3

I want to implement a search over encrypted data. I found a blogpost, which explains 3 methods. One method is to use deterministic encryption, which I'm trying to implement. But my use case is a little bit different.

My application provides end-to-end-encrytpion, so that I (as the service provider) cannot read user data. The data is encrypted on the user's client. Now I want to search through data of different users. The search function and it's results aren't public, they will only be used internally to calculate some metadata, which is sent to the data owner. I don't need to know the unencrypted data, only their relationship. The data isn't natural language so frequency analysis or dictionary attacks shouldn't be a problem, for example person names and email adresses.

To make the encryption deterministic, I have to use the same salt for each data and it's known by everyone. (For example I would use bcrypt's hashpw function always with salt "staticsalt".)

  • Is this still secure enough or does using the same salt for everyone making it useless?
  • If it's useless, how should I implement a search through encrypted data of multiple users? The other two search methods in the blogpost don't seem to provide multi-user functionality.
  • What operations do you need to do on the encrypted data? If you want to sum encrypted data or something like that, CryptDB might be worth looking into. Of course, you're sacrificing some security for some added functionality, so you'll have to decide if that's worth it. – Neil Fitzgerald Jun 26 '14 at 21:36
1

What you are looking to do cannot be made secure. Regardless of the implementation, if it is possible to efficiently search across multiple users, then the scheme is necessarily vulnerable to dictionary attacks. Note that it is very likely an attacker would be able to obtain a large list of names and email addresses. The best you can really hope for is to slightly obfuscate the data such that nothing would be learned from a casual glance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.