]> Fastly Inc.

fde@00f.net

Internet-Draft This document specifies URICrypt, a deterministic, prefix-preserving encryption scheme for Uniform Resource Identifiers (URIs). URICrypt encrypts URI paths while preserving their hierarchical structure, enabling systems that rely on URI prefix relationships to continue functioning with encrypted URIs. The scheme provides authenticated encryption for each URI path component, preventing tampering, reordering, or mixing of encrypted segments. Discussion Venues Source for this draft and an issue tracker can be found at .

Introduction This document specifies URICrypt, a method for encrypting Uniform Resource Identifiers (URIs) while preserving their hierarchical structure. The primary motivation is to enable systems that rely on URI prefix relationships for routing, filtering, or access control to continue functioning with encrypted URIs. URICrypt achieves prefix preservation through a chained encryption model where the encryption of each URI component depends cryptographically on all preceding components. This ensures that URIs sharing common prefixes produce ciphertexts that also share common encrypted prefixes. The scheme uses an extendable-output function (XOF) as its cryptographic primitive and provides authenticated encryption for each component, preventing tampering, reordering, or mixing of encrypted segments. URICrypt is a reversible encryption scheme: encrypted URIs can be fully decrypted to recover the original URIs, but only with possession of the secret key.

Use Cases and Motivations The main motivations include:

• Access Control in CDNs: Content Delivery Networks often use URI prefixes for routing and access control. URICrypt allows encryption of resource paths while preserving the prefix structure needed for CDN operations.
• Privacy-Preserving Logging: Systems can log encrypted URIs without exposing sensitive path information, while still enabling analysis based on URI structure.
• Confidential Data Sharing: When sharing links to sensitive resources, URICrypt prevents the path structure itself from revealing confidential information.
• Token-Based Access Systems: Systems that issue time-limited access tokens can use URICrypt to obfuscate the underlying resource location while maintaining routability.
• Multi-tenant Systems: In systems where multiple tenants share infrastructure, URICrypt can isolate tenant data while allowing shared components to be processed efficiently.
• Privacy-preserving Analytics: URICrypt can complement IPCrypt . Together, they enable systems to perform analytics on encrypted network flows and resource access patterns without exposing sensitive information about either the network endpoints or the specific resources being accessed.

Terminology The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “NOT RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. Throughout this document, the following terms and conventions apply:

• URI: Uniform Resource Identifier as defined in .
• URI Component: A segment of a URI path, terminated by ‘/’, ‘?’, or ‘#’ characters. For encryption purposes, components include the trailing terminator except for the final component.
• Scheme: The URI scheme (e.g., “https://”) which is preserved in plaintext.
• XOF: Extendable-Output Function, a cryptographic function that can produce output of arbitrary length.
• SIV: Synthetic Initialization Vector, a value derived from the accumulated state of all previous components, used for authentication and as input to keystream generation.
• SIVLEN: The length of the Synthetic Initialization Vector in bytes, defined as 16 bytes (128 bits) for this specification.
• PADBS: Padding Block Size, the number of bytes to which ciphertext components are aligned. Defined as 3 bytes for this specification to ensure efficient Base64url encoding without padding characters.
• Domain Separation: The practice of using distinct inputs to cryptographic functions to ensure outputs for different purposes are not compatible.
• Prefix-preserving Encryption: An encryption scheme where, if two plaintexts share a common prefix, their corresponding ciphertexts also share a common (encrypted) prefix.
• Chained Encryption: A mode where encryption of each component depends cryptographically on all preceding components.

URI Processing This section describes how URIs are processed for encryption and decryption. The overall encryption flow transforms a plaintext URI into an encrypted URI while preserving its hierarchical structure:

URI Component Extraction Before encryption, a URI must be split into its scheme and path components. The path is further divided into individual components for chained encryption. Components are terminated by ‘/’, ‘?’, or ‘#’ characters, which allows proper handling of query strings and fragments.

Full URIs For a full URI including a scheme: For a URI with query parameters: For a URI with a fragment: Note that all components except the last include their trailing terminator character (‘/’, ‘?’, or ‘#’). This ensures proper reconstruction during decryption.

