I'd like to use a possibly insecure cache for storing expensive-to-calculate sensitive information. My requirements are:
- If the cache ever gets compromised it should reveal nothing about its ids or values (except for the number of records/size of the database).
- If both the client and the cache are compromised, but not (all of) the ids, then attackers should not be able to get access to values they do not know the id of.
What would be a simple secure way of accomplishing this? I've tried to create a scheme matching these requirements:
- Each client has their own strong password $P$.
- A per-id encryption key is derived from the password: $K = HMAC(P||"key", id)$. (A HMAC with as key the password with the literal
keyappended and the actual id as message)
- The plain text value $V$ is encrypted using AES-CTR into ciphertext $C$: $C = AES-CTR(key=K, message=V)$
- Instead of using plain ids, they are one-way hashed: $I = HMAC(P||"id", id)$
- The combination of $(I, C)$ is then stored in the cache.
To get a value from the cache we calculate $I$ and use it to retrieve $C$. We then recalculate $K$ and use it to decrypt the message.
Would this scheme be secure? Or is there a better way of solving this problem?