Format-Preserving Encryption
Format-preserving encryption (FPE) makes the ciphertext take the same format as the plaintext (e.g., an encrypted credit card number is still 16 digits), so database schemas need no change.
Purpose
It encrypts sensitive fields in legacy systems without altering field length, format, or validation rules, lowering migration cost.
Mechanism
The plaintext space (e.g., the 16-digit card-number domain) is treated as the integer set {0,...,N-1}, and the FF1/FF3 algorithms apply a NIST-approved pseudorandom permutation over that domain, keeping length and character set unchanged.
Use cases
- Credit card number encryption
- Social security number encryption
- Legacy system field encryption