Looking for suggestions on implementing a server-side lookup table, where the key is an email address.
Goal: Keep these email address private, even if data on the server is stolen.
Assumptions: The server does not need (and ideally should not know) the email address. Clients cannot directly talk to each other, but it's going to be a web/native app so they can can perform some calculations before making queries.
Is this achievable? Note: Just storing a hash of the email on the server would leave the keys vulnerable to a dictionary attack. The server also can't simply add a salt for each hash, because it would not know which salt to use when presented with a specific email address. I could encrypt the hashed emails with a global key stored separately, but I'm hoping there are better solutions than this.