Path-Only URIs For absolute paths (URIs starting with ‘/’ but without a scheme), the leading ‘/’ is treated as the first component: For a path with query parameters: The leading ‘/’ is explicitly encrypted as a component to maintain consistency and enable proper prefix preservation for absolute paths. This character receives its own SIV and is encrypted, ensuring that the root path is authenticated like any other path component and that different keys and contexts produce different ciphertexts for that path, consistently with other paths. In applications where all paths are guaranteed to be absolute and the '/' path can be considered a special case, ciphertext expansion can be reduced by removing the leading '/' character from the URI prior to encryption, treating the path as relative with '/' as implicit.

Component Reconstruction During decryption, components are joined to reconstruct the original path: For absolute paths without a scheme:

Cryptographic Operations The chained encryption model creates cryptographic dependencies between components, ensuring prefix preservation. SIV1 (SIVLEN bytes) +-------------------+ | | v Encrypt("example.com/") | v Output1 = SIV1 || Ciphertext1 | | State carries forward v +-------------------+ | Component 2: | | "path/" | +-------------------+ | | Plaintext absorbed (includes Component 1 state) v +-------------------+ | SIV2 generation |------> SIV2 (depends on 1) +-------------------+ | | v Encrypt("path/") | v Output2 = SIV2 || Ciphertext2 | | State carries forward v +-------------------+ | Component 3: | | "to/" | +-------------------+ | | Plaintext absorbed (includes 1 + 2 state) v +-------------------+ | SIV3 generation |------> SIV3 (depends on 1, 2) +-------------------+ | | v Encrypt("to/") | v Output3 = SIV3 || Ciphertext3 | | State carries forward v +-------------------+ | Component 4: | | "resource" | +-------------------+ | | Plaintext absorbed (includes 1 + 2 + 3 state) v +-------------------+ | SIV4 generation |------> SIV4 (depends on 1, 2, 3) +-------------------+ | | v Encrypt("resource") | v Output4 = SIV4 || Ciphertext4 Final Output: Output1 || Output2 || Output3 || Output4 ]]> If URIs share a common prefix example.com/path/, their Output1 and Output2 will be identical.

XOF Initialization The base XOF is initialized with the secret key and context parameters using length-prefixed encoding to prevent ambiguities. Two XOF instances are derived from the base XOF:

1. Components XOF: Updated with each component’s plaintext to generate SIVs
2. Base Keystream XOF: Used as the starting point for generating keystream for each component

The initialization process is: Note on XOF cloning: The .clone() operation creates a new XOF instance with an identical internal state, preserving all previously absorbed data. After cloning, the original and cloned XOFs can be updated and read from independently. This allows the components_xof to maintain a running state across all components while base_keystream_xof remains unchanged for creating per-component keystreams.

Component Encryption For each component, the encryption process follows a precise sequence that ensures both confidentiality and authenticity:

1. Update components_xof with the component plaintext
2. Squeeze the SIV from components_xof (SIVLEN bytes). This requires cloning components_xof before reading, as reading may finalize the XOF.
3. Create keystream_xof by cloning base_keystream_xof and updating it with SIV
4. Calculate padding needed for base64 encoding
5. Generate a keystream of length (component_length + padding)
6. XOR the padded component with the keystream
7. Output SIV concatenated with encrypted_component

The padding ensures clean base64url encoding without padding characters. Since base64 encoding works with groups of 3 bytes (producing 4 characters), we pad each (SIV || encrypted_component) pair to have a length that’s a multiple of PADBS: This formula calculates:

• How many bytes are needed to reach the next multiple of PADBS
• The outer modulo handles the case where total_bytes is already a multiple of PADBS

The components_xof maintains state across all components. After generating the SIV for component N, the XOF can be updated with component N+1’s plaintext. This chaining ensures that each component’s encryption depends on all previous components, thus enabling the prefix-preserving property.

