Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to implement a search over encrypted data. I found a blogpost, which explains 3 methods. One method is to use deterministic encryption, which I'm trying to implement. But my use case is a little bit different.

My application provides end-to-end-encrytpion, so that I (as the service provider) cannot read user data. The data is encrypted on the user's client. Now I want to search through data of different users. The search function and it's results aren't public, they will only be used internally to calculate some metadata, which is sent to the data owner. I don't need to know the unencrypted data, only their relationship. The data isn't natural language so frequency analysis or dictionary attacks shouldn't be a problem, for example person names and email adresses.

To make the encryption deterministic, I have to use the same salt for each data and it's known by everyone. (For example I would use bcrypt's hashpw function always with salt "staticsalt".)

  • Is this still secure enough or does using the same salt for everyone making it useless?
  • If it's useless, how should I implement a search through encrypted data of multiple users? The other two search methods in the blogpost don't seem to provide multi-user functionality.
share|improve this question
What operations do you need to do on the encrypted data? If you want to sum encrypted data or something like that, CryptDB might be worth looking into. Of course, you're sacrificing some security for some added functionality, so you'll have to decide if that's worth it. – Neil Fitzgerald Jun 26 '14 at 21:36

What you are looking to do cannot be made secure. Regardless of the implementation, if it is possible to efficiently search across multiple users, then the scheme is necessarily vulnerable to dictionary attacks. Note that it is very likely an attacker would be able to obtain a large list of names and email addresses. The best you can really hope for is to slightly obfuscate the data such that nothing would be learned from a casual glance.

share|improve this answer

Deterministic encryption using a one way function and a salt to protect against dictionary attacks will definitely make the data searchable and secure. Using the same salt doesn't make it useless so long as the salt remains secret. Using this method would make the search somewhat limited though as your search value must hash to the exact value that's stored in the database, but if you know the exact manner in which the data is stored and it is stored in such a way that there aren't many ambiguities, then you should be able to efficiently pull this off.

share|improve this answer
Thanks, for your answer. I think I have to add more details to my question. The salt is known by every client application and therefore could be extracted... (I didn't downvote.) – Marvin May 13 '14 at 14:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.