Building Searchable Encrypted Databases with PHP and SQL

Re:Building Searchable Encrypted Databases with PHP and SQL by piotrkaminski on Wednesday May 31, 2017 @04:36AM (#14451102)

I was specifically after a deterministic encryption scheme that would allow for exact-match comparisons and whose deployment was fairly foolproof (so a non-expert couldn't screw it up too badly), which AES-SIV appears to provide nicely. Another benefit in my case is that I'm using a NoSQL database where separating the encrypted value from its indexed value is not always practical, so having a single value that serves both purposes is highly desirable.

I'm not familiar with the other schemes you mentioned, but the practical reason for using AES-SIV is the converse of yours for not using it: there's an implementation for JavaScript. :) It's unlikely there are implementations for the other schemes you listed.

I agree that the Bloom filters are a nice natural outcome of your approach, though it would also be possible to combine AES-SIV for primary encryption with a truncated HMAC for partial match Bloom filters.

[ Parent | on HN ]

Re:Building Searchable Encrypted Databases with PHP and SQL by CiPHPerCoder on Wednesday May 31, 2017 @04:43AM (#14451123)

Here's the killer feature of my approach: Each filter has its own HMAC/Argon2 key, so it becomes less useful for what I like to call crossword puzzle attacks. (I hope that's easier to understand than a wordy explanation of how such an attack would work.)

[ Parent | on HN ]