Component Decryption For each encrypted component, the decryption process is:

1. Read SIV from input (SIVLEN bytes)
2. Create keystream_xof by cloning base_keystream_xof and updating it with SIV
3. Decrypt bytes incrementally to determine component boundaries:
   • Generate keystream bytes one at a time from the XOF
   • XOR each encrypted byte with its corresponding keystream byte
   • Check each decrypted byte for component terminators ('/', '?', '#')
   • When a terminator is found, the component is complete.
   • Skip any padding bytes (null bytes) after the component
4. Update components_xof with the complete plaintext component (including terminator)
5. Generate the expected SIV from components_xof
6. Compare the expected SIV with the received SIV (constant-time)
7. If mismatch, return error

Component Boundary Detection During decryption, component boundaries are discovered dynamically by examining the decrypted plaintext:

• Each component (except possibly the last) ends with a terminator character ('/', '?', or '#')
• When a terminator is encountered, we know the component is complete
• After finding the terminator, we skip padding bytes to align to the next PADBS-byte boundary.
• The padding length can be calculated: padding = (PADBS - ((SIVLEN + bytes_read) % PADBS)) % PADBS

This approach eliminates the need for explicit length encoding, as the component structure itself provides the necessary boundary information. Any tampering with the encrypted data will cause the SIV comparison to fail.

Padding and Encoding To enable clean base64url encoding without padding characters (‘=’), each encrypted component pair (SIV || ciphertext) is padded to be a multiple of PADBS bytes. This is necessary because base64 encoding processes 3 bytes at a time to produce 4 characters of output. The padding calculation (PADBS - (SIVLEN + component_len) % PADBS) % PADBS ensures the following:

• If (SIVLEN + component_len) % PADBS = 0: no padding needed (already aligned)
• If (SIVLEN + component_len) % PADBS = 1: add 2 bytes of padding
• If (SIVLEN + component_len) % PADBS = 2: add 1 byte of padding

With the default value of PADBS=3, this padding scheme provides partial length-hiding. For example, with SIVLEN=16, components “abc”, “abcd”, and “abcde” all produce 21-byte outputs after padding. Without the secret key, a passive adversary cannot determine the exact original component size. The final output is encoded using URL-safe base64 , with ‘-‘ replacing ‘+’ and ‘_’ replacing ‘/’ for URI compatibility.

Algorithm Specification This section provides the complete algorithms for encryption and decryption. The following functions and operations are used throughout the algorithms:

• TurboSHAKE128(): Creates a new TurboSHAKE128 XOF instance with domain separation parameter 0x1F. This function produces an extensible output function (XOF) that can generate arbitrary-length outputs.
• .update(data): Absorbs the provided data into the XOF state. Data is processed sequentially and updates the internal state of the XOF.
• .read(length): Squeezes the specified number of bytes from the XOF’s output. Each call continues from where the previous read left off, producing a continuous stream of pseudorandom bytes.
• .clone(): Creates a new XOF instance with an identical internal state to the original. This enables multiple independent computation paths from the same initial state.
• XOR operation: The bitwise exclusive OR operation between two byte sequences of equal length. This operation is used to combine plaintext with keystream for encryption, and ciphertext with keystream for decryption.
• base64url_encode(data): Converts binary data to a base64 string using URL-safe encoding (replacing ‘+’ with ‘-‘ and ‘/’ with ‘_’) and omitting padding characters.
• base64url_decode(string): Converts a URL-safe base64 string back to binary data, automatically handling the absence of padding characters.
• Stream(data): Creates a sequential reader for binary data, enabling byte-by-byte or block-based access to the contents.
• constant_time_compare(a, b): Compares two byte sequences in constant time, regardless of their contents. This prevents timing attacks by ensuring the comparison duration does not depend on which bytes differ.
• len(data): Returns the length of the provided data in bytes.
• Concatenation: The operation of joining two byte sequences end-to-end to form a single sequence.
• zeros(count): Generates a sequence of zero-valued bytes of the specified length, used for padding.
• remove_padding(data): Removes trailing zero bytes from a byte sequence to recover the original data length.
• join(components): Combines multiple path components into a single path string, preserving the terminator characters ('/', '?', '#') that are included in each component.

