What we're looking for
A solution where data is stored and retrieved (!) from a server using a
person ID that can only be known at the client (form of anonymization). Furthermore, the client should be able to calculate the original
person ID back from a data record.
Storing certificates on the client is not an option, asking the user for a password is.
My original idea
PBKDF2 + AES (CCM) on the client. However, because we need to be able to retrieve records later, I had to keep the IV (and salt) constant. For what I've read, this could be a problem (but I'm not sure, especially if the
person ID is always smaller than the key?).
My alternative idea
PBKDF2 + AES (CCM) on the client, now with random IV. This can now only be used for calculating the
person ID from a data record. For data retrieval we would add a separate column, containing a client-calculated hash of the
person ID. To prevent against an attack that hashes all valid
person ID's and works back from there, I was thinking to salt with the same user supplied password as we used for encryption (since this can be expected to never leave the client).
I could really use some thoughts on this challenge (and the two ideas described above).