Methods for IP Address Encryption and Obfuscation
draft-denis-ipcrypt-00
This document is an Internet-Draft (I-D).
Anyone may submit an I-D to the IETF.
This I-D is not endorsed by the IETF and has no formal standing in the
IETF standards process.
The information below is for an old version of the document.
| Document | Type |
This is an older version of an Internet-Draft whose latest revision state is "Active".
|
|
|---|---|---|---|
| Author | Frank Denis | ||
| Last updated | 2025-04-14 | ||
| RFC stream | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-denis-ipcrypt-00
Network Working Group F. Denis
Internet-Draft Fastly Inc.
Intended status: Informational April 2025
Expires: 16 October 2025
Methods for IP Address Encryption and Obfuscation
draft-denis-ipcrypt-00
Abstract
This document specifies methods for encrypting and obfuscating IP
addresses, providing both deterministic format-preserving and
non-deterministic constructions. These methods address privacy
concerns raised in [RFC6973] and [RFC7258] regarding pervasive
monitoring and data collection.
The methods apply uniformly to both IPv4 and IPv6 addresses by
converting them into a 16-byte representation. Two generic
constructions are defined—one using a 128-bit block cipher and the
other using a 128-bit tweakable block cipher—along with three
concrete instantiations:
* *ipcrypt-deterministic:* Deterministic encryption using AES128
(applied as a single-block operation).
* *ipcrypt-nd:* Non-deterministic encryption using the KIASU-BC
tweakable block cipher with an 8-byte tweak.
* *ipcrypt-ndx:* Non-deterministic encryption using the AES-XEX
tweakable block cipher with a 16-byte tweak.
Deterministic mode produces a 16-byte ciphertext (enabling format
preservation), while non-deterministic modes prepend a randomly
sampled tweak (which MUST be uniformly random when generated, as
specified in [RFC4086]) to produce larger ciphertexts that resist
correlation attacks.
Discussion Venues
This note is to be removed before publishing as an RFC.
Source for this draft and an issue tracker can be found at
https://github.com/jedisct1/draft-denis-ipcrypt.
Denis Expires 16 October 2025 [Page 1]
Internet-Draft ipcrypt April 2025
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 3 October 2025.
Copyright Notice
Copyright (c) 2025 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Use Cases and Motivations . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. IP Address Conversion . . . . . . . . . . . . . . . . . . . . 4
3.1. Converting to a 16-Byte Representation . . . . . . . . . 4
3.1.1. IPv6 Addresses . . . . . . . . . . . . . . . . . . . 4
3.1.2. IPv4 Addresses . . . . . . . . . . . . . . . . . . . 5
3.2. Converting from a 16-Byte Representation to an IP
Address . . . . . . . . . . . . . . . . . . . . . . . . . 5
4. Generic Constructions . . . . . . . . . . . . . . . . . . . . 5
5. Deterministic Encryption . . . . . . . . . . . . . . . . . . 6
5.1. Specific Instantiation: ipcrypt-deterministic . . . . . . 6
5.1.1. Operation Flow Diagram . . . . . . . . . . . . . . . 6
5.2. Format Preservation . . . . . . . . . . . . . . . . . . . 7
6. Non-Deterministic Encryption . . . . . . . . . . . . . . . . 7
Denis Expires 16 October 2025 [Page 2]
Internet-Draft ipcrypt April 2025
6.1. ipcrypt-nd (KIASU-BC) . . . . . . . . . . . . . . . . . . 8
6.1.1. Usage Considerations . . . . . . . . . . . . . . . . 8
6.2. ipcrypt-ndx (AES-XEX) . . . . . . . . . . . . . . . . . . 8
6.2.1. Usage Considerations . . . . . . . . . . . . . . . . 8
6.3. Comparison of Modes . . . . . . . . . . . . . . . . . . . 9
7. Security Considerations . . . . . . . . . . . . . . . . . . . 9
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 9
