]> Fastly Inc.

fde@00f.net

Internet-Draft This document specifies URICrypt, a deterministic, prefix-preserving encryption scheme for Uniform Resource Identifiers (URIs). URICrypt encrypts URI paths while preserving their hierarchical structure, enabling systems that rely on URI prefix relationships to continue functioning with encrypted URIs. The scheme provides authenticated encryption for each URI path component, preventing tampering, reordering, or mixing of encrypted segments. Discussion Venues Source for this draft and an issue tracker can be found at .

Introduction This document specifies URICrypt, a method for encrypting Uniform Resource Identifiers (URIs) while preserving their hierarchical structure. The primary motivation is to enable systems that rely on URI prefix relationships for routing, filtering, or access control to continue functioning with encrypted URIs. URICrypt achieves prefix preservation through a chained encryption model where the encryption of each URI component depends cryptographically on all preceding components. This ensures that URIs sharing common prefixes produce ciphertexts that also share common encrypted prefixes. The scheme uses an extendable-output function (XOF) as its cryptographic primitive and provides authenticated encryption for each component, preventing tampering, reordering, or mixing of encrypted segments.

Use Cases and Motivations The main motivations include:

• Access Control in CDNs: Content Delivery Networks often use URI prefixes for routing and access control. URICrypt allows encrypting resource paths while preserving the prefix structure needed for CDN operations.
• Privacy-Preserving Logging: Systems can log encrypted URIs without exposing sensitive path information, while still enabling analysis based on URI structure.
• Confidential Data Sharing: When sharing links to sensitive resources, URICrypt prevents the path structure itself from revealing confidential information.
• Token-Based Access Systems: Systems that issue time-limited access tokens can use URICrypt to obfuscate the underlying resource location while maintaining routability.
• Multi-Tenant Systems: In systems where multiple tenants share infrastructure, URICrypt can isolate tenant data while allowing shared components to be processed efficiently.
• Privacy-Preserving Analytics: URICrypt can complement IPCrypt . Together, they enable systems to perform analytics on encrypted network flows and resource access patterns without exposing sensitive information about either the network endpoints or the specific resources being accessed.

Terminology The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “NOT RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. Throughout this document, the following terms and conventions apply:

• URI: Uniform Resource Identifier as defined in .
• URI Component: A segment of a URI path, typically separated by ‘/’ characters. For encryption purposes, components include the trailing separator except for the final component.
• Scheme: The URI scheme (e.g., “https://”) which is preserved in plaintext.
• XOF: Extendable-Output Function, a hash function that can produce output of arbitrary length.
• SIV: Synthetic Initialization Vector, a 16-byte value derived from the accumulated state of all previous components, used for authentication and as input to keystream generation.
• Domain Separation: The practice of using distinct inputs to cryptographic functions to ensure outputs for different purposes are not compatible.
• Prefix-Preserving Encryption: An encryption scheme where if two plaintexts share a common prefix, their corresponding ciphertexts also share a common (encrypted) prefix.
• Chained Encryption: A mode where encryption of each component depends cryptographically on all preceding components.

URI Processing This section describes how URIs are processed for encryption and decryption.

URI Component Extraction Before encryption, a URI must be split into its scheme and path components. The path is further divided into individual components for chained encryption.

Full URIs For a full URI including a scheme: Note that all components except the last include the trailing ‘/’ character. This ensures proper reconstruction during decryption.

Path-Only URIs For URIs without a scheme: The leading ‘/’ is not treated as a separate component but is implied during reconstruction.

Component Reconstruction During decryption, components are joined to reconstruct the original path:

Cryptographic Operations URICrypt uses three parallel TurboSHAKE128 instances for different purposes, all initialized from the same base hasher.

Hasher Initialization The base hasher is initialized with the secret key and context parameter using length-prefixed encoding to prevent ambiguities. Two hashers are derived from the base hasher:

1. Components Hasher: Updated with each component’s plaintext to generate SIVs
2. Base Keystream Hasher: Used as the starting point for generating keystream for each component

The initialization process:

Component Encryption For each component, the encryption process is:

1. Update components_hasher with the component plaintext
2. Generate SIV from components_hasher (16 bytes)
3. Create keystream_hasher by cloning base_keystream_hasher and updating with SIV
4. Calculate padding needed for base64 encoding
5. Generate keystream of length (component_length + padding)
6. XOR padded component with keystream
7. Output SIV concatenated with encrypted_component

The padding length is calculated as: padding_len = (3 - (16 + component_len) % 3) % 3

Component Decryption For each encrypted component, the decryption process is:

1. Read SIV from input (16 bytes)
2. Create keystream_hasher by cloning base_keystream_hasher and updating with SIV
3. Read encrypted component data (length determined from encoding)
4. Generate keystream and decrypt component
5. Remove padding to recover plaintext
6. Update components_hasher with plaintext
7. Generate expected SIV from components_hasher
8. Compare expected SIV with received SIV (constant-time)
9. If mismatch, return error

Any tampering with the encrypted data will cause the SIV comparison to fail.

