I want to implement a search over encrypted data. I found a blogpost, which explains 3 methods. One method is to use deterministic encryption, which I'm trying to implement. But my use case is a little bit different.
My application provides end-to-end-encrytpion, so that I (as the service provider) cannot read user data. The data is encrypted on the user's client. Now I want to search through data of different users. The search function and it's results aren't public, they will only be used internally to calculate some metadata, which is sent to the data owner. I don't need to know the unencrypted data, only their relationship. The data isn't natural language so frequency analysis or dictionary attacks shouldn't be a problem, for example person names and email adresses.
To make the encryption deterministic, I have to use the same salt for each data and it's known by everyone. (For example I would use bcrypt's hashpw function always with salt "staticsalt".)
- Is this still secure enough or does using the same salt for everyone making it useless?
- If it's useless, how should I implement a search through encrypted data of multiple users? The other two search methods in the blogpost don't seem to provide multi-user functionality.