9.1. Normative References . . . . . . . . . . . . . . . . . . 9
9.2. Informative References . . . . . . . . . . . . . . . . . 10
Appendix A. Acknowledgments . . . . . . . . . . . . . . . . . . 11
Appendix B. Appendices . . . . . . . . . . . . . . . . . . . . . 11
B.1. Appendix A. Pseudocode and Examples . . . . . . . . . . 11
B.1.1. IPv4 Address Conversion . . . . . . . . . . . . . . . 11
B.1.2. IPv6 Address Conversion . . . . . . . . . . . . . . . 12
B.1.3. Conversion from a 16-Byte Array to an IP Address . . 12
B.1.4. Deterministic Encryption (ipcrypt-deterministic) . . 13
B.1.5. Non-Deterministic Encryption using KIASU-BC
(ipcrypt-nd) . . . . . . . . . . . . . . . . . . . . 13
B.1.6. Non-Deterministic Encryption using AES-XEX
(ipcrypt-ndx) . . . . . . . . . . . . . . . . . . . . 13
B.2. Appendix B. Diagrams . . . . . . . . . . . . . . . . . . 13
B.2.1. IPv4 Address Conversion Diagram . . . . . . . . . . . 14
B.2.2. Deterministic Encryption Flow . . . . . . . . . . . . 14
B.2.3. Non-Deterministic Encryption Flow (ipcrypt-nd) . . . 14
B.2.4. Non-Deterministic Encryption Flow (ipcrypt-ndx) . . . 15
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 15
1. Introduction
This document specifies a standard for the encryption and obfuscation
of IP addresses for both operational use and privacy preservation.
The objective is to enable network operators, researchers, and
privacy advocates to share or analyze data while protecting sensitive
address information, addressing concerns raised in [RFC7624]
regarding confidentiality in the face of pervasive surveillance.
1.1. Use Cases and Motivations
The main motivations include:
* *Privacy Protection:* Encrypting IP addresses prevents the
disclosure of user-specific information when data is logged or
measured, as discussed in [RFC6973].
* *Format Preservation:* Ensuring that the encrypted output remains
a valid IP address allows network devices to process the data
without modification.
Denis Expires 16 October 2025 [Page 3]
Internet-Draft ipcrypt April 2025
* *Mitigation of Correlation Attacks:* Deterministic encryption
reveals repeated inputs; non-deterministic modes use a random
tweak to obscure linkability while keeping the underlying input
confidential.
2. Terminology
The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”,
“SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “NOT RECOMMENDED”, “MAY”, and
“OPTIONAL” in this document are to be interpreted as described in BCP
14 [RFC8174] when, and only when, they appear in all capitals, as
shown here.
Throughout this document, the following terms and conventions apply:
* *IP Address:* An IPv4 or IPv6 address as defined in [RFC4291].
* *16-Byte Representation:* A fixed-length representation used for
both IPv4 (via IPv4-mapped IPv6) and IPv6 addresses.
* *Tweak:* A non-secret, additional input to a tweakable block
cipher that further randomizes the output.
* *Deterministic Encryption:* Encryption that always produces the
same ciphertext for a given input and key.
* *Non-Deterministic Encryption:* Encryption that produces different
ciphertexts for the same input due to the inclusion of a randomly
sampled tweak.
* *(Input, Tweak) Collision:* A scenario where the same input is
encrypted with the same tweak; this reveals that the input was
repeated but not the input’s value.
3. IP Address Conversion
This section describes the conversion of IP addresses to and from a
16-byte representation. This conversion is necessary to operate a
128-bit cipher on both IPv4 and IPv6 addresses.
3.1. Converting to a 16-Byte Representation
3.1.1. IPv6 Addresses
IPv6 addresses are natively 128 bits and are converted directly using
network-byte order (big-endian) as specified in [RFC4291].
