Tell tokenisation, masking and encryption apart by what survives

applied · 75 min · Objective 1.4

Task

Implement all three protections over the same synthetic dataset, then try to recover the original values from each. What you can and cannot get back is the whole distinction, and it is much sharper once you have failed to reverse the right one.

Steps

  1. Generate /tmp/records.csv with twenty synthetic rows: id,name,card where card is a made-up 16-digit string. Use python3 and a fixed seed so the set is reproducible.
  2. Masked copy: write /tmp/masked.csv showing only the last four digits, as **** **** **** 4471.
  3. Encrypted copy: encrypt the card column with a key you hold, using openssl enc -aes-256-cbc -pbkdf2 per value, into /tmp/enc.csv.
  4. Tokenised copy: write /tmp/tokens.csv replacing each card with a random token from openssl rand -hex 8, and keep the mapping in a SEPARATE file /tmp/vault.csv that you then move out of the working directory.
  5. Now attempt recovery from each, holding only that file: from the masked copy, from the encrypted copy without the key, from the encrypted copy with the key, and from the token file without the vault.
  6. Record in /tmp/recovery.md which attempts succeeded and, for each failure, WHY — whether the information is absent, or present but protected.

Verify

python3 - <<'PY'
import csv
def col(p,i):
    return [r[i] for r in list(csv.reader(open(p)))[1:]]
orig=set(col('/tmp/records.csv',2))
for path in ('/tmp/masked.csv','/tmp/enc.csv','/tmp/tokens.csv'):
    vals=set(col(path,2))
    leak=orig & vals
    print(path, 'leaks', len(leak), 'original value(s)')
    assert not leak, path+' still contains original card values'
print('no protected file contains an original value')
PY
grep -ciE "vault|key|absent|irreversible" /tmp/recovery.md

The assertion is the verification: none of the three protected files may contain an original value, which catches the common mistake of masking the display column while leaving the real one in place. The grep confirms you wrote down the reasoning rather than only the result.

Notes

The distinction that should now be concrete: the encrypted file HAS the data and needs a key; the token file does NOT have the data at all and needs the vault; the masked file has irreversibly discarded it. That is why a stolen token database is worthless and a stolen encrypted database is a race against key management.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.