If you consider what users type as a string, you can validate it matches a
certain format with a regex, and the function `matches(., 'your regex')`.
For validation, would this work for you?
Replacing the first 5 digits by "*" is a bit more tricky. You could do this
in a calculation, but that would also replace them in the data, which I
imagine you don't want. So, I think that if you also need this, you would
need to create your own XBL component, which would have the ability to show
to users something different than what is stored in the data.
As a side-note, I know that the goal is to prevent someone looking over the
user's shoulder to see the SSN after it has been entered, but having a
textfield where "55-555-5555" is replaced by "**-***-555" on tab out can
also be confusing. What is the user comes back to the field, and changes
"**-***-555" into "**-***-556"? Should you then change the stored value to
"55-555-5556"? If you need this, I think that it would be better if the
field changes its value back from "**-***-555" to "55-555-5555" when the
fields gets the focus. But again, you would need to create an XBL component