Technical Bulletin #4 Encryption Guidelines and Algorithms for State Use REVISED: March, 20001

This technical bulletin supplements information in Appendices A and B to 45 CFR 1355 on assigning record numbers to detailed foster care and adoption data submitted to the Administration for Children and Families (ACF). This bulletin provides States with guidance in encrypting record numbers in the State data file submissions.

I. GENERAL INFORMATION

1. Background

   To protect confidentiality when reporting detailed data to AFCARS, States are required to assign a sequential number or a unique number which follows the child as long as he or she is in foster care and use a sequential or encrypted record number for reporting adoptions.² This record number (foster care data element #4 and adoption data element #5) must be a twelve digit number that cannot be linked to the child except at the State or local level. For purposes of the Federal child and family services reviews and the title IV-E foster care eligibility reviews³,States must be able to identify the case file for a specific record for up to three years after the end of the report period.

   States may:

   • generate a sequential record number for each child in the submission. The sequencing must begin with '000000000001' having each additional record incremented by 1. Since children may be represented by different sequential numbers for different reporting periods, States must maintain cross reference files for each bi-annual submission to cross walk assigned sequential numbers back to the appropriate case files; or,
   • encrypt the case number for each child in the submission by applying a mathematical formula to the child's case number. States can match the encrypted case number to the original case number by applying the reverse mathematical formula. Confidentiality is maintained by using a mathematical formula that can be identified only by the State transferring data.

   While States may use either sequential numbering or encrypting, ACF encourages States to use encryption. Using this method makes it easier for States to cross reference files for the identification of case record numbers at a later date. Also, States are encouraged to use the same case record number for a child each time the child enters and exits foster care, or receives services. This, combined with the use of the same "key", allows the State and ACF to develop cohort information and an annual database by matching records submitted for each of the report periods in a fiscal year. This is especially important in regard to the new child and family services review and the statewide assessment. The statewide assessment includes AFCARS data from the three most recent and available Federal Fiscal Years.

   This bulletin provides information on encrypting case numbers. For information regarding the use of the AFCARS Encryption/Decryption Utility supplied by ACF for State use, see Technical Bulletin #5, AFCARS Encryption/Decryption Utility: C Version 2.0.

   States may either use the methods outlined in this document to encrypt record numbers or may develop their own algorithms. However, all methods must adhere to the following guidelines:

Instructions and Methods

AFCARS record numbers may be encrypted using a variety of methods. In the following three sections, we will introduce algorithms States may select from to encrypt record numbers:

• Substitution
• Transposition
• Bit-level operations

II. SUBSTITUTION METHOD

1. Introduction

   In this method of encryption, each digit in the ID is replaced by another digit generated through an algorithm. To see how this type of encryption is accomplished, consider the following number line:

   0 1 2 3 4 5 6 7 8 9

   L <——————————> R

   A very simple encryption is accomplished by substituting each digit with the digit found 4 positions to the left on the number line. If the count of 4 extends beyond the number line, circle around and continue counting. By applying this rule, 1234 becomes 7890. Please note that this example is for illustration purposes only. It is not sufficiently complex for encrypting the State client ID.

   The following substitution models (sections II.B.-II.F.) are appropriate for encrypting State client IDs. However, if one of these substitution methods is chosen, the State should develop its own rules for substituting one digit for another. Please do not use the examples given as the substitution scheme for State encryption rules.

2. Unique digit substitution

   Apply a different substitution rule for each digit. For example, 1234 is encrypted as 6493 using the number line and the following table of rules:

   0 1 2 3 4 5 6 7 8 9

   L <——————————> R

3. Variable length substitution

   If the client ID length is variable, different rules can be applied based on the number of digits in the ID. For example, if the State's client ID can vary from 6 to 9 digits, the following table of rules could be applied:

4. Substitution with shuffled digits

   Use a number line with shuffled digits. For example, 1234 is encrypted as 6361 using the following number line and table of rules:

   6 9 2 8 3 1 4 0 5 7

   L <——————————> R

5. Substitution with an alphanumeric line

   Increase the substitution possibilities by using a line that includes both the alphabet as well as digits. 1234 is encrypted as I4PI using the following alphanumeric line and table of rules:

A B C D E F G H I J K L 0 1 2 3 4 5 6 7 8 9 M N O P Q R S T U V W X Y Z

L <————————————————————————————————— > R

6. Key-driven substitution

   A key can be used to drive the substitution algorithm. The key determines the number of positions to shift the characters of the ID. The selected key should be as long as the longest ID that exists. Each character of the key will correspond to one character of the ID.