Padding and Encoding Each encrypted component (SIV || ciphertext) is padded to make its length a multiple of 3 bytes, enabling clean base64 encoding without padding characters. The final output is encoded using URL-safe base64 without padding.

Algorithm Specification This section provides the complete algorithms for encryption and decryption. The following functions and operations are used throughout the algorithms:

• TurboSHAKE128(): Creates a new TurboSHAKE128 hash instance with domain separation parameter 0x1F. This function produces an extensible output function (XOF) that can generate arbitrary-length outputs.
• .update(data): Absorbs the provided data into the hash state. The data is processed sequentially and updates the internal state of the hash function.
• .read(length): Squeezes the specified number of bytes from the hash function’s output. Each call continues from where the previous read left off, producing a continuous stream of pseudorandom bytes.
• .clone(): Creates a new hash instance with an identical internal state to the original. This enables multiple independent computation paths from the same initial state.
• XOR operation: The bitwise exclusive OR operation between two byte sequences of equal length. This operation is used to combine plaintext with keystream for encryption, and ciphertext with keystream for decryption.
• base64url_encode(data): Converts binary data to a base64 string using URL-safe encoding (replacing ‘+’ with ‘-‘ and ‘/’ with ‘_’) and omitting padding characters.
• base64url_decode(string): Converts a URL-safe base64 string back to binary data, automatically handling the absence of padding characters.
• Stream(data): Creates a sequential reader for binary data, enabling byte-by-byte or block-based access to the contents.
• constant_time_compare(a, b): Compares two byte sequences in constant time, regardless of their contents. This prevents timing attacks by ensuring the comparison duration does not depend on which bytes differ.
• len(data): Returns the length of the provided data in bytes.
• concatenated with: The operation of joining two byte sequences end-to-end to form a single sequence.
• zeros(count): Generates a sequence of zero-valued bytes of the specified length, used for padding.
• remove_padding(data): Removes trailing zero bytes from a byte sequence to recover the original data length.
• join(components): Combines multiple path components into a single path string using ‘/’ as the separator between components.

Encryption Algorithm Input: secret_key, context, uri_string Output: encrypted_uri Steps:

1. Split URI into scheme and components
2. Initialize hashers as described in
3. encrypted_output = empty byte array
4. For each component:
   • Update components_hasher with component
   • SIV = components_hasher.read(16)
   • keystream_hasher = base_keystream_hasher.clone()
   • keystream_hasher.update(SIV)
   • padding_len = (3 - (16 + len(component)) % 3) % 3
   • keystream = keystream_hasher.read(len(component) + padding_len)
   • padded_component = component concatenated with zeros(padding_len)
   • encrypted_part = padded_component XOR keystream
   • encrypted_output = encrypted_output concatenated with SIV concatenated with encrypted_part
5. base64_output = base64url_encode(encrypted_output)
6. Return scheme + base64_output

Decryption Algorithm Input: secret_key, context, encrypted_uri Output: decrypted_uri or error Steps:

1. Split encrypted URI into scheme and base64 part
2. decoded = base64url_decode(base64_part). If decoding fails, return error
3. Initialize hashers as described in
4. decrypted_components = empty list
5. input_stream = Stream(decoded)
6. While input_stream is not empty:
   • SIV = input_stream.read(16). If not enough bytes, return error
   • keystream_hasher = base_keystream_hasher.clone()
   • keystream_hasher.update(SIV)
   • Determine component length from remaining data and padding
   • encrypted_part = input_stream.read(component_length)
   • keystream = keystream_hasher.read(len(encrypted_part))
   • padded_plaintext = encrypted_part XOR keystream
   • component = remove_padding(padded_plaintext)
   • Update components_hasher with component
   • expected_SIV = components_hasher.read(16)
   • If constant_time_compare(SIV, expected_SIV) == false: return error
   • decrypted_components.append(component)
7. decrypted_path = join(decrypted_components)
8. Return scheme + decrypted_path

Implementation Details

TurboSHAKE128 Usage Implementations MUST use TurboSHAKE128 with a domain separation parameter of 0x1F for all operations. The TurboSHAKE128 XOF is used for:

• Generating SIVs from the components hasher
• Generating keystream for encryption/decryption
• All hash operations in the initialization

TurboSHAKE128 is specified in and provides the security properties needed for this construction.

