ipcrypt

A Zero implementation of ipcrypt — secure, efficient methods for encrypting IP addresses.

Implements all four ipcrypt modes:

• ipcrypt-deterministic — AES-128 format-preserving encryption (IP → IP)
• ipcrypt-nd — Non-deterministic with KIASU-BC tweakable block cipher (8-byte tweak)
• ipcrypt-ndx — Non-deterministic with AES-XTS (16-byte tweak)
• ipcrypt-pfx — Prefix-preserving encryption (maintains network structure)

API

All functions operate on 16-byte IP representations ([16]u8). IPv4 addresses use IPv4-mapped IPv6 format (::ffff:a.b.c.d).

use ipcrypt

// Convert IPv4 to 16-byte representation
let ip [16]u8 ipv4_to_16 [192, 0, 2, 1]

// Deterministic encryption (16-byte key)
let key [16]u8 [...]
let ct [16]u8 det_encrypt key ip
let rt [16]u8 det_decrypt key ct

// Non-deterministic: ND (16-byte key, 8-byte tweak)
let nd_out [24]u8 nd_encrypt key ip tweak8
let nd_ip [16]u8 nd_decrypt key nd_out

// Non-deterministic: NDX (32-byte key, 16-byte tweak)
let ndx_out [32]u8 ndx_encrypt key32 ip tweak16
let ndx_ip [16]u8 ndx_decrypt key32 ndx_out

// Prefix-preserving (32-byte key, IP → IP)
let pfx_ct [16]u8 pfx_encrypt key32 ip
let pfx_ip [16]u8 pfx_decrypt key32 pfx_ct

Test Vectors

Verified against the ipcrypt specification test vectors:

Mode	Key	Input	Output
deterministic	0123456789abcdeffedcba9876543210	0.0.0.0	bde9:6789:d353:824c:d7c6:f58a:6bd2:26eb
nd	0123456789abcdeffedcba9876543210	0.0.0.0	tweak=08e0c289bff23b7c, out=08e0c289bff23b7cb349a...
ndx	012345...67452301	0.0.0.0	tweak=21bd1834bc088cd2b4ecbe30b70898d7, out=82db0d4125...
pfx	012345...67452301	0.0.0.0	151.82.155.134

Build

zero check .
zero test .

License

MIT