Protegrity Format Preserving Encryption

The Protegrity Format Preserving Encryption (FPE) encrypts input data of a specified format and generates output data, ciphertext, of the same format.

In the Protegrity’s Format Preserving Encryption (FPE), input data is encrypted using a block cipher method. A cryptographic key and algorithm are applied to a block of data at once, rather than one bit at a time. For example, using FPE, a 16-digit credit card number is encrypted such that the generated ciphertext is another 16-digit number. Since encrypted data retains its original format with FPE, there is no need for any schema-related changes to the database or application.

Protegrity supports FPE using NIST-approved Format preserving, Feistel based type 1 (FF1) mode of operation with AES-256 block cipher encryption algorithm.

Protegrity Format Preserving Encryption (FPE) currently supports encryption using AES-256 block cipher algorithm.

For more information about the AES-256 algorithm, refer to AES-256.

FPE Properties

The FPE properties are specified when creating a data element with FPE method.

Code Points

The code points are coded character sets, where each character maps to unique numeric values for representation of that character.

Tweak Input

The tweak input can be used to encrypt the same input plaintext that results in different ciphertexts.

Left and Right Settings

The Left and Right Settings property indicates the number of characters from left and right that will remain in the clear and are excluded from format preserving encryption.

Handling Special Numeric Credit Card Data

The Handling Special Numeric Data process involves gathering a set of special numeric data and representing it in a different format.


Last modified : December 16, 2025