 (2016)
EMVCo: Payment Tokenisation Specification—Technical Framework, Version 1.0. Technical Report (2014)
Hoang, V.T., Morris, B., Rogaway, P.: An enciphering scheme based on a card shuffle. In: Safavi-Naini, R., Canetti, R. (eds.) Advances in Cryptology–CRYPTO 2012. Lecture Notes in Computer Science, vol. 7414, pp. 1–13. Springer, Heidelberg (2012)
Liskov, M., Rivest, R.L., Wagner, D.: Tweakable block ciphers. J. Cryptol. 24(3), 588–613 (2011)
Morris, B., Rogaway, P., Stegers, T.: How to encipher messages on a small domain. In: Halevi, S. (ed.) Advances in Cryptology–CRYPTO 2009. Lecture Notes in Computer Science, vol. 5677, pp. 286–302. Springer, Heidelberg (2009)
NIST: Secure Hash Standard (SHS). FIPS Publication, Information Technology Laboratory National Institute of Standards and Technology, Gaithersburg, MD, pp. 180-4 (2015)
Rukhin, A., et al.: A Statistical Test Suite for the Validation of Random and Pseudo Random Number Generators for Cryptographic Applications. NIST Special Publication, Information Technology Laboratory National Institute of Standards and Technology, Gaithersburg, MD (2010)
SSC, P.: Information Supplement: PCI DSS Tokenization Guidelines, Version 2.0. Technical Report (2011)
SSC, P.: Tokenization Product Security Guidelines—Irreversible and Reversible Tokens, Version 1.0. Technical Report (2015)
SSC, P.: PCI DSS Requirements and Security Assessment Procedures, Version 3.2. Technical Report (2016)
Stefanov, E., Shi, E.: FastPRP: Fast Pseudo-Random Permutations for Small Domains. IACR Cryptology ePrint Archive, Report 2012/254 (2012), http://eprint.iacr.org/
Acknowledgements
The authors are indebted to several people for their suggestions: Sandra Díaz, Patrick Harasser, Alessandro Tomasi and the anonymous referee.
Author information
Authors and Affiliations
Corresponding author
Rights and permissions
About this article
Cite this article
Aragona, R., Longo, R. & Sala, M. Several proofs of security for a tokenization algorithm. AAECC 28, 425–436 (2017). https://doi.org/10.1007/s00200-017-0313-3
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s00200-017-0313-3