Key and Context Handling The secret key MUST be at least 16 bytes long. Keys shorter than 16 bytes MUST be rejected. Implementations SHOULD validate that the key does not consist of repeated patterns (e.g., identical first and second halves) as a best practice. The context parameter is a string that provides domain separation. Different applications SHOULD use different context strings to prevent cross-application attacks. The context string MAY be empty. Both key and context are length-prefixed when absorbed into the base hasher: The length is encoded as a single byte, limiting keys and contexts to 255 bytes. This is sufficient for all practical use cases.

Error Handling Implementations MUST NOT reveal the cause of decryption failures. All error conditions (invalid base64, incorrect padding, SIV mismatch, insufficient data) MUST result in identical, generic error messages. SIV comparison MUST be performed in constant-time to prevent timing attacks.

Security Guarantees URICrypt provides the following cryptographic security guarantees:

Confidentiality URICrypt achieves semantic security for URI path components through its use of TurboSHAKE128 as a pseudorandom function. Each component is encrypted using a unique keystream derived from:

• The secret key
• The application context
• A synthetic initialization vector (SIV) that depends on all preceding components

This construction ensures that:

• An attacker without the secret key cannot recover plaintext components from ciphertexts
• The keystream generation is computationally indistinguishable from random for each unique (key, context, path-prefix) tuple
• Components are protected by at least 128 bits of security against brute-force attacks

Authenticity and Integrity Each URI component is authenticated through the SIV mechanism:

• The SIV acts as a Message Authentication Code (MAC) computed over the component and all preceding components
• Any modification to a component will cause the SIV verification to fail during decryption
• The chained construction ensures that reordering, insertion, or deletion of components is detected
• Authentication provides 128-bit security against forgery attempts

Prefix-Preserving Property URICrypt maintains a controlled information leakage pattern: - URIs sharing a common prefix will produce ciphertexts with the same encrypted prefix - This property is deterministic and intentional, enabling systems to perform prefix-based operations - The leakage is limited to prefix structure only - no information about non-matching suffixes is revealed

Domain Separation The context parameter provides cryptographic domain separation: - Different contexts with the same key produce completely independent ciphertexts - This prevents cross-context attacks where ciphertexts from one application could be used in another - Context binding is cryptographically enforced through the hasher initialization

Resistance to Common Attacks URICrypt resists several categories of attacks: Chosen-Plaintext Attacks (CPA): While deterministic, URICrypt is CPA-secure for unique inputs. The determinism is a design requirement for prefix preservation. Tampering Detection: Any bit flip, truncation, or modification in the ciphertext will be detected with overwhelming probability (1 - 2^-128). Length Extension: The use of length-prefixed encoding and domain separation prevents length extension attacks. Replay Attacks: Within a single (key, context) pair, replay is possible due to determinism. Applications requiring replay protection should incorporate timestamps or nonces in the context. Key Recovery: TurboSHAKE128’s security properties ensure that observing ciphertexts does not leak information about the secret key.

Security Bounds The security of URICrypt is bounded by:

• Key strength: Minimum 128-bit security with 16-byte keys
• Collision resistance: 2⁶⁴ birthday bound for SIV collisions
• Authentication security: 2^-128 probability of successful forgery
• Computational security: Based on TurboSHAKE128’s proven security as an XOF

Limitations and Trade-offs URICrypt makes specific security trade-offs for functionality:

• Deterministic encryption: Same inputs produce same outputs, enabling certain traffic analysis
• Length preservation: Component lengths are not hidden, potentially revealing information patterns
• Prefix structure leakage: The hierarchical structure of URIs is preserved by design

These trade-offs are intentional and necessary for the prefix-preserving functionality. Applications requiring stronger privacy guarantees should evaluate whether URICrypt’s properties align with their threat model.

Security Considerations URICrypt provides confidentiality and integrity for URI paths while preserving prefix relationships. The security properties depend on:

• Key Secrecy: The security of URICrypt depends entirely on the secrecy of the secret key. Keys MUST be generated using a cryptographically secure random number generator and stored securely.
• Deterministic Encryption: URICrypt is deterministic - identical inputs produce identical outputs. This allows observers to detect when the same URI is encrypted multiple times. Applications requiring unlinkability SHOULD incorporate additional entropy (e.g., via the context parameter).
• Prefix Preservation: While essential for functionality, prefix preservation leaks information about URI structure. Systems where this information is sensitive SHOULD consider alternative approaches.
• Context Separation: The context parameter prevents cross-context attacks. Applications MUST use distinct contexts for different purposes, even when sharing keys.
• Component Authentication: Each component is authenticated via the SIV mechanism. Any modification, reordering, or truncation of components will be detected during decryption.
• Length Leakage: The length of each component is preserved in the encrypted output. Applications sensitive to length information SHOULD consider padding components to fixed lengths.
• Key Reuse: Using the same key with different contexts is safe, but using the same (key, context) pair for different applications is NOT RECOMMENDED.

