Thanks for this! I'm using your library atm to protect some testing data and it works great. But how can I generate an ff3-1 key and tweak for usage with aes256 block cipher please?

As I explained in #17, the approach with withCustomAlphabet seems flawed to me. It prevents implementation of the full specification with radix up to 65536.

Please see test_why_withCustomAlphabet_is_broken() in comparison with test_german(). Do you see how to get this test to pass?

Having a broad range of environment-specific stuff is good in my experience. That allows contributors to use whatever tools they want without going through the mess we saw with the .idea/ files. If the Python package is set up properly, the .gitignore won't be included in the PyPI distribution.

In the end, it won't prevent you from git adding files. It just prevents git from suggesting irrelevant files to add.

I read over @PuspenduBanerjee's .gitignore and it looks perfectly good to me. I'd recommend restoring it. Or at the very least find a standard Python-oriented .gitignore from somewhere.

Hi @bschoening, I've been slammed the past few weeks so I didn't get a chance to respond to https://github.com/mysto/python-fpe/pull/11#issuecomment-926608199 until now.

That issue was caused by not having python-fpe properly installed as a Python package. (The way Python handles packages is a total mess...) In short, Python imports work for both files and modules with the same syntax. The command from ff3 import ff3 has two possible meanings:

1. From the ff3 package import the ff3 module.
2. From the ff3 subdirectory of the current directory, import ff3.py.

Option 2 is bad because it depends on the path where the command is being executed. Thus it's better to install everything as a package with pip so that 1. makes sense and your commands work regardless of the path.

I updated the README accordingly. An added benefit is that setuptools will automatically install pycryptodome as needed. There's no need for a separate pip install command.

I then restored my test. My test was however broken due to radixMap. I removed radixMap because it behaves differently from what I expect. I would expect radix=26 to correspond to the character set [0-9a-p]. If you want [a-z] I think it would make more sense to implement an alphabet string parameter. You could then:

1. Check that there are no duplicates (len(set(alphabet)) == len(alphabet))
2. Check that all the characters in the input message occur in the alphabet
3. Convert the input message to and from an integer based on the alphabet instead of base_conv_r() and Python's int(n, radix) function

As a bonus, base-62 would be trivial. (alphabet=string.digits + string.ascii_lowercase + string.ascii_uppercase)

I started using the FF3-1 implementation recently and its super cool. However I was approached if FF1 would also be an option. I was told its "better" as in "more secure" than FF3-1.

I dont know if that is true, but I certainly know that I can not implement FF1 in Python now.

Would it be something to consider to also add FF1 support please?

I just wanted to let you know that I have used some of your test vectors to verify my C-implementation of the FPE algorithms. Of course I have mentioned the source and credit. Please feel free to check out the testvectors folder of this repository and inform me of any issues.

Cheers

In my branch, all of these cases worked correctly with my validate_radix_and_alphabet() function:

def validate_radix_and_alphabet(radix, alphabet):
    """Validate and compute radix and alphabet given one or the other.

    If only radix is given, use the default alphabet up to that many characters.
    If only alphabet is given, compute the radix as the length of the alphabet.
    If both are given, verify consistency.

    Arguments:
    - `radix`: The length of the alphabet
    - `alphabet`: A string containing successive characters to be used as digits

    Returns:
    - `radix`, `alphabet`: A validated tuple containing both the radix and alphabet
    """

    if not isinstance(radix, (NoneType, int)):
        raise ValueError(f"radix must be an integer.")

    if radix is not None and radix < 2:
        raise ValueError("radix must be at least 2.")

    if not isinstance(alphabet, (NoneType, str)):
        raise ValueError(f"alphabet must be an string.")

    if alphabet is not None and len(alphabet) < 2:
        raise ValueError(f"alphabet must contain at least two characters.")

    if radix is not None and alphabet is not None:
        # Verify consistency
        if len(alphabet) != radix:
            raise ValueError(
                f"The alphabet has length {len(alphabet)} which conflicts with "
                f"the given value of {radix} for radix."
            )

    if alphabet is None:
        if radix is None:
            radix = 10
        # Use characters from the default alphabet.
        if radix > len(STANDARD_ALPHABET):
            raise ValueError(
                f"For radix >{len(STANDARD_ALPHABET)} "
                f"please specify a custom alphabet."
            )
        alphabet = STANDARD_ALPHABET[:radix]
    # alphabet is now defined. The radix might not be.

    if len(alphabet) != len(set(alphabet)):
        raise ValueError("The specified alphabet has duplicate characters.")

    if radix is None:
        radix = len(alphabet)
    # radix is now defined.

    if radix > RADIX_MAX:
        raise ValueError(
            f"The current radix {radix} exceeds the maximum allowed radix of "
            f"{RADIX_MAX} in the FF3-1 specification."
        )

    return radix, alphabet

The current release on PyPI is from Mar 17. It may be worth considering a workflow for automatically publishing tagged releases to PyPI, for example:

https://packaging.python.org/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/

The setup.py file which appears on PyPI does not appear in this repository.

You may want to set up a CI workflow which publishes tagged commits to PyPI automatically, and for that you'd need to include the setup.py.

Hi There,

I'm running this on Python 3.9.2 and I'm getting the package ff-3.py

\lib\site-packages\ff3\ff3.py", line 90, in init self.aesBlock = AES.AESCipher(reverse_string(self.key))

Code from ff-3.py line 90

aes.NewCipher automatically returns the correct block based on the length of the key

    # Always use the reversed key since Encrypt and Decrypt call ciph expecting that

    self.aesBlock = AES.AESCipher(reverse_string(self.key))

I've imported the package crypto. cipher but I couldn't find the AESCipher but it seems to be under crypto, let me know what do you think?

Good point with https://github.com/mysto/python-fpe/pull/21#pullrequestreview-781518568

Does this make it more understandable? I renamed working_digits → plaintext_len and eliminated n in favor of len(plaintexts_as_ints).