Encryption Algorithm Input: secret_key, context, uri_string Output: encrypted_uri Steps:

1. Split URI into scheme and components
2. Initialize XOF instances as described in
3. encrypted_output = empty byte array
4. For each component:
   • Update components_xof with component
   • SIV = components_xof.clone().read(SIVLEN)
   • keystream_xof = base_keystream_xof.clone()
   • keystream_xof.update(SIV)
   • padding_len = (PADBS - (SIVLEN + len(component)) % PADBS) % PADBS
   • keystream = keystream_xof.read(len(component) + padding_len)
   • padded_component = component concatenated with zeros(padding_len)
   • encrypted_part = padded_component XOR keystream
   • encrypted_output = encrypted_output concatenated with SIV concatenated with encrypted_part
5. base64_output = base64url_encode(encrypted_output)
6. If scheme is not empty: Return scheme + base64_output
7. Else if original URI started with ‘/’: Return '/' + base64_output
8. Else: Return base64_output

Decryption Algorithm Input: secret_key, context, encrypted_uri Output: decrypted_uri or error Note: For path-only URIs (those starting with ‘/’), the output format is: - ‘/’ followed by the base64url-encoded encrypted components - This preserves the absolute path indicator in the encrypted form Steps:

1. Split encrypted URI into scheme and base64 part
2. decoded = base64url_decode(base64_part) If decoding fails, return error
3. Initialize XOF instances as described in
4. decrypted_components = empty list
5. position = 0
6. While position < len(decoded):
   • SIV = decoded[position:position+SIVLEN] If not enough bytes, return error
   • keystream_xof = base_keystream_xof.clone()
   • keystream_xof.update(SIV)
   • component_start = position + SIVLEN
   • component = empty byte array
   • position = position + SIVLEN
   • While position < len(decoded):
     • decrypted_byte = decoded[position] XOR keystream_xof.read(1)
     • position = position + 1
     • If decrypted_byte == 0x00: continue (skip padding)
     • component.append(decrypted_byte)
     • If decrypted_byte is '/', '?', or '#':
       • total_len = position - component_start
       • position = position + ((PADBS - ((SIVLEN + total_len) % PADBS)) % PADBS)
       • Break inner loop
   • Update components_xof with component
   • expected_SIV = components_xof.clone().read(SIVLEN)
   • If constant_time_compare(SIV, expected_SIV) == false, return error
   • decrypted_components.append(component)
7. decrypted_path = join(decrypted_components)
8. Return scheme + decrypted_path

Implementation Details

TurboSHAKE128 Usage Implementations MUST use TurboSHAKE128 with a domain separation parameter of 0x1F for all operations. The TurboSHAKE128 XOF is used for:

• Generating SIVs from the components XOF
• Generating keystream for encryption/decryption
• All XOF operations in the initialization

TurboSHAKE128 is specified in and provides the security properties needed for this construction.

Key and Context Handling The secret key MUST be at least SIVLEN bytes long. Keys shorter than SIVLEN bytes MUST be rejected. Implementations SHOULD validate that the key does not consist of repeated patterns (e.g., identical first and second halves) as a best practice. The context parameter is a string that provides domain separation. Different applications SHOULD use different context strings to prevent cross-application attacks. The context string MAY be empty. Both key and context are length-prefixed when absorbed into the base XOF: The length is encoded as a single byte, limiting keys and contexts to 255 bytes. This is sufficient for all practical use cases.

Error Handling Implementations MUST NOT reveal the cause of decryption failures. All error conditions (invalid base64, incorrect padding, SIV mismatch, insufficient data) MUST result in identical, generic error messages. SIV comparison MUST be performed in constant-time to prevent timing attacks.

Security Guarantees URICrypt provides the following cryptographic security guarantees:

Confidentiality URICrypt achieves semantic security for URI path components through its use of TurboSHAKE128 as a pseudorandom function. Each component is encrypted using a unique keystream derived from the following:

• The secret key
• The application context
• A synthetic initialization vector (SIV) that depends on all preceding components

This construction ensures that:

• An attacker without the secret key cannot recover plaintext components from ciphertexts.
• The keystream generation is computationally indistinguishable from random for each unique (key, context, path-prefix) tuple.
• Components are protected by at least 128 bits of security against brute-force attacks.