_Example:_
Denis Expires 16 October 2025 [Page 4]
Internet-Draft ipcrypt April 2025
IPv6 Address: 2001:0db8:85a3:0000:0000:8a2e:0370:7334
16-Byte Representation: [20 01 0d b8 85 a3 00 00 00 00 8a 2e 03 70 73 34]
3.1.2. IPv4 Addresses
IPv4 addresses (32 bits) are mapped using the IPv4-mapped IPv6
format:
IPv4 Address: 192.0.2.1
16-Byte Representation: [00 00 00 00 00 00 00 00 00 00 FF FF C0 00 02 01]
3.2. Converting from a 16-Byte Representation to an IP Address
The conversion algorithm is as follows:
1. Examine the first 12 bytes of the 16-byte representation
2. If they match the IPv4-mapped prefix (10 bytes of 0x00 followed
by 0xFF, 0xFF):
* Interpret the last 4 bytes as an IPv4 address in
dotted-decimal notation
3. Otherwise:
* Interpret the 16 bytes as an IPv6 address in colon-hexadecimal
notation
(For additional illustration, see Appendix B.)
4. Generic Constructions
This specification defines two generic cryptographic constructions:
1. *128-bit Block Cipher Construction:*
* Used in deterministic encryption
* Operates on a single 16-byte block
* Example: AES-128 treated as a permutation
2. *128-bit Tweakable Block Cipher (TBC) Construction:*
* Used in non-deterministic encryption
* Accepts a key, a tweak, and a message
Denis Expires 16 October 2025 [Page 5]
Internet-Draft ipcrypt April 2025
* The tweak is typically randomly sampled (and MUST be uniformly
random when generated)
* Reuse of the same tweak on different inputs does not
compromise confidentiality
Valid options for implementing a tweakable block cipher include, but
are not limited to:
* *SKINNY*
* *DEOXYS-BC*
* *KIASU-BC*
* *AES-XEX*
Implementers MUST choose a cipher that meets the required security
properties and provides robust resistance against related-tweak and
other cryptographic attacks.
5. Deterministic Encryption
Deterministic encryption applies a 128-bit block cipher directly to
the 16-byte representation of an IP address.
5.1. Specific Instantiation: ipcrypt-deterministic
This instantiation employs AES128 in a single-block operation. Since
AES128 is a permutation, every distinct 16-byte input maps to a
unique 16-byte ciphertext, preserving the IP address format.
5.1.1. Operation Flow Diagram
Denis Expires 16 October 2025 [Page 6]
Internet-Draft ipcrypt April 2025
+---------------------+
| IP Address |
| (IPv4 or IPv6) |
+---------------------+
|
v
+---------------------+
| Convert to 16 Bytes |
+---------------------+
|
v
+---------------------+
| AES128 Encrypt |
| (Single Block) |
+---------------------+
|
v
+---------------------+
| 16-Byte Output |
+---------------------+
|
v
+---------------------+
| Convert to IP Format|
+---------------------+
5.2. Format Preservation
* If the 16-byte ciphertext begins with an IPv4-mapped prefix, it
*MUST* be rendered as a dotted-decimal IPv4 address.
* Otherwise, it is interpreted as an IPv6 address.
*Note:* To ensure IPv4 format preservation, implementers *MUST*
consider using cycle-walking or an FPE mode if required.
6. Non-Deterministic Encryption
Non-deterministic encryption leverages a tweakable block cipher
together with a random tweak.
Although the tweak is generated uniformly at random (and thus may
occasionally collide per birthday bounds), such collisions are benign
when they occur with different inputs. An (input, tweak) collision
reveals that the same input was encrypted with the same tweak but
does not disclose the input’s value.
Denis Expires 16 October 2025 [Page 7]
Internet-Draft ipcrypt April 2025
The usage limits discussed below apply per cryptographic key;
rotating keys can extend secure usage beyond these bounds.
This document defines two instantiations:
* *ipcrypt-nd:* Uses the KIASU-BC tweakable block cipher with an
8-byte (64-bit) tweak. See [KIASU-BC] for details.
* *ipcrypt-ndx:* Uses the AES-XEX tweakable block cipher with a
16-byte (128-bit) tweak. See [XTS-AES] for background.
