Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose I am storing a number of encrypted documents in a database. I would like to make it possible to identify the subset of documents whose contents match user-specified search terms without a) maintaining a plaintext index or b) decrypting documents on the fly. Is there any way to accomplish this securely?

By the same token, I'm wondering if a collection of encrypted documents can be sorted according to an encrypted attribute (e.g., document title) without first decrypting all attribute values.

share|improve this question
this might be the answer I'm looking for: – nw. Aug 3 '12 at 19:34
1 might be worth looking at too. – mikeazo Aug 3 '12 at 22:19
up vote 7 down vote accepted

Yes. If you encrypt the documents with this purpose in mind (you have to use a special kind of encryption algorithm), then yes, it is possible to do this, for certain kinds of search queries.

There is a rich research literature on this topic. The buzzword is "search on encrypted data". I'll point you to a few sample papers in this space. Do a literature search, and you should be able to find many more for yourself.

The best scheme for your situation will depend upon your application requirements. If you have a read-mostly database (updates are rarer than searches), then I would suggest a scheme based upon encrypted indexes. If you need to make modifications frequently, or if searching is relatively rare, the other schemes might be preferable.

share|improve this answer
I'll put this in a comment because it's not directly related: 'Structured Encryption and Controlled Disclosure' Chase and Kamara 2011 – pg1989 Aug 21 '13 at 18:54

Well, if you have documents encrypted with SHA512 or MD5 or any one-way crypto, the only possibility you have is to encrypt search terms with the same crypto and make the query to the DB.

share|improve this answer
You'll have to add more detail here. Simply doing this does not work because of the all-or-nothing property, H("keyword") is designed to be independent of H(document containing "keyword"). You need a more elaborate scheme for this to work. – Thomas Aug 4 '12 at 2:18
You're right. I forgot that. Sorry. – Luis Arriojas Aug 4 '12 at 2:27
SHA512 and MD5 are not encryption. They are hashes. – D.W. Aug 4 '12 at 21:48
Yes, just yesterday I read that in a blog about IT security. – Luis Arriojas Aug 23 '12 at 20:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.