IANA Considerations This document has no actions for IANA.

Normative References Fastly Inc. This document specifies secure, efficient methods for encrypting IP addresses for privacy-preserving storage, logging, and analytics. Unlike truncation, which destroys data irreversibly, these methods are reversible with the encryption key while providing strong privacy guarantees. Four modes are defined: ipcrypt-deterministic (format-preserving, 16-byte output), ipcrypt-pfx (prefix-preserving, native address size), ipcrypt-nd and ipcrypt-ndx (non-deterministic with random tweaks). All support high-performance processing at network speeds and produce interoperable results across implementations. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. A Uniform Resource Identifier (URI) is a compact sequence of characters that identifies an abstract or physical resource. This specification defines the generic URI syntax and a process for resolving URI references that might be in relative form, along with guidelines and security considerations for the use of URIs on the Internet. The URI syntax defines a grammar that is a superset of all valid URIs, allowing an implementation to parse the common components of a URI reference without knowing the scheme-specific requirements of every possible identifier. This specification does not define a generative grammar for URIs; that task is performed by the individual specifications of each URI scheme. [STANDARDS-TRACK] ABN AMRO Bank zkSecurity STMicroelectronics National Institute of Standards and Technology Radboud University This document defines four eXtendable Output Functions (XOF), hash functions with output of arbitrary length, named TurboSHAKE128, TurboSHAKE256, KT128 and KT256. All four functions provide efficient and secure hashing primitives, and the last two are able to exploit the parallelism of the implementation in a scalable way. This document is a product of the Crypto Forum Research Group. It builds up on the definitions of the permutations and of the sponge construction in [FIPS 202], and is meant to serve as a stable reference and an implementation guide. This document describes the commonly used base 64, base 32, and base 16 encoding schemes. It also discusses the use of line-feeds in encoded data, use of padding in encoded data, use of non-alphabet characters in encoded data, use of different encoding alphabets, and canonical encodings. [STANDARDS-TRACK] Security systems are built on strong cryptographic algorithms that foil pattern analysis attempts. However, the security of these systems is dependent on generating secret quantities for passwords, cryptographic keys, and similar quantities. The use of pseudo-random processes to generate secret quantities can result in pseudo-security. A sophisticated attacker may find it easier to reproduce the environment that produced the secret quantities and to search the resulting small set of possibilities than to locate the quantities in the whole of the potential number space. Choosing random quantities to foil a resourceful and motivated adversary is surprisingly difficult. This document points out many pitfalls in using poor entropy sources or traditional pseudo-random number generation techniques for generating such quantities. It recommends the use of truly random hardware techniques and shows that the existing hardware on many systems can be used for this purpose. It provides suggestions to ameliorate the problem when a hardware solution is not available, and it gives examples of how large such quantities need to be for some applications. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.

Pseudocode

URI Component Extraction

Hasher Initialization

Encryption Algorithm

Decryption Algorithm = padding_len: component_data = input_stream.peek(possible_len) break if component_data is None: return error("Decryption failed") // Read encrypted data encrypted_part = input_stream.read(len(component_data)) // Generate keystream and decrypt keystream = keystream_hasher.squeeze(len(encrypted_part)) padded_plaintext = xor_bytes(encrypted_part, keystream) // Remove padding bytes added for base64 alignment padding_len = (3 - (16 + len(encrypted_part)) % 3) % 3 component = padded_plaintext[:-padding_len] if padding_len > 0 else padded_plaintext // Update hasher with plaintext components_hasher.update(component) // Generate expected SIV expected_siv = components_hasher.squeeze(16) // Authenticate using constant-time comparison to prevent timing attacks if not constant_time_equal(siv, expected_siv): return error("Decryption failed") decrypted_components.append(component) // Reconstruct URI if scheme and decrypted_components: path = "".join(decrypted_components) return scheme + path elif decrypted_components: return "/" + "".join(decrypted_components) else: return "" ]]>

Padding and Encoding 0: encoded = encoded + ('=' * padding) // Make standard base64 encoded = encoded.replace('-', '+') .replace('_', '/') // Decode return standard_base64_decode(encoded) ]]>

Test Vectors These test vectors were generated using the reference Rust implementation of URICrypt with TurboSHAKE128.

Test Vector 1: Full URI

Test Vector 2: Path-Only URI

Test Vector 3: Multi-Component Path

Test Vector 4: Root with Scheme

Test Vector 5: Simple Path