In my application I have an SQLite database that stores labels for images, like this:
The LABEL column is indexed as it is important that I can efficiently find all images with a certain label.
At rest I would like to encrypt those labels so that no one can learn the actual labels. Unfortunately encrypting the whole database seems difficult as it is not officially supported by rusqlite, the library I'm using. So I will have to resort to encrypting the labels before inserting them into the database. Of course it will still be possible to see which two images share a label, that is alright.
I am already using XChaCha20Poly1305 in another part of the application, but I'm not married to it if another cipher is better suited.
My question is where to safely get the nonce from.
I believe simply using the same nonce (maybe derived by HKDF together with the key) for all labels would be the infamous nonce reuse that is deadly for AEAD ciphers, including XChaCha20Poly1305? Can I use a hash of the label as nonce, i.e. derive the nonce from the plaintext? Or do I need to generate one random nonce per label and store them in the database, indexed by a hash of the label?