Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sorry for my dumb question, but it's better to ask dumb question than to do dumb things silently.

I want to encrypt user email in my DB so that if someone stole the DB (and not the key) - he won't be able to restore the email adresses. But I need to be able to find user by email in my DB. And I can't iterate over all the emails in the DB, decrypt each and compare - this is too slow (minutes, hours).

If I encrypt emails with AES with random IV - then each time I encrypt the same email - the encrypted value is different. This is great for security but this way I can't just encrypt the given email and search for a value. If the IV is the same each time - then as far as I understand if attacker have enough encrypted values - he can easily find the key, right?

I was thinking about storing original email hash alongside the encrypted value, but this way attacker will be able to recover original email values by encrypting emails from some dictionary with the same hash algorithm and comparing hash values with values in the DB.

I thought about storing hash of original email+some_fixed_secret. Is this secure? If not - is there a secure solution to my problem?

share|improve this question
    
While you say "find user by email", it seems like you're describing finding emails by username. $\hspace{.12 in}$ –  Ricky Demer May 28 '13 at 17:39
1  
Why not just eschew the IV altogether and use a deterministic scheme? There are lots of recent results showing good provable security for deterministic schemes. Look at Boldyreva's CV for a couple of them. –  pg1989 May 28 '13 at 17:40
    
Ricky Demer, email is used not only as a login, e.g. for finding user friends already registered in the system (given the exported list of his contacts from other system), for ensuring email uniqueness etc. –  Mikhail May 28 '13 at 17:50
    
pg1989, thanks! Using your advice I found some links at en.wikipedia.org/wiki/Deterministic_encryption including Boldyreva's work. Need to study them. –  Mikhail May 28 '13 at 17:57
    
A fixed IV doesn't allow to find the key, but might allow decrypting other ciphertexts, depending on the encryption scheme. But you actually only need a one-way function. –  Paŭlo Ebermann May 28 '13 at 17:58
show 6 more comments

1 Answer

up vote 2 down vote accepted

I ended up with the following solution:
For each email store two values: encrypted email and signature for the email.
For encryption I used AES in CBC mode with random IV.
For signing I used HMAC SHA256.
The keys used for encryption and for signing are different.

Later on I found the following link: docs.oracle.com. So looks like this is pretty standard approach.

share|improve this answer
    
+1 Looks good. For some applications, if the attacker already has an email address on his list, then he can already send spam to that address -- it doesn't hurt anyone if that attacker can confirm that you have the same address on your list (or not). So for those applications, non-keyed hash functions are adequate. See suppression list and Store hashed email and compare hash values. –  David Cary Jun 3 '13 at 5:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.