In both cases, if a tweak is generated randomly, it *MUST be
uniformly random*. Reusing the same randomly generated tweak on
different inputs is acceptable from a confidentiality standpoint.
6.1. ipcrypt-nd (KIASU-BC)
* *Tweak:* 8 bytes (64 bits).
* *Output:* 24 bytes total (8-byte tweak concatenated with a 16-byte
ciphertext).
6.1.1. Usage Considerations
Random sampling of an 8-byte tweak yields an expected collision for a
specific tweak value after about 2^(64/2) = 2^32 operations.
If an (input, tweak) collision occurs, it indicates that the same
input was processed with that tweak without revealing the input’s
value. These collision bounds apply per cryptographic key; by
rotating keys regularly, secure usage can be extended well beyond
these bounds.
Ultimately, the effective security is determined by the underlying
block cipher’s strength (≈2^128 for AES-128).
6.2. ipcrypt-ndx (AES-XEX)
* *Tweak:* 16 bytes (128 bits).
* *Output:* 32 bytes total (16-byte tweak concatenated with a
16-byte ciphertext).
6.2.1. Usage Considerations
Independent sampling of a 16-byte tweak results in an expected
collision after about 2^(128/2) = 2^64 operations.
Denis Expires 16 October 2025 [Page 8]
Internet-Draft ipcrypt April 2025
As with ipcrypt-nd, an (input, tweak) collision reveals repetition
without compromising the input value.
These limits are per key; regular key rotation further extends secure
usage. The effective security is governed by the strength of AES-128
(approximately 2^128 operations).
6.3. Comparison of Modes
* *Deterministic (ipcrypt-deterministic):* Produces a 16-byte
output; preserves format but reveals repeated inputs.
* *Non-Deterministic:*
- *ipcrypt-nd (KIASU-BC):* Produces a 24-byte output using an
8-byte tweak; (input, tweak) collisions reveal repeated inputs
(with the same tweak) but not their values.
- *ipcrypt-ndx (AES-XEX):* Produces a 32-byte output using a
16-byte tweak; supports higher secure operation counts per key.
7. Security Considerations
* *Deterministic Mode:* AES-128’s permutation behavior ensures
distinct inputs yield distinct outputs; however, repeated inputs
result in identical ciphertexts, thereby revealing repetition.
* *Non-Deterministic Mode:* The inclusion of a random tweak ensures
that encrypting the same input generally produces different
outputs.
In cases where an (input, tweak) collision occurs, an attacker
learns only that the same input was processed with that tweak, not
the value of the input itself. Security is determined by the
underlying block cipher (≈2^128 for AES-128) on a per-key basis.
Key rotation is recommended to extend secure usage beyond the per-
key collision bounds.
8. IANA Considerations
This document does not require any IANA actions.
9. References
9.1. Normative References
Denis Expires 16 October 2025 [Page 9]
Internet-Draft ipcrypt April 2025
[FIPS-197] NIST, "Advanced Encryption Standard (AES)", FIPS PUB 197,
26 November 2001, <https://nvlpubs.nist.gov/nistpubs/FIPS/
NIST.FIPS.197.pdf>.
[NIST-SP-800-38G]
NIST, "Recommendation for Block Cipher Modes of Operation:
Methods for Format-Preserving Encryption", NIST SP
800-38G, March 2016,
<https://nvlpubs.nist.gov/nistpubs/SpecialPublications/
NIST.SP.800-38G.pdf>.
[RFC4086] Eastlake 3rd, D., Schiller, J., and S. Crocker,
"Randomness Requirements for Security", BCP 106, RFC 4086,
DOI 10.17487/RFC4086, June 2005,
<https://www.rfc-editor.org/rfc/rfc4086>.
[RFC4291] Hinden, R. and S. Deering, "IP Version 6 Addressing
Architecture", RFC 4291, DOI 10.17487/RFC4291, February
2006, <https://www.rfc-editor.org/rfc/rfc4291>.
[RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J.,
Morris, J., Hansen, M., and R. Smith, "Privacy
Considerations for Internet Protocols", RFC 6973,
DOI 10.17487/RFC6973, July 2013,
<https://www.rfc-editor.org/rfc/rfc6973>.
[RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an
Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May
2014, <https://www.rfc-editor.org/rfc/rfc7258>.
[RFC7624] Barnes, R., Schneier, B., Jennings, C., Hardie, T.,
Trammell, B., Huitema, C., and D. Borkmann,
"Confidentiality in the Face of Pervasive Surveillance: A
Threat Model and Problem Statement", RFC 7624,
DOI 10.17487/RFC7624, August 2015,
<https://www.rfc-editor.org/rfc/rfc7624>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.
9.2. Informative References
[BRW2005] Bellare, M., Rogaway, P., and D. Wagner, "Format-
Preserving Encryption", CRYPTO 2005, 2005,
<https://www.cs.ucdavis.edu/~rogaway/papers/subset.pdf>.
Denis Expires 16 October 2025 [Page 10]
Internet-Draft ipcrypt April 2025
[IEEE-P1619]
IEEE, "IEEE Standard for Cryptographic Protection of Data
on Block-Oriented Storage Devices", IEEE 1619-2007, 18
December 2007,
<https://standards.ieee.org/ieee/1619/2041/>.
[IPCrypt2] Denis, F., "ipcrypt2: IP address encryption/obfuscation
tool", 2025, <https://github.com/jedisct1/ipcrypt2>.
[KIASU-BC] Jean, J., Nikolić, I., and T. Peyrin, "Tweaks and Keys for
Block Ciphers: the TWEAKEY Framework", Cryptology ePrint
Archive Paper 2014/831, 2014,
<https://eprint.iacr.org/2014/831>.
[LRW2002] Liskov, M., Rivest, R., and D. Wagner, "Tweakable Block
Ciphers", Fast Software Encryption 2002, 2002,
<https://www.cs.berkeley.edu/~daw/papers/tweak-
crypto02.pdf>.
[XTS-AES] Black, J., Dawson, E., Gueron, S., and P. Rogaway, "The
XTS-AES Mode for Disk Encryption", IEEE 1619-2007, 2010,
<https://web.cs.ucdavis.edu/~rogaway/papers/xts.pdf>.
Appendix A. Acknowledgments
The author gratefully acknowledges the contributions and insightful
comments from members of the IETF independent stream community and
the broader cryptographic community that have helped shape this
specification.
Appendix B. Appendices
B.1. Appendix A. Pseudocode and Examples
This appendix provides detailed pseudocode for key operations
described in this document.
B.1.1. IPv4 Address Conversion
Denis Expires 16 October 2025 [Page 11]
Internet-Draft ipcrypt April 2025
function IPv4To16Bytes(ipv4_address):
// Split the IPv4 address into its octets
parts = ipv4_address.split(".")
if length(parts) != 4:
raise Error("Invalid IPv4 address")
// Create a 16-byte array with the IPv4-mapped prefix
bytes16 = [0x00] * 10 // 10 bytes of 0x00
bytes16.append(0xFF) // 11th byte: 0xFF
bytes16.append(0xFF) // 12th byte: 0xFF
// Append each octet (converted to an 8-bit integer)
for part in parts:
bytes16.append(int(part) & 0xFF)
return bytes16
_Example:_ For "192.0.2.1", the function returns
[00, 00, 00, 00, 00, 00, 00, 00, 00, 00, FF, FF, C0, 00, 02, 01]
B.1.2. IPv6 Address Conversion
function IPv6To16Bytes(ipv6_address):
// Parse the IPv6 address into eight 16-bit words.
words = parseIPv6(ipv6_address) // Expands shorthand notation and returns 8 words
bytes16 = []
for word in words:
high_byte = (word >> 8) & 0xFF
low_byte = word & 0xFF
bytes16.append(high_byte)
bytes16.append(low_byte)
return bytes16
_Example:_ For "2001:0db8:85a3:0000:0000:8a2e:0370:7334", the output
is the corresponding 16-byte sequence.