Authenticity and Integrity Each URI component is authenticated through the SIV mechanism:

• The SIV acts as a Message Authentication Code (MAC) computed over the component and all preceding components.
• Any modification to a component will cause the SIV verification to fail during decryption.
• The chained construction ensures that reordering, insertion, or deletion of components is detected.
• Authentication provides 128-bit security against forgery attempts.

Prefix-Preserving Property URICrypt maintains a controlled information leakage pattern:

• URIs sharing a common prefix will produce ciphertexts with the same encrypted prefix.
• This property is deterministic and intentional, enabling systems to perform prefix-based operations.
• The leakage is limited to prefix structure only—no information about non-matching suffixes is revealed.

Domain Separation The context parameter provides cryptographic domain separation:

• Different contexts with the same key produce completely independent ciphertexts.
• This prevents cross-context attacks where ciphertexts from one application could be used in another.
• Context binding is cryptographically enforced through the XOF initialization.

Key Commitment URICrypt provides full key-commitment security. The scheme is fully key-committing, meaning that a ciphertext can only be decrypted with the exact key that was used to encrypt it. It is computationally infeasible to find two different keys that successfully decrypt the same ciphertext to valid plaintexts.

Resistance to Common Attacks URICrypt resists several categories of attacks: Chosen-plaintext Attacks (CPA): While deterministic, URICrypt is CPA-secure for unique inputs. The determinism is a design requirement for prefix preservation. Tampering Detection: Any bit flip, truncation, or modification in the ciphertext will be detected with overwhelming probability (1 - 2^-128). Length-extension Attacks: The use of length-prefixed encoding and domain separation prevents length-extension attacks. Replay Attacks: Within a single (key, context) pair, replay is possible due to determinism. Applications requiring replay protection should incorporate timestamps or nonces into the context. Key Recovery: TurboSHAKE128’s security properties ensure that observing ciphertexts does not leak information about the secret key.

Security Bounds The security of URICrypt is bounded by the following:

• Key strength: Minimum 128-bit security with SIVLEN-byte keys
• Collision resistance: 2⁶⁴ birthday bound for SIV collisions
• Authentication security: 2^-128 probability of successful forgery
• Computational security: Based on TurboSHAKE128’s proven security as an XOF

Limitations and Trade-offs URICrypt makes specific security trade-offs for functionality, including the following:

• Deterministic encryption: Same inputs produce same outputs, enabling certain traffic analysis
• Partial length obfuscation: With PADBS=3, exact component lengths are partially hidden
• Prefix structure leakage: The hierarchical structure of URIs is preserved by design
• SIV length configuration: Implementations MAY adjust SIVLEN for different usage bounds. Larger values (24 or 32 bytes) increase birthday bound resistance at the cost of ciphertext expansion. However, 16 bytes is generally recommended as it provides practical collision resistance with acceptable overhead
• Padding block size configuration: The default PADBS=3 already provides partial length-hiding. Implementations MAY adjust PADBS to increase size obfuscation. Larger values create larger size buckets but increase ciphertext expansion. The value MUST remain a multiple of 3 to ensure efficient Base64url encoding without padding characters

These trade-offs are intentional and necessary for the prefix-preserving functionality. Applications requiring stronger privacy guarantees should evaluate whether URICrypt’s properties align with their threat model.

Security Considerations URICrypt provides confidentiality and integrity for URI paths while preserving prefix relationships. The encryption is fully reversible: encrypted URIs can be decrypted to recover the original plaintext URIs, but only with knowledge of the secret key. The security properties depend on:

• Key Secrecy: The security of URICrypt depends entirely on the secrecy of the secret key. Keys MUST be generated using a cryptographically secure random number generator and stored securely.
• Deterministic Encryption: URICrypt is deterministic - identical inputs produce identical outputs. This allows observers to detect when the same URI is encrypted multiple times. Applications requiring unlinkability SHOULD incorporate additional entropy (e.g., via the context parameter).
• Prefix Preservation: While essential for functionality, prefix preservation leaks information about URI structure. Systems where this information is sensitive SHOULD consider alternative approaches.
• Context Separation: The context parameter prevents cross-context attacks. Applications MUST use distinct contexts for different purposes, even when sharing keys.
• Component Authentication: Each component is authenticated via the SIV mechanism. Any modification, reordering, or truncation of components will be detected during decryption.
• Length Obfuscation: The default PADBS=3 configuration provides partial length-hiding. Applications requiring stronger length-hiding SHOULD consider using larger PADBS values or padding components to fixed lengths.
• Key Reuse: Using the same key with different contexts is safe, but using the same (key, context) pair for different applications is NOT RECOMMENDED.

