I've been trying to use KMS to store sensitive personal data. We generated a CMK and are using the API/Encrypt over https. The idea was to store login information (emails) using KMS, we are using a password less authentication (JWT). This email data could potentially be decoded if some feature requires it but that's not the issue here.
I know that encrypting the same input using envelope encryption will give me a different result every time thus why encrypted keys need to be stored alongside the encrypted result, but i want to do one way-comparison to enable secure logins.
I need KMS to use the same key (therefore not envelope encryption right?) for every encrypt call so i can compare encrypted results. Is this something that can be done using KMS? Do i need to manually generate a key and securely store it in CMK to allow this or can i use a KMS-generated key? I've read all the KMS documentations but it's still a bit fuzzy and i can't find a decent source clearly explaining all this. My PoC clearly returns a different result every time.
I sincerely hope i'm asking the question in the right place, i dont think it's well suited for SO. Thanks!