There are multiple vendors of products that claim that their products perform what they have called vaultless tokenization or reversible tokenization, without storing the token and associated tokenized data. However, they also say that tokenization is not the same as encryption, and that they have a proprietary algorithm which tokenizes and de-tokenizes input data.
My question is - isn't this really just fancy encryption (and if it keeps the shape of the source data, possibly even less secure than typical encryption)?
I thought the original idea behind tokenization was that you generate a set of pseudo-random data, assign that pseudo-random data to the input data, and store the mapping between the two in a hardened vault. If you then store the tokens in your less secure systems, and data is stolen, it will be virtually impossible for an attacker to de-tokenize the data, unless they also have a copy of the mapping in the vault.
If the token is derived from the source data, doesn't that make it much easier to attack (assuming the mapping is not also stolen by the attacker), since it's really just an encrypted version of the source data?