As part of an application I am developing, I am required to store user email adresses on a cloud DB. The email address is not required to be in plain text for the normal operation of the application.
So, to provide security, the email address is being encrypted and then stored in the database. The email address in the encrypted form will be the primary means of identifying users (it is the primary key).
Given these facts, which of the following encryption methods makes sense if the database server is vulnerable to attacks.
Method 1:
Encrypted-Email-Address = Asymmetric Cipher(Pub-Key2,
Asymmetric Cipher(Pub-Key1, Plain-text-Email-address))
No random padding will be used to allow for deterministic mapping between plain and cipher email addresses, hence encryption twice
OR
Method 2:
Encrypted-Email-Address = Symmetric Cipher(Key, Plain-text-Email-address)
Note that because decryption is not required for the normal operation, the private Keys in method 1 will be stored offline in the physical world. The encryption will need to be deterministic though because the email address is the primary key.
I did go through https://stackoverflow.com/questions/6980044/using-asymmetric-encryption-to-secure-passwords. But there the OP is looking to store a non primary key field, so I am unable to use it.
Are you aware of any better methodologies which solve this use case?