IP::Anonymous - Perl port of Crypto-PAn to provide anonymous IP addresses

  use IP::Anonymous;
  @key = (0..31);
  my $object = new IP::Anonymous(@key);
  print $object->anonymize("192.0.2.0")."\n";

# IP::Anonymous - Perl port of Crypto-PAn to provide anonymous IP addresses
#
# Copyright (c) 2005 John Kristoff <jtk@northwestern.edu>.  All rights
# reserved.  This program is free software; you can redistribute it and/or
# modify it under the same terms as Perl itself.

package IP::Anonymous;
$VERSION = '0.04';
require 5.001;

# base extensions and modules
use strict;                 # force us to code defensively
use warnings;               # do not let laziness go unnoticed
use vars qw($VERSION);      # package scope global vars
use Carp;                   # make errors the caller's problem
use Socket;                 # for convenient dotted quad handling routines

# additional modules
use Crypt::Rijndael;        # the Rijndael crypto magic

# module scope vars
my $m_pad;                  # 2nd 128 bits of user key used for secret padding
my $ecb;                    # electronic codebook mode (default) object
my $first4bytes_pad;        # 1st 4 bytes of secret pad in "network" order

# initialize
sub new {
    my $package = shift;
    my @key = @_;           # expected key is 32 8-bit unsigned ints
    my $m_key;              # 1st 128 bits of user key used for cipher

    # 1st 128 bits of key used as secret key for Rijndael cipher
    $m_key = pack("C16", @key[0..15]);
    # 2nd 128 bits of key used for secret padding
    $m_pad = pack("C16", @key[16..31]);

    # init the key
    $ecb = new Crypt::Rijndael $m_key;
    # encrypt the 128-bit secret pad
    $m_pad = $ecb->encrypt($m_pad);

    # first four bytes of secret pad in "network" (big-endian) order
    $first4bytes_pad = unpack("N", $m_pad);

    return bless({}, $package);
}

# generate a bit using the Rijndael cipher for each of the 32 bit address
# msb bits taken from original address, remaining bits are from m_pad
sub anonymize {
    my $package = shift;
    my $address = shift;    # expect dotted quad string
    my $first4bytes_input;  # used to handle the byte ordering problem
    my @rin_input = ();     # psuedorandom Rijndael cipher used each round
    my $rin_output;         # encrypted byte result at each round
    my $result = 0;         # initialize psuedorandom one time pad

    # rudimentary check for correctly formatted dotted quad
    if($address !~ /^\d{1,3}(?:\.\d{1,3}){3}$/) {
        croak("ERROR [".__LINE__."]: invalid IP address format\n");
        return;
    }

    # convert dotted quad to long in "network" (big-endian) order
    $address = unpack("N", pack("C4", split /\./, $address));

    # Rijndael cipher used to obtain each of the 32 anonymized bits
    @rin_input = unpack("C16", $m_pad);

    # init input with encrypted pad 
    $rin_input[0] = ($first4bytes_pad >> 24);
    # mask off excess bits for 64-bit systems in left shift
    $rin_input[1] = (($first4bytes_pad << 8 & 0xffffffff) >> 24);
    $rin_input[2] = (($first4bytes_pad << 16 & 0xffffffff) >> 24);
    $rin_input[3] = (($first4bytes_pad << 24 & 0xffffffff) >> 24);

    # get an 8-bit byte
    $rin_output = unpack("C", $ecb->encrypt(pack("C16", @rin_input)));
    # only the first bit of rin_output is used for each round
    $result |= ($rin_output >> 7) << 31;

    # loop through remaining 31 bits
    for (my $position=1; $position <= 31; $position++) {
        $first4bytes_input = (($address >> (32-$position)) <<
                             (32-$position)) |
                             # mask off excess bits for 64-bit systems
                             (($first4bytes_pad << $position & 0xffffffff) >>
                              $position);

        $rin_input[0] = ($first4bytes_input >> 24);
        # mask off excess bits for 64-bit systems in left shift
        $rin_input[1] = (($first4bytes_input << 8 & 0xffffffff) >> 24);
        $rin_input[2] = (($first4bytes_input << 16 & 0xffffffff) >> 24);
        $rin_input[3] = (($first4bytes_input << 24 & 0xffffffff) >> 24);

        # get an 8-bit byte
        $rin_output = unpack("C", $ecb->encrypt(pack("C16", @rin_input)));
        # only the first bit of rin_output is used for each round
        $result |= ($rin_output >> 7) << (31-$position);
    }
    # return anonymized, prefix-preserved address as a dotted quad string
    return inet_ntoa(pack("N", $result ^ $address))
}

1;

__END__