Storing email adress encrypted but deterministically

Question

As part of an application I am developing, I am required to store user email adresses on a cloud DB. The email address is not required to be in plain text for the normal operation of the application.

So, to provide security, the email address is being encrypted and then stored in the database. The email address in the encrypted form will be the primary means of identifying users (it is the primary key).

Given these facts, which of the following encryption methods makes sense if the database server is vulnerable to attacks.

Method 1:

Encrypted-Email-Address = Asymmetric Cipher(Pub-Key2, 
               Asymmetric Cipher(Pub-Key1, Plain-text-Email-address))

No random padding will be used to allow for deterministic mapping between plain and cipher email addresses, hence encryption twice

OR

Method 2:

Encrypted-Email-Address = Symmetric Cipher(Key, Plain-text-Email-address)

Note that because decryption is not required for the normal operation, the private Keys in method 1 will be stored offline in the physical world. The encryption will need to be deterministic though because the email address is the primary key.

I did go through https://stackoverflow.com/questions/6980044/using-asymmetric-encryption-to-secure-passwords. But there the OP is looking to store a non primary key field, so I am unable to use it.

Are you aware of any better methodologies which solve this use case?

Answer 1

As far as I can tell, you're using the email address for 2 separate purposes, so why not store it twice?

In one column, you could store a hashed version, much like you would store a password. That's deterministic, so you can use it to look up a user by their email address.

Though, as others have mentioned, it's not a good idea to use it as a primary key. Use a surrogate key (e.g. an auto-increment) and create a unique index on the email column.

Then in a second column, you'd have an asymmetrically-encrypted version that you can decrypt with an offline private key if you ever need to. This one would not need to be deterministic, so you can use standard asymmetric encryption.

Answer 2

Email addresses are subject to enumeration. There are not so many email addresses. Any deterministic scheme which uses no secret (i.e. no key that a possible attacker knows of) will do nothing against that. I don't know what you suppose that the "double asymmetric encryption" with two public keys achieves; but I know that it does not fix that core problem. Public keys are public.

Symmetric encryption, with a key that the attacker does not have, can be deterministic and yet safe (if done properly) but this hardly applies to your situation, since while you don't need decryption, you do need to encrypt a lot, because the user's email address is what the user types in.

An additional problem with email addresses is that they are not always reproducible: users may employ different casings (case is not significant in the domain part, after the '@', but it may be significant in the local part), use variants (many people have '[email protected]' and '[email protected]' as valid addresses) and include "comments" (as in '[email protected]') with a site-specific notion of what constitutes a "comment". As @Stephen suggests, it is better to simply allocate an ID to each user and use that ID as primary key.