Building Searchable Encrypted Databases with PHP and SQL

Re:Building Searchable Encrypted Databases with PHP and SQL by Quiark on Wednesday May 31, 2017 @09:13AM (#14452187)

I agree that the HMAC approach is better but a proper deterministic encryption would work just fine, wouldn't it? You're comparing your method with ECB mode which is a bit unfair.

[ Parent | on HN ]

Re:Building Searchable Encrypted Databases with PHP and SQL by CiPHPerCoder on Wednesday May 31, 2017 @09:27AM (#14452288)

What are some constructions you'd consider "fair"?

[ Parent | on HN ]

Re:Building Searchable Encrypted Databases with PHP and SQL by Quiark on Wednesday May 31, 2017 @10:02AM (#14452568)

AEAD cipher with nonce generated from plaintext? That would have equivalent security properties except for being needlessly complicated?

[ Parent | on HN ]

Re:Building Searchable Encrypted Databases with PHP and SQL by CiPHPerCoder on Wednesday May 31, 2017 @10:21AM (#14452718)

So you mean something like this?

    $nonce = sodium_crypto_generichash($message, '', 24);
    $ciphertext = $nonce . sodium_crypto_aead_xchacha20poly1305_ietf_encrypt(
        $message,
        $nonce,
        $nonce,
        $key
    );

That solves the literal search problem, but none of the others.

However, in my experience[1], when it comes to deterministic encryption, most PHP developers will use ECB mode, or CBC mode with a NULL IV.

[1]: https://meta.stackoverflow.com/q/293930/2224584

[ Parent | on HN ]