IANA Considerations This document has no actions for IANA.

Acknowledgments The author would like to thank Maciej Soltysiak for highlighting the importance of properly supporting query parameters and fragments in URI encryption.

Normative References Fastly Inc. This document specifies secure, efficient methods for encrypting IP addresses for privacy-preserving storage, logging, and analytics. Unlike truncation, which destroys data irreversibly, these methods are reversible with the encryption key while providing strong privacy guarantees. Four modes are defined: ipcrypt-deterministic (format-preserving, 16-byte output), ipcrypt-pfx (prefix-preserving, native address size), ipcrypt-nd and ipcrypt-ndx (non-deterministic with random tweaks). All support high-performance processing at network speeds and produce interoperable results across implementations. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. A Uniform Resource Identifier (URI) is a compact sequence of characters that identifies an abstract or physical resource. This specification defines the generic URI syntax and a process for resolving URI references that might be in relative form, along with guidelines and security considerations for the use of URIs on the Internet. The URI syntax defines a grammar that is a superset of all valid URIs, allowing an implementation to parse the common components of a URI reference without knowing the scheme-specific requirements of every possible identifier. This specification does not define a generative grammar for URIs; that task is performed by the individual specifications of each URI scheme. [STANDARDS-TRACK] This document describes the commonly used base 64, base 32, and base 16 encoding schemes. It also discusses the use of line-feeds in encoded data, use of padding in encoded data, use of non-alphabet characters in encoded data, use of different encoding alphabets, and canonical encodings. [STANDARDS-TRACK] This document defines four eXtendable-Output Functions (XOFs), hash functions with output of arbitrary length, named TurboSHAKE128, TurboSHAKE256, KT128, and KT256. All four functions provide efficient and secure hashing primitives, and the last two are able to exploit the parallelism of the implementation in a scalable way. This document is a product of the Crypto Forum Research Group. It builds up on the definitions of the permutations and of the sponge construction in NIST FIPS 202 and is meant to serve as a stable reference and an implementation guide. Security systems are built on strong cryptographic algorithms that foil pattern analysis attempts. However, the security of these systems is dependent on generating secret quantities for passwords, cryptographic keys, and similar quantities. The use of pseudo-random processes to generate secret quantities can result in pseudo-security. A sophisticated attacker may find it easier to reproduce the environment that produced the secret quantities and to search the resulting small set of possibilities than to locate the quantities in the whole of the potential number space. Choosing random quantities to foil a resourceful and motivated adversary is surprisingly difficult. This document points out many pitfalls in using poor entropy sources or traditional pseudo-random number generation techniques for generating such quantities. It recommends the use of truly random hardware techniques and shows that the existing hardware on many systems can be used for this purpose. It provides suggestions to ameliorate the problem when a hardware solution is not available, and it gives examples of how large such quantities need to be for some applications. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.

Pseudocode

URI Component Extraction

XOF Initialization

Encryption Algorithm

Decryption Algorithm

Padding and Encoding 0: encoded = encoded + ('=' * padding) // Make standard base64 encoded = encoded.replace('-', '+') .replace('_', '/') // Decode return standard_base64_decode(encoded) ]]>

Test Vectors These test vectors were generated using the reference Rust implementation of URICrypt with TurboSHAKE128.

Test Vector 1: Full URI

Test Vector 2: Path-Only URI

Test Vector 3: Multi-Component Path

Test Vector 4: Root with Scheme

Test Vector 5: Simple Path

Test Vector 6: URI with Query Parameters

Test Vector 7: URI with Fragment

Test Vector 8: URI with Query and Fragment