B.1.3. Conversion from a 16-Byte Array to an IP Address
Denis Expires 16 October 2025 [Page 12]
Internet-Draft ipcrypt April 2025
function Bytes16ToIP(bytes16):
if length(bytes16) != 16:
raise Error("Invalid byte array")
// Check for the IPv4-mapped prefix
if bytes16[0:10] == [0x00]*10 and bytes16[10] == 0xFF and bytes16[11] == 0xFF:
ipv4_parts = []
for i from 12 to 15:
ipv4_parts.append(str(bytes16[i]))
ipv4_address = join(ipv4_parts, ".")
return ipv4_address
else:
words = []
for i from 0 to 15 step 2:
word = (bytes16[i] << 8) | bytes16[i+1]
words.append(format(word, "x"))
ipv6_address = join(words, ":")
return ipv6_address
B.1.4. Deterministic Encryption (ipcrypt-deterministic)
function ipcrypt_deterministic(ip_address, key):
bytes16 = convertTo16Bytes(ip_address)
ciphertext = AES128_encrypt(key, bytes16)
encrypted_ip = Bytes16ToIP(ciphertext)
return encrypted_ip
B.1.5. Non-Deterministic Encryption using KIASU-BC (ipcrypt-nd)
function ipcrypt_nd(ip_address, key):
bytes16 = convertTo16Bytes(ip_address)
// Generate an 8-byte random tweak (MUST be uniformly random)
tweak = random_bytes(8)
ciphertext = KIASU_BC_encrypt(key, tweak, bytes16)
result = concatenate(tweak, ciphertext) // 8 bytes || 16 bytes = 24 bytes total
return result
B.1.6. Non-Deterministic Encryption using AES-XEX (ipcrypt-ndx)
function ipcrypt_ndx(ip_address, key):
bytes16 = convertTo16Bytes(ip_address)
// Generate a 16-byte random tweak (MUST be uniformly random)
tweak = random_bytes(16)
ciphertext = AES_XEX_encrypt(key, tweak, bytes16)
result = concatenate(tweak, ciphertext) // 16 bytes || 16 bytes = 32 bytes total
return result
B.2. Appendix B. Diagrams
Denis Expires 16 October 2025 [Page 13]
Internet-Draft ipcrypt April 2025
B.2.1. IPv4 Address Conversion Diagram
IPv4: 192.0.2.1
|
v
Octets: C0 00 02 01
|
v
16-Byte Array:
[00 00 00 00 00 00 00 00 00 00 | FF FF | C0 00 02 01]
B.2.2. Deterministic Encryption Flow
IP Address
|
v
[Convert to 16 Bytes]
|
v
[AES128 Single-Block Encrypt]
|
v
16-Byte Ciphertext
|
v
[Convert to IP Format]
|
v
Encrypted IP Address
B.2.3. Non-Deterministic Encryption Flow (ipcrypt-nd)
Denis Expires 16 October 2025 [Page 14]
Internet-Draft ipcrypt April 2025
IP Address
|
v
[Convert to 16 Bytes] ---> 16-Byte Representation
|
v
[Generate Random 8-Byte Tweak]
|
v
[KIASU-BC Tweakable Encrypt]
|
v
16-Byte Ciphertext
|
v
[Concatenate Tweak || Ciphertext]
|
v
24-Byte Output (`ipcrypt-nd`)
B.2.4. Non-Deterministic Encryption Flow (ipcrypt-ndx)
IP Address
|
v
[Convert to 16 Bytes] ---> 16-Byte Representation
|
v
[Generate Random 16-Byte Tweak]
|
v
[AES-XEX Tweakable Encrypt]
|
v
16-Byte Ciphertext
|
v
[Concatenate Tweak || Ciphertext]
|
v
32-Byte Output (`ipcrypt-ndx`)
Author's Address
Frank Denis
Fastly Inc.
Email: fde@00f.net
Denis Expires 16 October 2025 [Page 15]