   The following example uses an algorithm that shifts every digit X positions to the right, where X is the alphabetic position of the corresponding letter of the key (i.e. A = 1, B = 2, C = 3, D = 4, E = 5, etc.). If the number 123456789 is to be encrypted and the key is TRANSFORM, the resulting ID is YX4UBOZDZ using the alphanumeric line and table shown below:

   A B C D E F G H I J K L 0 1 2 3 4 5 6 7 8 9 M N O P Q R S T U V W X Y Z

   L <———————————————————————————————— > R

III. TRANSPOSITION METHOD

1. Introduction

   In this method of encryption, the positioning of the digits is changed. For example, 1234567 becomes 7234561 if the first and last digits are transposed. Please note that this example is for illustration purposes only. It is not sufficiently complex for encrypting the State client ID.

   The following models (sections III.B. - III.C.) are appropriate for encrypting State client IDs.

2. Transposition of digit pairs

   Transpose all digits in the ID. For example, 1234567 becomes 4657321, by applying the following rules:

3. Transposition with shuffled digits

   Rather than follow a straight transposition scheme, shuffle all digits. For example, 1234567 becomes 4715326 when applying the following rules:

IV. BIT-LEVEL OPERATIONS

1. Introduction

   State Case ID's can be encrypted by transforming the characters at the bit level to other characters in the ASCII data set. However, it is important to remember that ASCII control characters (0-31) and characters 35, 36, 37, and 64 must not be used. Inserting ASCII control characters into the AFCARS submission file will cause a file format error; the State file will not be processed and will fail the Data Compliance Utility.

   Three methods of bit manipulation are left shifts, logical nots (binary complements), and exclusive or (XOR). Left shifts describe the procedure of re-positioning bits within a character. Logical nots describe an operation in which each bit is replaced with its complement. XOR describes an operation that involves comparing binary representations of two characters and producing another binary representation according to a set of comparison rules. Each bit-level operation is described below in greater detail. The following models (subsections IV.B. - IV.E.) are appropriate for encrypting State client IDs.

2. Left Shifts

   This method has two types. Each involves three steps:

   1. Truncate (delete) the left most bit.
   2. Move the remaining bits over 1 position to the left.
   3. Fill the empty right position with a 0, or

   4. Fill the empty right position with a 1.

   B 1. Left Shift 1 Position

   In this example, the left most bit is truncated, all of the remaining 0's and 1's are moved one position to the left, and the empty position filled with a 0:

B.2 Left Shift 1 Position plus 1

In this example, the left most bit is truncated, all of the remaining 0's and 1's are moved one position to the left, and the empty position filled with a 1:

3. Logical Nots (Binary Complements)

   In this method, each bit is replaced with its complement (opposite value). Every 0 is replaced with a 1, every 1 is replaced with a 0. The following table illustrates this method:

4. XOR Method

   In this method, compare the binary representation of the original character and the binary representation of the key on a bit by bit basis. If both bits are the same (both 0 or both 1), the result is zero. If both bits are different, the result is one. The following table illustrates this method:

5. Combinations of left shifting and logical nots

   Bits can be further manipulated by sequentially applying two operations to a character. The following four tables illustrate some possible combinations:

   E.1 Left Shift 1 Position followed by a Logical Not

   In this method, the left most bit is truncated, all of the remaining 0's and 1's are moved one position to the left, and a 0 is added to the right side. Next, each bit is replaced with its complement to get the final conversion shown below.

E.2 Logical Not followed by a left shift one position

In this method, each bit is replaced with its complement. Next, the left most bit is truncated and all of the remaining 0's and 1's are moved one position to the left. A zero is added on the right side to get the final conversion shown below.

E.3 Left Shift 1 Position plus followed by a Logical Not

In this method, the left most bit is truncated, all of the remaining 0's and 1's are moved one position to the left, and a 1 is added on the right side. Next, each bit is replaced with its complement to get the final conversion shown below.

E.4 Logical Not followed by a Left Shift 1 Position plus 1

In this method, each bit is replaced with its complement. Next, truncate the left most bit, all of the remaining 0's and 1's are moved one position to the left, and a 1 is added on the right side to get the final conversion shown below.

V. COMBINING ALGORITHMS

1. Introduction

   States can devise an encryption method that employs a minimum of two algorithms. Combining methods can help create more complex encryption algorithms to ensure more secure State client IDs.

2. Substitution with Transposition

   One possible combination is to apply substitution with shuffled digits to a State client ID followed by transposition of digit pairs.

