Check if encrypted text is equal without decrypting or doing heavy calculation - AES

Question

I implemented AES128-CBC algorithm and what I need is to be able to compare encrypted text without decrypting.
Is the only way to use static or no iv to achieve this?
. Any ideas?

Use in code -Something like :

select x from ins left join Users ui on ui.UserIDNumber=id

or Select * from users where userIdNumber = @userIdInput .
We encrypt the data in Angular

Use Case
User can type the field, we do a search and return him the matching records. Or he just asks for all the records and we return the records with the value still encrypted.
There's a button he can click if he wants to have the fields decrypted.

Answer 1

Don't use the same IV twice with CBC. The ciphertext reveals when two plaintexts start with the same 16-byte block. This makes it significantly easier to brute-force partially-known plaintexts to find them in your database, as well as to obtain partial information about records (e.g. with a plausible format, it might make it easy to find people with the same name).

In fact, you should not use CBC at all. CBC is an obsolete mode that is available in a lot of libraries and mentioned in a lot of documentation because it used to be a de facto standard. But since the 1990s our knowledge of block cipher modes has improved and we know that while CBC isn't broken, it's very tricky to use correctly. There are subtle attacks when two messages are encrypted with the same key and related, but distinct IVs. There are also subtle attacks when the IV is related to the ciphertext.

What you're looking for is called deterministic encryption. Normally, encryption is randomized or pseudo-randomized, so that if you encrypt the same message twice, an adversary can't tell that it's the same message by looking at the plaintext. Encryption modes achieve this by randomizing the IV, or at least ensuring that the same IV is not reused for the same message with the same key.

There's a trick to making deterministic encryption out of normal encryption: calculate the IV from the plaintext. If the IV only depends on the plaintext, then encrypting the same plaintext twice results in the same ciphertext.

There are modes called “synthetic IV” modes that use an IV which is partly a nonce (i.e. never reused with the same key) and partly derived from the message. If you feed a constant input as the nonce, you get deterministic encryption. Two popular choices are AES-SIV and AES-GCM-SIV.

If you're stuck with antique crypto libraries (the Javascript ecosystem is unfortunately not very good when it comes to crypto), you can still use CBC, but you need to be careful. To calculate an IV from the plaintext, use SHA-256, which is commonly available and fast. But don't just take SHA-256(plaintext): the IV needs to be stored in the database (otherwise you can't decrypt), so the IV calculation must involve a secret key. You can use the first 128-bits of SHA-256(K1 + plaintext), where K1 is a (at least) 128-bit secret key. Use a different key from the AES encryption key because it's bad hygiene to use the same key for the same purpose, although it doesn't actually matter in practice because SHA-256 and AES are completely unrelated.

Answer 2

I implemented AES128-CBC algorithm and what I need is to be able to compare encrypted text without decrypting. Is the only way to use static or no iv to achieve this?

I believe that the core problem is "how do I encrypt data in such a way that I can find matching plaintexts with minimal processing?"

Well, the easiest way I can think of is deterministic encryption. That is, whenever you encrypt a specific text, you always encrypt it into the exact same ciphertext. This makes finding matching plaintexts easy (you just look for matching ciphertexts).

Now, using the same IV whenever you encrypt would do this; however this has an issue. With CBC mode, that would also leak when two different plaintexts have the same first 16 bytes (even if they differ afterwards); this may be leaking more than what you'd desire. On the other hand, if the field length is always 16 bytes or less, this does work.

Assuming that the field can be longer than 16 bytes, well, since you have implemented CBC mode anyways, the easiest thing to do is use an IV which is a function of the plaintext (and hence encrypting the same plaintext twice would use the same IV). If you compute the CBC-MAC (which is essentially "perform a CBC mode encryption with a fixed IV, except you tweak the last plaintext block and discard everything except the last ciphertext block - that last ciphertext block is the result of the CBC-MAC computation), you can use that as the IV for the normal CBC mode encryption. In addition, when decrypting, when you get the plaintext, you can recompute the CBC-MAC of the plaintext you get and compare that with the IV - that gives you some integrity protection (the attacker can replace one field entry with another - we can't prevent that if we use deterministic encryption).

Answer 3

First of all, you need the same encryption key and the IV that were used during encryption to decrypt your data. I guess each field has its own key and IV. If you want to compare arbitrary string m (in plaintext) with encrypted data e, you can always compute x = Enc(m, key, IV) and compare x == e.

If only user has access to keys and IVs, then you have to script search button to send encrypted input.