A group of bankers will store sensitive financial information on a server owned by a third party. I represent the 3rd party server.
The financial information will be stored as plain text on the server except that the customer's Account Numbers will be encrypted. The banks do not want us to know their customers' account numbers.
My question is, how safe is it to use the Account Number as a nonce if it is also the message being encrypted when using AES-GCM? So, how safe is it to encrypt as follows: AES-GCM[Key, Nonce = AccountNumber, Message = Account Number].
I know this is an example of deterministic encryption and it would be best to use GCM-SIV mode but I cannot find any libraries that implement this encryption that I can use with the .NET Framework.
On a side note, has anyone ever used Miscreant .NET? As far as I know it has not received FIPS compliance.
Here is an example of the design:
Note, that the AccountNumber is a primary key and will not be repeated. Therefore, nonce = message = AccountNumber will never be repeated.
PK*AccountNumber Balance Nonce
1 $10,000 1
2 $15,000 2
3 $20,000 3
3rd Party Server
If the Banker wants to query the 3rd party server for the balance of AccountNumber = 1, he will query the server for AES-GCM(Key,Nonce=1,Message=1)='A2B3C4'. Since only the banker knows the Key and AccountNumber only he can know which record to query for. This is in essence a zero-knowledge encryption scheme where only the Banker has any knowledge of the key, nonce or message.