Format-Preserving Encryption with Age Bucketing

What Cryptographic Hashing Is

Cryptographic Hashing (CryptoHashConfig) in Sensitive Data Protection computes an HMAC-SHA-256 message authentication code over an input string using a cryptographic key and returns a base64-encoded hash value.

Why It Doesn't Meet the Requirement

• Fails Reversibility: Cryptographic hashing is strictly a one-way tokenization method. It cannot be decrypted or de-tokenized back to the original patient_account_id, violating the requirement for authorized re-identification pipelines.
• Fails Format and Length Preservation: The output of cryptoHashConfig is a fixed-length base64-encoded string, which does not preserve the 10-digit numeric character set required by legacy schema validators.

Key Characteristics and Limitations

• One-Way Transformation: Impossible to recover cleartext data even with access to the original hashing key.
• Format Expansion: Converts numbers and strings into fixed-width base64 hashes.
• Referential Integrity: Maintains deterministic mapping for SQL joins, but lacks reversibility.

This Answer Would Be Correct If

The organization required permanent, irreversible pseudonymization (one-way hashing) where downstream systems supported arbitrary string lengths and re-identification was strictly prohibited.

Additional Context

While cryptographic hashing is secure and maintains referential integrity for joins, it is unsuited for workflows requiring compliance audits that necessitate detokenization.

What Deterministic Encryption and Character Masking Are

Deterministic Encryption (DE) uses AES-SIV to encrypt plaintext values into base64-encoded tokens with surrogates, while Character Masking (CharacterMaskConfig) replaces characters with a fixed symbol (e.g., * or #).

Why It Doesn't Meet the Requirement

• Fails Format Preservation: While Deterministic Encryption provides two-way reversibility and referential integrity, it outputs base64-encoded ciphertexts that do not preserve the 10-digit numeric character set, causing legacy validation errors.
• Fails Quasi-Identifier Generalization: Character masking redacts characters entirely rather than grouping numbers into continuous 10-year cohort intervals (e.g., masking turns 27 into ** or 2*, destroying distribution metrics).

Key Characteristics and Limitations

• Strong Cryptographic Security: AES-SIV used in DE provides authenticated encryption, which is stronger than FPE-FFX when format constraints are not present.
• Length and Alphabet Expansion: Deterministic encryption increases output string size and introduces alphanumeric/base64 characters.
• Destructive Masking: Character masking does not create structured mathematical buckets.

This Answer Would Be Correct If

Downstream analytical systems had no character set or length constraints and the age field required partial redaction rather than numerical cohort bucketing.

What Transient Keys and Time Part Transformations Are

A Transient Crypto Key (TransientCryptoKey) is an ephemeral key generated dynamically in-memory by Sensitive Data Protection for the duration of a single API request and immediately discarded. A Time Part Config (TimePartConfig) extracts specific temporal components (such as year or month) from date and timestamp fields.

Why It Doesn't Meet the Requirement

• Fails Cross-Pipeline Re-identification: Because a transient key is discarded after the API call finishes, records cannot be de-tokenized later in a separate re-identification pipeline, breaking two-way reversibility.
• Fails Key Management Policy: Transient keys cannot be audited or managed through Cloud KMS wrapped keys.
• Invalid Type Transformation: timePartConfig is designed for date and timestamp fields, not integer age columns.

Key Characteristics and Limitations

• Ephemeral Scope: Transient keys only guarantee consistency within a single batch API call; subsequent calls use different keys, breaking join referential integrity across pipelines.
• Temporal Restriction: TimePartConfig cannot evaluate or bucket numeric integer attributes.

This Answer Would Be Correct If

The dataset were processed in a single ad-hoc batch request where re-identification was never required and the age field was formatted as a full birth date string.