   In the first method, 1234 is encrypted as 9715 using the following number line and table of rules:

   9 0 8 2 3 6 7 4 1 5

   L <————————— > R

3. Bit Level Operations with Transposition

   The following algorithm was developed to be used by States to create encrypted AFCARS record numbers and will ensure that none of the restricted ASCII codes (characters 0-31, 35, 36, 37, and 64) occur in the resulting encrypted numbers. It uses the operations described below and assumes that State case IDs are composed of upper and lower case alphabetic characters (ASCII characters 41-90 and 97-122), digits 0-9 (ASCII characters 48-57), and dashes (ASCII character 45).

   1. Set up a table assigning a value of 0 to 6 for the operations described below. States may use the following example table or modify the example by reordering the bit operations:

2. Select an encryption key. The encryption key should be as long as the State case ID. The key should be kept secure and only be accessible to authorized State personnel.

3. Apply the following steps to the State case IDs:

   1. Determine the ASCII value of the first character of the key.
   2. Apply a MOD 7 operation to the ASCII value of that character. (In other words, divide the value by 7 and take the whole number remainder, which will be either 0,1,2,3,4,5, or 6).
   3. Using the chart developed in Step 1, go to the modal value (0-6) and select the corresponding bit operation.
   4. Determine the bit representation of the first character of the State case ID.
   5. Apply the bit operation(s) to the first character of the State case ID number. The resulting character will be the first number encrypted.
   6. Apply the same steps to each character in the ID, using the second character of the key to transform the second character of the State case ID, the third for the third, etc.

The following is an illustration of these steps applied to the first letter of State case ID "BD5-983E25N5" using the key "Change code.":

1. "C" is the first letter of the key; its ASCII value is 67.

2. 67 MOD 7 = 4.

3. The corresponding bit operation is ~ <<1+0.

4. "B" is the first character of the State case ID. Its ASCII value is 66; the binary representation of 66 is 01000010.

5. Applying ~ <<1+0 to 01000010 will yield 01111010 or 122. 122 is the ASCII number for "z".

The following table details the conversion for each character of the ID:

We will now change the position of the encrypted characters using the following table of rules:

In the first transposition, z and ö are switched to produce the character set:

ö w ò ñ î Å ï ¢ - c z

In the second transposition, w and c are switched to produce the character set:

ö c ò ñ î Å ï ¢ - w z

In the third transposition, ò and - are switched to produce the character set:

ö c - ñ î Å ï ¢ ò w z

In the fourth transposition, ñ and ¢ are switched to produce the character set:

ö c - ¢ î Å ï ñ ò w z

In the fifth transposition, î and ï are switched to produce the character set:

ö c - ¢ ï Å î ñ ò w z

In the sixth transposition, Å and are switched to produce the final character set:

ö c - ¢ ï Å î ñ ò w z

The final character set now represents the unique encrypted character set.

VI. REVERSING THE ENCRYPTION ALGORITHM

1. Introduction

   As mentioned in the Guidelines, be sure that the selected encryption method can be reversed to produce the original client ID for any AFCARS record number.

2. Sample Reversal Algorithm

   We will use the algorithm described in section V.B. (substitution with transposition) to illustrate the process. Let us work backwards starting with the second encryption method(transposition of digit pairs). Our first step is to reverse the order of the digit pairs that were transposed. With each digit pair, reverse the switching order to produce the following table of rules:

We will now change 9715 back to the original number (1234) by reversing the original substitution method. The number line will not change. Using the original table of rules, reverse the direction for each rule to produce the following table of rules:

9 0 8 2 3 6 7 4 1 5

L <————————— > R

As stated in the Guidelines, be sure that the encrypted number is scanned so that the ASCII control numbers (0-31) and ASCII characters 35, 36, 37, and 64 are not being used.

BIBLIOGRAPHY

The listed sources have examples of additional encryption strategies and techniques.

Denning, Dorothy E.R., Cryptography and Data Security, Addison Wesley, 1983.

Frank, Peter, Calculator Ciphers, Information Associates, 1980.

Kahn, David, The Codebreakers, Macmillan Company, 1972.

Marotta, Michael E., The Code Book: All about Unbreakable Codes and How to Use Them, Loompanics Unlimited, 1987

Meyer, Carl H. and Matyas, Stephen M., Cryptography, John Wiley & Sons, 1982.

Prosise, Jeff, How to Keep it a Secret, PC Magazine, July 1994.

Prosise, Jeff, WinCrypt Protects Your Data, PC Magazine, July 1994.

Russell, Deborah and Gangemi, G.T., Computer Security Basics, O'Reilly & Associates, Inc., 1992.

¹Initial issuance date June 30, 1994, as Technical Bulletin #6, Encryption versus Sequencing; and March 9, 1995, as Technical Bulletin #9, Encryption Guidelines & Algorithms.
²See 45 CFR 1355, Appendix A Section II,I.D. and Appendix B, Section II.I.C.
³ See 45 CFR 1355.31-37, and 1356.71.